Analysis
- max time kernel
150s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/07/2026, 00:18
Behavioral task
behavioral1
Sample
2026-07-28_d48a6f3d5ac0d876eb98cae7bc0e91d4_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-28_d48a6f3d5ac0d876eb98cae7bc0e91d4_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-07-28_d48a6f3d5ac0d876eb98cae7bc0e91d4_elex_wannacry.exe
- Size 51KB
- Sample260729-als7ja1yev
- SHA256 08cec2312679c500276255f7e372c54e0ec6940bb8bc9994aa7271cdfcf87943
- MD5 d48a6f3d5ac0d876eb98cae7bc0e91d4
- SHA1 3e8931329ab3b199d006ec8f56d3ab50ada9baa7
- SHA512 1ebf4cd0ce9945333cfaf92e34a4526133c874e52ca883ef10ded664728112944e4657e2ddfc791ab2f8fc89f35960ce9724af99e6c48ee80992b2cf1ae9b6c6
- SSDEEP 768:W7BlphA7pARFbhM0Kkq81LOyq81LORWAnWAkpUE5c5R2dxD9z:W7ZhA7pApM21LOA1LOrtkpt6H2d/z
- TLSH T1D83309267AAD7C2EC6611074543BFC70A6B3A5673F21DF4FAAC1893D0D22291446D2EF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 2 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000a000000011390-10.dat family_cosmu behavioral2/files/0x000500000001b871-13.dat family_cosmu - Renames multiple (4187) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Executes dropped EXE 2 IoCs
pid Process 1260 _taskrun.exe 5904 Zombie.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Zombie.exe 2026-07-28_d48a6f3d5ac0d876eb98cae7bc0e91d4_elex_wannacry.exe File opened for modification C:\Windows\SysWOW64\Zombie.exe 2026-07-28_d48a6f3d5ac0d876eb98cae7bc0e91d4_elex_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\UIAutomationClientSideProviders.resources.dll.tmp Zombie.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\VisualElements\LogoBeta.png.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pl-pl.dll.tmp Zombie.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\v8_context_snapshot.bin.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Grace-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationUI.resources.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\libffi.md.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-ul-phn.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\OUTLOOK_F_COL.HXK.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Linq.Parallel.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Controls.Ribbon.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\System.Xaml.resources.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-heap-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red Violet.xml.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-ul-phn.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPack2019Eula.txt.tmp Zombie.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msdaremr.dll.mui.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Ping.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Diagnostics.Tools.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\ReachFramework.resources.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalDemoR_BypassTrial180-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Grace-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicstylish.dotx.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-filesystem-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_F_COL.HXK.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscorlib.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.TextWriterTraceListener.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ONINTL.DLL.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\ReachFramework.resources.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\[email protected] Zombie.exe File created C:\Program Files\Java\jre-1.8\lib\calendars.properties.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Dynamic.Runtime.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Grace-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Forms.Primitives.resources.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\msvcp140_1.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Grayscale.xml.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\fre\StartMenu_Win8.mp4.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\MAPISHELLR.DLL.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ValueTuple.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10.mp4.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\or-IN\tipresx.dll.mui.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationCore.resources.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\charsets.jar.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.it-it.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\lib\net.properties.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\CT_ROOTS.XML.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\System.ValueTuple.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.Design.dll.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\WindowsBase.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\fr\PresentationCore.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Windows.Presentation.dll.tmp Zombie.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-28_d48a6f3d5ac0d876eb98cae7bc0e91d4_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Zombie.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3316 wrote to memory of 1260 3316 2026-07-28_d48a6f3d5ac0d876eb98cae7bc0e91d4_elex_wannacry.exe 88 PID 3316 wrote to memory of 5904 3316 2026-07-28_d48a6f3d5ac0d876eb98cae7bc0e91d4_elex_wannacry.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-28_d48a6f3d5ac0d876eb98cae7bc0e91d4_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-28_d48a6f3d5ac0d876eb98cae7bc0e91d4_elex_wannacry.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\_taskrun.exe"_taskrun.exe"2⤵
- Executes dropped EXE
PID:1260
-
-
C:\Windows\SysWOW64\Zombie.exe"C:\Windows\system32\Zombie.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5904
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1738198120-2966725515-3980530802-1000\desktop.ini.tmp
- Size 44KB
- SHA256 bf20843f0b6345adb1d3b87285cc02d040d7e6d38133c3fe11527b50b44b554e
- MD5 b266f35530372d918d704a6b19e6c6ab
- SHA1 d18c6ae9a456a80ea2111b1696674c5052c4cb53
- SHA512 41c8c11383c96e936108e2d7085044fe45f21fb554cb45baf63513bf9c7a2d1024603b92fb1b8ab7d4d8ab4d49cfd5210599cbd8d37d09577a24baf125da67ac
- SSDEEP 768:W7BlphA7pARFbhM0Kkq81LOyq81LORWAnWAkpUE5c5R2J:W7ZhA7pApM21LOA1LOrtkpt6H2J
- TLSH T12713C6263E6EBC2EC2611078152BFC74A6F355673F21DF4EA6C2C93C096229144AD1EF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_taskrun.exe
- Size 7KB
- SHA256 aa0b4f00af4d44a4944d81e2771fadeba8db0889665659528f804e0a9d3274f7
- MD5 fff35d3d88a66f7d311ea1d1a380d062
- SHA1 cf6124e88302d028d7deb5c8dfd6065b90089510
- SHA512 3be4e9b92e3ff33962c36f8b982c8acf72ba16bce412052f7dcbe3e95d4b2dafaab6e040e51258b8b16b7bd13341401f35dea7676395a9fc14cc7a0ba434dc5c
- SSDEEP 96:bn66+nzrDdbAVMPcJaSGLu+RmSoflpT9pSkCF5VbwWVD9CPfWlkbBzNt:jyNzGRG6WmJthTPCxUWTyfWCf
- TLSH T1DAE18314D3E40637EDF70FB1ECA30240A732FB159C37C76E6888114BA92678447726A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Zombie.exe
- Size 44KB
- SHA256 abf63d134d716a5d240dca41d01b0c70bbf7ea53b4ad6fbba07ecea862dd6623
- MD5 538e5ecb06cc98068b074b3b2867866d
- SHA1 b50f9f4b83110b030dd95b679ad102c9b4f18a85
- SHA512 0a0f92ad8f030aae15c3922fd8780b2d2a16af61a634c814830be7d57695df2d40c7b65dd6e2a3921020684dea27f18aadae5e3db8ca7043aa09be88a10e16c7
- SSDEEP 768:W7BlphA7pARFbhM0Kkq81LOyq81LORWAnWAkpUE5c5R2R:W7ZhA7pApM21LOA1LOrtkpt6H2R
- TLSH T1DC13C7263E6EBC2EC2611078152BFC74A6F355673F21DF4EA6C2C93D096229144AD1EF
- MD5 SHA1 SHA512 SSDEEP TLSH