Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/07/2026, 20:24
Behavioral task
behavioral1
Sample
2026-07-28_8a26bd73d92f4889b8f66c1d4778d507_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-28_8a26bd73d92f4889b8f66c1d4778d507_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-07-28_8a26bd73d92f4889b8f66c1d4778d507_elex_wannacry.exe
- Size 120KB
- Sample260728-y6vsvsvera
- SHA256 aff412d03f981dc78c57d650a0fed9b9f4d429b72dca951a4a23f399bdcaa577
- MD5 8a26bd73d92f4889b8f66c1d4778d507
- SHA1 8ddeef33308346f2e7de23c8b2aa3e63f3bcb84f
- SHA512 4de7a6e26a86ba67f8312a46d4c98a55b06cd612710721f1cccfa7c26b1a3fa702532e92a29ed1a0ef193ad4dcdb70c6ccabee3859c3bea0668442a7d74cee49
- SSDEEP 768:W7BlpQpARFbh2UM/zX1vqX1vLFB5W5KcMcoYJIJDYJIJVY1+kwk4Iixia:W7ZQpApjIKTie+efYgPUiV
- TLSH T187C33ADAEFD18C93F3193034A8E7B261B275E4D01F5B9F7B5AA148B91E80DB01D8118B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 2 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000800000001b884-9.dat family_cosmu behavioral2/files/0x000c00000001c540-12.dat family_cosmu - Renames multiple (4136) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Executes dropped EXE 2 IoCs
pid Process 4144 _OnLineTPV.exe 1436 Zombie.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Zombie.exe 2026-07-28_8a26bd73d92f4889b8f66c1d4778d507_elex_wannacry.exe File opened for modification C:\Windows\SysWOW64\Zombie.exe 2026-07-28_8a26bd73d92f4889b8f66c1d4778d507_elex_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.NETCore.App.deps.json.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationClient.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Diagnostics.EventLog.Messages.dll.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\lib\cmm\GRAY.pf.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ul-phn.xrm-ms.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\WindowsFormsIntegration.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.Design.Editors.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\MAPIR.DLL.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\tpcps.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Primitives.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.DispatchProxy.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Reflection.Extensions.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\glib.md.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\lib\sa-jdi.jar.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusDemoR_BypassTrial365-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Grace-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.IO.Compression.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Accessibility.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\WindowsBase.resources.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\WindowsFormsIntegration.resources.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\lib\ant-javafx.jar.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\bin\server\classes.jsa.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Xaml.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationFramework.resources.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Banded Edge.eftx.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial3-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.PPT.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Net.WebSockets.dll.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\PresentationCore.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Csp.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationProvider.resources.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processthreads-l1-1-1.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.ComponentModel.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Forms.Design.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\WindowsBase.resources.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\thaidict.md.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\lib\deploy.jar.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\qps-ploc\tipresx.dll.mui.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Cng.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\Microsoft.CSharp.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\UIAutomationClient.resources.dll.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\lib\jfxswt.jar.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp Zombie.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-pl.xrm-ms.tmp Zombie.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-28_8a26bd73d92f4889b8f66c1d4778d507_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Zombie.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language _OnLineTPV.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4964 wrote to memory of 4144 4964 2026-07-28_8a26bd73d92f4889b8f66c1d4778d507_elex_wannacry.exe 88 PID 4964 wrote to memory of 1436 4964 2026-07-28_8a26bd73d92f4889b8f66c1d4778d507_elex_wannacry.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-28_8a26bd73d92f4889b8f66c1d4778d507_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-28_8a26bd73d92f4889b8f66c1d4778d507_elex_wannacry.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\_OnLineTPV.exe"_OnLineTPV.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4144
-
-
C:\Windows\SysWOW64\Zombie.exe"C:\Windows\system32\Zombie.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1436
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-552508041-2681165170-3229858294-1000\desktop.ini.tmp
- Size 95KB
- SHA256 7ff7d6fe1b38f303088b1acafe94fe21f76f080b0f6e29007dcef740f63d1d22
- MD5 692cdd6b8823bb89ef594e71acae78a0
- SHA1 9b57c03d35d484f375933de139259bb43c919565
- SHA512 ad3a87897f10db7c06f86c7408f6b6bb3c5d4a6d9833889c912c9717e0fdcb707f395d7b1004048eb61a602374ccba6499cd576d715268b9c5a7abb69633d22d
- SSDEEP 768:W7BlpQpARFbh2UM/zX1vqX1vLFB5W5KcMcoYJIJDYJIJZ:W7ZQpApjIKTie+eL
- TLSH T139A3298BEBE1D453F75D7830399B3168A5A1D8D0BF2FBDB966E349D81C90CB44A011CA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_OnLineTPV.exe
- Size 24KB
- SHA256 f9c97332b9083ad7a87f270f2df64528e219f48f052731972775113c71a18196
- MD5 415f808afc05cfef5ffc37f7887f51dc
- SHA1 70fa9f4bc42cae808d6644b3c391457fa147d9c5
- SHA512 2559aba5c9858be12c931a6747495ceb19ab19acee17b234f652a0e45398dda79fc37f584cca0ff978fcb2e6c3e29e081ee14d37b36e2c0575a3e4dcdcb7dea4
- SSDEEP 384:+YhYnVrpwkj7JvGFFtk4t1cIAxbE9lY4a0kHhU2ixTdepLF7Sq9K:5Y1+kwk4IixiM
- TLSH T18FB262A1FE855DABF661227CCCF7D372A33DF1E10B838B0B4A20513A5752A512ED6607
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Zombie.exe
- Size 95KB
- SHA256 7ac6040a378416560f59a19e1aac8c060f0dd2825fb6571d739a3fd7133824e2
- MD5 02f6e456dbf327f767cc5836420f71c1
- SHA1 d25ff8599f9f9e74ff5b701ef807c719631845b3
- SHA512 23ef9bbe995728f77e81986063d38507062fe4d06e2114cedd05fa2cafc48ee235930cbd70e66a2356ec5488630838e99d12a5338ff9d06d54404a326c5088cf
- SSDEEP 768:W7BlpQpARFbh2UM/zX1vqX1vLFB5W5KcMcoYJIJDYJIJi:W7ZQpApjIKTie+eU
- TLSH T193A3298BEBE1D453F75D7830399B3168A5A1D8D0BF2FBDB966E349D81C90CB44A011CA
- MD5 SHA1 SHA512 SSDEEP TLSH