Analysis
- max time kernel
150s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/07/2026, 22:32
Behavioral task
behavioral1
Sample
2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe
- Size 80KB
- Sample260729-2f46dsfh93
- SHA256 b358d127f18ec0ecb5103963432e1c8a9b62acf79bc28cc6fb0a5b93589d18aa
- MD5 7cba0236efa8691b2b1369ae35f0c7e1
- SHA1 bef2da434deec81f6a4c4736dc10b8ec776e2e71
- SHA512 e0363ca2037f5b1afa06d66f5dcd47dc4f12e8b17202389b8fba3c24ede0cd34fbce26e3a6d2dc2f57935c9dddc3cf5696977d9aa546615864bb01502eea3135
- SSDEEP 1536:p7ZhA7dAp1++PJHJXA/OsIZfzc3/Q8asUsJOLKlDa:Te76WQSohsUsUKlDa
- TLSH T10D836C3B8F10F427D01A78369D2B6664DE32ADC97F5BFCFA9EA094F50C617C1A505029
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 2 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x0008000000019ce0-1.dat family_cosmu behavioral2/files/0x000400000001b1ed-5.dat family_cosmu - Renames multiple (4264) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.Design.Editors.dll.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\tr\System.Xaml.resources.dll.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ul-phn.xrm-ms.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PenImc_cor3.dll.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-math-l1-1-0.dll.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\lib\orb.idl.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\fre\StartMenu_Win7_RTL.wmv.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-ul-oob.xrm-ms.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Grace-ul-oob.xrm-ms.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_F_COL.HXK.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\af.txt.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-console-l1-1-0.dll.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Internet Explorer\ja-JP\ieinstal.exe.mui.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ul-phn.xrm-ms.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Grace-ppd.xrm-ms.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_COL.HXC.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\lib\ir.idl.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationCore.resources.dll.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\IFDPINTL.DLL.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Sockets.dll.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\+Connect to New Data Source.odc.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_COL.HXT.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\fr\System.Windows.Controls.Ribbon.resources.dll.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\cryptix.md.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-pl.xrm-ms.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XmlDocument.dll.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\calendars.properties.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ul-oob.xrm-ms.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-pl.xrm-ms.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sr-latn-rs.dll.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\msinfo32.exe.mui.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Common Files\System\ado\msadomd.dll.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Common Files\System\fr-FR\wab32res.dll.mui.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.DataIntegration.TransformDataByExample.dll.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\sl.txt.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\vk_swiftshader_icd.json.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-time-l1-1-0.dll.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunec.jar.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\splash.gif.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ul-oob.xrm-ms.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ul-oob.xrm-ms.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Text.RegularExpressions.dll.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.VisualBasic.Forms.dll.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\C2R64.dll.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Violet II.xml.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Configuration.dll.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Forms.Design.resources.dll.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-pl.xrm-ms.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_COL.HXT.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\[email protected] 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\jfr.jar.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-pl.xrm-ms.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-string-l1-1-0.dll.tmp 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-29_7cba0236efa8691b2b1369ae35f0c7e1_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-552508041-2681165170-3229858294-1000\desktop.ini.tmp
- Size 80KB
- SHA256 fb85bc3361f3e517c227fabd0398b12efe16b16b2d2e3a218b02b655ed16e99c
- MD5 b99974c17137ecf78ca63b16d4c3f679
- SHA1 f6e338d66bad42b71fb0e5d37ef8343652ed8da7
- SHA512 8479a7ac3f210ddcacf1489a1fa4644ced55dd53f730eb102e068d6d5e0f31df512423be50080f44c66f945c75ed926e9a905332977db6e901024bff8e732a5d
- SSDEEP 1536:p7ZhA7dAp1++PJHJXA/OsIZfzc3/Q8asUsJOLKlDq:Te76WQSohsUsUKlDq
- TLSH T10A836B3B8F10F427D01A68369D2B6764DE32ADC97F5BFCFA9EA094F50C617C1A505029
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 179KB
- SHA256 b95440a0e5f4e830afc9e7da5099853b5dbf3bd5ef8c1af6495b35a316b48fa0
- MD5 d8aad56553d1ab18a2f6c730febec535
- SHA1 42fabb009e789af1f002b892d554c8825b6ec0e8
- SHA512 5056f6469b7ab379a813572c4a0259144a006d9b9174928a96cc99b21f9f8f1c50f2ec31c4762f5c9c144ec6ae14b20ee2d791833fb8665f59c4e608fb72c4e8
- SSDEEP 3072:Te76WQSohsUsUKlDv5ZMfTiu66I3UwqSsMBlsWb4A+4:SeWQSohsUsLDXMfTinqncsWp+4
- TLSH T1700439617F6DF561CA442239AD1B6E43CF013DCA3F5AEDA67EA115E34C38AC11C4B0A6
- MD5 SHA1 SHA512 SSDEEP TLSH