Analysis
- max time kernel
149s - max time network
129s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
28/07/2026, 16:59
Behavioral task
behavioral1
Sample
2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
- Size 54KB
- Sample260728-vhn4macr8z
- SHA256 589daf42d30b0cab03fdf2ecd0b3ef805dff6bff6cdec495b8366f0fb70d4097
- MD5 a89ae77f7f15f2943233e5d055efb995
- SHA1 f9f7b12c01f9d26fc2c46e903aea942d23da198e
- SHA512 f101a55b6951f1d4d9bf266c3891f28b8682ca84393dce5625ebe495abee262682b13d2d6f5cea9760fee09103b9ef8ea31a8d412cf0bf1d43c89be783d9473d
- SSDEEP 768:/7BlpQpARFbhIYJIJDYJIJPfFpsJcFfFpsJcXcMcrtzTzB:/7ZQpApze+eJfFpsJOfFpsJMT23
- TLSH T1D84328CE832CC152E60E3B749E33287874B2420CB497FCEFBE16D852A821AE5551795F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral1/memory/4872-0-0x0000000000400000-0x0000000000408000-memory.dmp family_cosmu behavioral1/files/0x000a000000016907-2.dat family_cosmu behavioral1/files/0x00040000000217fc-6.dat family_cosmu behavioral1/memory/4872-536-0x0000000000400000-0x0000000000408000-memory.dmp family_cosmu - Renames multiple (4961) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\rtscom.dll.mui.tmp 2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Trial-pl.xrm-ms.tmp 2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-ppd.xrm-ms.tmp 2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-ppd.xrm-ms.tmp 2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll.tmp 2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Thread.dll.tmp 2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationClientSideProviders.resources.dll.tmp 2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\cs\UIAutomationClientSideProviders.resources.dll.tmp 2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe File created C:\Program Files\Internet Explorer\de-DE\ieinstal.exe.mui.tmp 2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\lib\ir.idl.tmp 2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ppd.xrm-ms.tmp 2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-pl.xrm-ms.tmp 2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Timer.dll.tmp 2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Net.Primitives.dll.tmp 2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2native.dll.tmp 2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe File created C:\Program Files\Microsoft Office\FileSystemMetadata.xml.tmp 2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Banded Edge.eftx.tmp 2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ul.xrm-ms.tmp 2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\OFFSYMB.TTF.tmp 2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe File created C:\Program Files\Common Files\System\ado\msadomd28.tlb.tmp 2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Debug.dll.tmp 2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.EventBasedAsync.dll.tmp 2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jsound.dll.tmp 2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe.tmp 2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_es.properties.tmp 2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\nashorn.jar.tmp 2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-ppd.xrm-ms.tmp 2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\GB.XSL.tmp 2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\tr\System.Windows.Forms.resources.dll.tmp 2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp 2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Grace-ul-oob.xrm-ms.tmp 2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp 2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\SECURL.ICO.tmp 2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNoteFilter.dll.tmp 2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\sl.txt.tmp 2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll.tmp 2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp 2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-ul-phn.xrm-ms.tmp 2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-140.png.tmp 2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\offsym.ttf.tmp 2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\ru.txt.tmp 2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\msdasqlr.dll.mui.tmp 2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.IO.Compression.Brotli.dll.tmp 2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-ul-oob.xrm-ms.tmp 2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Trial-ul-oob.xrm-ms.tmp 2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ppd.xrm-ms.tmp 2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp 2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.reportviewer.common.dll.tmp 2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSO.FRAMEPROTOCOLWIN32.DLL.tmp 2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaTypewriterRegular.ttf.tmp 2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ul-oob.xrm-ms.tmp 2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-pl.xrm-ms.tmp 2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\officeinventoryagentfallback.xml.tmp 2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-140.png.tmp 2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\WindowsFormsIntegration.resources.dll.tmp 2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml.tmp 2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe File created C:\Program Files\CompressSplit.vssm.tmp 2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp 2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\msinfo32.exe.mui.tmp 2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ja\System.Windows.Forms.Design.resources.dll.tmp 2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue II.xml.tmp 2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Initialization.dll.tmp 2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OutlookLogoSmall.scale-140.png.tmp 2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\sv-SE\tipresx.dll.mui.tmp 2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-540052884-2969440504-464782435-1000\desktop.ini.tmp
- Size 54KB
- SHA256 59c00e732a74e7c2cb6122fb86620c5daee76d2d2515449fb791088e2981988a
- MD5 56500f275f42d9c9ca3cc0ca0f18044b
- SHA1 6faaa1c11ec3dbf5ca32db2bd72c1d5672fc0ec3
- SHA512 baede75d66b8c7ce69b5ff23ec18d0f040f3f6591e4bf94c8ed523eebb8cbec9b8f579e39a0e0b8e37cbdf02721683142cb9a95a619169abfa0221269545cb7d
- SSDEEP 768:/7BlpQpARFbhIYJIJDYJIJPfFpsJcFfFpsJcXcMcrtzTzc:/7ZQpApze+eJfFpsJOfFpsJMT2W
- TLSH T1894329CE8328C152E61E3B749E33287874B2420CB497FCEFFE16D852A821AE5551795F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 153KB
- SHA256 841273c7b16d4d5df99517583fbaa3e08517224c9a3da381fb7d1ca3fe92a3fe
- MD5 5e3c358dd26497bd7d76c2823f0fefe5
- SHA1 2e3bbf5cd5234ecf778d63d81d3998e58033adaa
- SHA512 ba3fb82f093a3e73c0e2b88deccff219e08f1136f259e3622e43cb421b34da32ff2a5e21f2d58fad7a5eaf6c2d27b8587e16f59ff831a1344d09a093ec5e6880
- SSDEEP 3072:9QWpze+eJfFpsJOfFpsJQ5ZMfTiu66I3UwqSsMBlsWb4A+f:Lpe+e/MfTinqncsWp+f
- TLSH T171E3F7907C6EF2A0CF482339AE2B5EB39201398E3C5ACD86B665D5E3913CD950C574E7
- MD5 SHA1 SHA512 SSDEEP TLSH