Analysis
- max time kernel
149s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
29/07/2026, 22:32
Behavioral task
behavioral1
Sample
2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe
- Size 80KB
- Sample260729-2f46dsfh93
- SHA256 b358d127f18ec0ecb5103963432e1c8a9b62acf79bc28cc6fb0a5b93589d18aa
- MD5 7cba0236efa8691b2b1369ae35f0c7e1
- SHA1 bef2da434deec81f6a4c4736dc10b8ec776e2e71
- SHA512 e0363ca2037f5b1afa06d66f5dcd47dc4f12e8b17202389b8fba3c24ede0cd34fbce26e3a6d2dc2f57935c9dddc3cf5696977d9aa546615864bb01502eea3135
- SSDEEP 1536:p7ZhA7dAp1++PJHJXA/OsIZfzc3/Q8asUsJOLKlDa:Te76WQSohsUsUKlDa
- TLSH T10D836C3B8F10F427D01A78369D2B6664DE32ADC97F5BFCFA9EA094F50C617C1A505029
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 2 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral1/files/0x000a0000000242f2-1.dat family_cosmu behavioral1/files/0x00040000000217fc-5.dat family_cosmu - Renames multiple (4901) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\1033\CLVWINTL.DLL.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\MMSL.ICO.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\server\Xusage.txt.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\dynalink.md.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-ul-oob.xrm-ms.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ppd.xrm-ms.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-ppd.xrm-ms.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.AddinTelemetry.dll.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.Calendars.dll.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.NETCore.App.runtimeconfig.json.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\ReachFramework.resources.dll.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\PresentationCore.resources.dll.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\bg.pak.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\ext\jaccess.jar.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-ppd.xrm-ms.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationClientSideProviders.dll.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaSansRegular.ttf.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-ppd.xrm-ms.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\Custom.propdesc.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\IEAWSDC.DLL.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ja-jp.dll.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationTypes.resources.dll.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ul-oob.xrm-ms.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ul-phn.xrm-ms.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ppd.xrm-ms.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\CHICAGO.XSL.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Grace-ul-oob.xrm-ms.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Linq.dll.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 8.0.15 (x64).swidtag.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\management-agent.jar.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\JAWTAccessBridge-64.dll.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Grace-ul-oob.xrm-ms.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\Informix.xsl.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\REPLTMPL.CFG.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrdeulm.dat.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-pl.xrm-ms.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ppd.xrm-ms.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrdeslm.dat.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\t2k.dll.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusDemoR_BypassTrial365-ppd.xrm-ms.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\offsymb.ttf.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\CLICK.WAV.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-pl.xrm-ms.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.JavaScript.dll.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\PresentationFramework.resources.dll.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\PresentationFramework.resources.dll.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Security.Cryptography.Xml.dll.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\javafx-src.zip.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.cpl.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\COPYRIGHT.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\offsymk.ttf.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Trial-ul-oob.xrm-ms.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.Win32.SystemEvents.dll.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssv.dll.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Grace-ul-oob.xrm-ms.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessVDI2019_eula.txt.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\STSLIST.CHM.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\JitV.dll.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue Green.xml.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-540052884-2969440504-464782435-1000\desktop.ini.tmp
- Size 80KB
- SHA256 39c2bd3933a339fb6a6ef9ae9ba0afc15248d74b23b7824dc943d31a261df353
- MD5 e9adb8217760cd681f003e6486262beb
- SHA1 69a497fec89c732a5a3a9d1a8d39555d6d07382c
- SHA512 cc57caf8305eab05e4899b06bb1fd4785063c3de253f16704f70efae5177cea73a429a7a53f74d817c526c416e2faa39abce955b3f4a7e268b3089ab17b1337d
- SSDEEP 1536:p7ZhA7dAp1++PJHJXA/OsIZfzc3/Q8asUsJOLKlDU:Te76WQSohsUsUKlDU
- TLSH T103836B3B8F10F427D01A68369D2B6764EE32ADC97F5BFCFA9EA094F50C617C1A505029
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 179KB
- SHA256 f4133b92a95c1f1bce754294807211fd71972a67998d8a166bea44a4a751b457
- MD5 5cf78e078c42767b136e89084db87718
- SHA1 f6fb421e366029b2aedeb91f0242fa8d0a775e21
- SHA512 0713f2aef187a38cf7c909280ae30930618f5250ab32d1fda979f6dc6089c3d788417394299b781a3bf38f5c29458491949aa5a38fa11472d79dffa0d6f0a0e1
- SSDEEP 3072:Te76WQSohsUsUKlDf5ZMfTiu66I3UwqSsMBlsWb4A+4:SeWQSohsUsLDnMfTinqncsWp+4
- TLSH T17D0439617F6DF561CA442239AD1B6E43CF013DCA3F5AEDA67EA115E34C38AC11C4B0A6
- MD5 SHA1 SHA512 SSDEEP TLSH