Analysis
- max time kernel
150s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/07/2026, 20:13
Behavioral task
behavioral1
Sample
2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe
- Size 58KB
- Sample260728-yzm5favdkc
- SHA256 d957a99ad0dc38a807abbb9f401b7bea2040063618a79ab7562dbe03eeef2f0d
- MD5 a390c908f75932873f8d439a04ec92db
- SHA1 e23d02426df473f19b8901a82eee106a1ed70281
- SHA512 98085e18f328631b1e1f8f8ca1e70814627b614ac2d26c38152e2272bcc06d533bebffebd1cd886beb71042c44a391d8f0b0e6b60c226e4ca95991b041fe8a12
- SSDEEP 768:W7BlpNLpARFbhblkYlkrt8PWGoPWGqMs1MsR5nd5n:W7ZNLpApCZrt8PWGoPWGANdN
- TLSH T183433A3EA63AC5BFF22483310532B4E2C2507D4E57E85BD35AE8F95C9BE22B0541F526
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 2 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x001100000001b303-1.dat family_cosmu behavioral2/files/0x000400000001b1c0-5.dat family_cosmu - Renames multiple (4413) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-ul-oob.xrm-ms.tmp 2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-pl.xrm-ms.tmp 2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md.tmp 2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_HK.properties.tmp 2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp 2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.dll.tmp 2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.tmp 2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\jsoundds.dll.tmp 2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ppd.xrm-ms.tmp 2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp 2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ppd.xrm-ms.tmp 2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-xstate-l2-1-0.dll.tmp 2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\coreclr.dll.tmp 2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Primitives.dll.tmp 2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe.tmp 2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-ul-oob.xrm-ms.tmp 2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-pl.xrm-ms.tmp 2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe.tmp 2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\UIAutomationClientSideProviders.resources.dll.tmp 2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe.tmp 2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Grace-ul-oob.xrm-ms.tmp 2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebClient.dll.tmp 2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Extensions.dll.tmp 2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\am.pak.tmp 2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-ul-oob.xrm-ms.tmp 2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\TellMeWord.nrr.tmp 2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\sa.txt.tmp 2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tabskb.dll.mui.tmp 2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\ko.pak.tmp 2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp 2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Net.Ping.dll.tmp 2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\System.Windows.Input.Manipulations.resources.dll.tmp 2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms.tmp 2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.X509Certificates.dll.tmp 2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Controls.Ribbon.resources.dll.tmp 2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\hprof.dll.tmp 2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-private-l1-1-0.dll.tmp 2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-pl.xrm-ms.tmp 2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Royale.dll.tmp 2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Grace-ppd.xrm-ms.tmp 2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART11.BDR.tmp 2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationClient.resources.dll.tmp 2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Organic.thmx.tmp 2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ppd.xrm-ms.tmp 2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ul-oob.xrm-ms.tmp 2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\nn-NO\tipresx.dll.mui.tmp 2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-pl.xrm-ms.tmp 2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ppd.xrm-ms.tmp 2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe.tmp 2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-pl.xrm-ms.tmp 2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\hi.txt.tmp 2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msdaremr.dll.mui.tmp 2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l2-1-0.dll.tmp 2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.TypeConverter.dll.tmp 2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebProxy.dll.tmp 2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ja\ReachFramework.resources.dll.tmp 2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\hi.pak.tmp 2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-1-0.dll.tmp 2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.IO.Compression.dll.tmp 2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Xaml.resources.dll.tmp 2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp 2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-synch-l1-2-0.dll.tmp 2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-pl.xrm-ms.tmp 2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-math-l1-1-0.dll.tmp 2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-28_a390c908f75932873f8d439a04ec92db_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-4046655672-1449839301-2197395821-1000\desktop.ini.tmp
- Size 58KB
- SHA256 06f9f2a56f838a3d281f29d49ed00cca1274bdece038f23d73e480006fcd6a63
- MD5 f83b5b1a816d8ee6faf5b4e9328a4706
- SHA1 9a7f1635ab3ec14fd2f2af4281e959ae28ff30ad
- SHA512 5574719ceb1e1f6d285e4c4ae1bf4fce279cf03ed3c02f9a7f87b6f15bea6f9d633c726027b5ed23846caa4d1a7ec536607e68ff3be8da87219b0db952b8eb21
- SSDEEP 768:W7BlpNLpARFbhblkYlkrt8PWGoPWGqMs1MsR5nd5na:W7ZNLpApCZrt8PWGoPWGANdNa
- TLSH T14C433A3EA63AC5AFF22483311532B4E2C2407D4E57E85BD34AE8F95C9BE22B0541F526
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 157KB
- SHA256 f593322330cbced7068c2cd49972b4f2eebfa35aaf61d697f0d3d737b93e7864
- MD5 df4094ec69667a4f325fc9d198510904
- SHA1 c8b3371247748d9779b9a19911572e90f0aff93c
- SHA512 2d2e035102c870fde486f858061fa10ada174f866f6c5e6b3a63b0fd6181779b5a18d6bf0dfc800c12be769ad446398b676e367d6324a1f518c5c57c28b8ae03
- SSDEEP 3072:6NLWpCZIz05ZMfTiu66I3UwqSsMBlsWb4A+r:u6EMfTinqncsWp+r
- TLSH T180F318617C6EF6A5CB4413396D277E83C300398F3DD9CE8266B5E5E792399A00C5B4E2
- MD5 SHA1 SHA512 SSDEEP TLSH