Analysis
- max time kernel
150s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/07/2026, 22:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe
- Size 13.6MB
- Sample260728-2wlc8acd26
- SHA256 6b83134a5f4afbdb34a0117c7d2ca443d75885c4ac16d54452c1cd1bf660cf8a
- MD5 5de254f14b7f59aed8fe5b7afd4db277
- SHA1 2888022c76213fef1dcf0f547cb4cc441c9dc99c
- SHA512 db4daf5f6228cee191ba7936a15a2d1d6b8b94b718340f0d7f9a4bbd935dd322f3ba6c3da5d43c020a7393c639e97b312bbfe32d118c20bfc370952425e8ea01
- SSDEEP 393216:OefhDMNxt76nZRFMLMYXM/jWbaD4WHZc3C0CDePpNbDhDj:phDMPAnbFMYBjWbaDlHcdpHP
- TLSH T11DE63330569AB361F3A461309B61F9512E947E50F0D0EDDBE9018B2B6EB2F91F425CCB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Renames multiple (199) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\Lang\cs.txt.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\ka.txt.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\kaa.txt.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\kab.txt.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\cpprestsdk.dll.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\lij.txt.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.bg-bg.dll.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\hr.txt.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\7-Zip\7z.sfx.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\be.txt.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\ext.txt.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\ky.txt.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.de-de.dll.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\7-Zip\7zFM.exe.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\da.txt.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\gu.txt.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\tk.txt.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\tr.txt.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ar-sa.dll.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\eo.txt.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\hy.txt.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\pl.txt.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\7-Zip\Uninstall.exe.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\fi.txt.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\pt.txt.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fi-fi.dll.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ru-ru.dll.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\7-Zip\descript.ion.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\de.txt.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\eu.txt.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\ta.txt.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.uk-ua.dll.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\cy.txt.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\es.txt.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\ja.txt.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\yo.txt.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pl-pl.dll.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\mn.txt.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\nn.txt.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\uk.txt.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.tr-tr.dll.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\he.txt.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\is.txt.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\bn.txt.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe File created C:\Program Files\7-Zip\7zG.exe.tmp 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-28_5de254f14b7f59aed8fe5b7afd4db277_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1738198120-2966725515-3980530802-1000\desktop.ini.tmp
- Size 13.6MB
- SHA256 226141fb63e5ecf3f90a8ba21b53ca169f5daceab7cde668f6f7c438710ef182
- MD5 cc8fb8e50aa43a42adf6b335b339a203
- SHA1 d70191c15554c898553b7170ea11d401c4fc85d7
- SHA512 1a0d99cfc90a093f4e11b29ba87a05b27bb4465fba2600d03a80d1e29c53b045150ef100bef27d9f690d47848e2e3731d609e1c72092debeb17e9f1f1f9fd86e
- SSDEEP 393216:OefhDMNxt76nZRFMLMYXM/jWbaD4WHZc3C0CDePpNbDhD3:phDMPAnbFMYBjWbaDlHcdpHz
- TLSH T1C9E63330569AB361F3A461309B62F9512E947E50F0D0EDDBE9018B2B6DB2F91F425CCB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 13.7MB
- SHA256 5c7f1332afd78e5236b85979919ceb7effab5740517bcb40889171d1ae54a5d9
- MD5 be16d82f4f0fa8ad955c87ad39ac1307
- SHA1 f50bec32f8e0dd4ee1f726b74a2dc2e25987502c
- SHA512 a5b98b76f84abc9442250c3d9b4ab3083d5f52a495046a1ec4d757b6f4d20b3105a2b087b79f83d93489d1e90f7ae8cad0d97aab43d0c20a2457a12f8cb059ff
- SSDEEP 393216:OefhDMNxt76nZRFMLMYXM/jWbaD4WHZc3C0CDePpNbDhDt:phDMPAnbFMYBjWbaDlHcdpHx
- TLSH T103E6333079AEF261EB942230AA63FE439E443D50BCC4DD87AA114767AD71F9168278C7
- MD5 SHA1 SHA512 SSDEEP TLSH