Analysis
- max time kernel
150s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
29/07/2026, 01:47
Behavioral task
behavioral1
Sample
2026-07-28_1552ad1a0d2640ebbbb96406a29a012b_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-28_1552ad1a0d2640ebbbb96406a29a012b_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-07-28_1552ad1a0d2640ebbbb96406a29a012b_elex_wannacry.exe
- Size 320KB
- Sample260729-b7j2esde34
- SHA256 4c0fa63f3f547e604eb6fdec4a638ae08d3279295366d7ca673756ed8cb8bc51
- MD5 1552ad1a0d2640ebbbb96406a29a012b
- SHA1 fca19358f1bc7c3655f85a4c93721e810b52a994
- SHA512 fbb4c81400140db99ca0a0a355d52d086d6ca89edee38245ee8946d2d9f3027427b98f0a1da08e7d212414ca8991b9073ab69e2e65f495569463c75ce15205f4
- SSDEEP 3072:69WpQE0zUMTcTSWEmOTcTSWEmr0kmPHrG3cWR/FzSDsEzt4lQM0QZkrXhsVzeLRl:nIZWAHrG3ZR/FWoQGlQ8yXhsVzE7
- TLSH T140646D87FB86AAA3D1160736C4AF43693335E6D03A96DF135E68F5346A133D0AC87507
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 2 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral1/files/0x000a0000000242b6-5.dat family_cosmu behavioral1/files/0x00070000000243a4-11.dat family_cosmu - Renames multiple (4912) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Executes dropped EXE 2 IoCs
pid Process 1832 Zombie.exe 1468 _zynap_service.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Zombie.exe 2026-07-28_1552ad1a0d2640ebbbb96406a29a012b_elex_wannacry.exe File opened for modification C:\Windows\SysWOW64\Zombie.exe 2026-07-28_1552ad1a0d2640ebbbb96406a29a012b_elex_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Grace-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Grace-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Common Files\System\Ole DB\msdaosp.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\PresentationUI.resources.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Forms.resources.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\lcms.md.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red Violet.xml.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri.xml.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Grace-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.CompilerServices.VisualC.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\CONVERT\1033\DELIMR.FAE.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationUI.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationFramework.resources.dll.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Net.WebClient.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\fr\System.Xaml.resources.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Security.Principal.Windows.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\AugLoop\third-party-notices.txt.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.HttpListener.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-process-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeServiceBypassR_PrepidBypass-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Grace-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Grace-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\kab.txt.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\tabskb.dll.mui.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Tracing.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationClientSideProviders.resources.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOARIA.DLL.tmp Zombie.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\java.security.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\splash_11-lic.gif.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\mip_upe_sdk.dll.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\bin\jfr.dll.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Grace-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Models.dll.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\bin\awt.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_K_COL.HXK.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\SECURS.ICO.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\FUNCRES.XLAM.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\libcurl64.dlla.manifest.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fi-fi.dll.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\ShapeCollector.exe.mui.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.IsolatedStorage.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Private.DataContractSerialization.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\WindowsBase.resources.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-file-l1-2-0.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCHARTCOMMON.DLL.tmp Zombie.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-28_1552ad1a0d2640ebbbb96406a29a012b_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Zombie.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language _zynap_service.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4884 wrote to memory of 1832 4884 2026-07-28_1552ad1a0d2640ebbbb96406a29a012b_elex_wannacry.exe 86 PID 4884 wrote to memory of 1468 4884 2026-07-28_1552ad1a0d2640ebbbb96406a29a012b_elex_wannacry.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-28_1552ad1a0d2640ebbbb96406a29a012b_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-28_1552ad1a0d2640ebbbb96406a29a012b_elex_wannacry.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Windows\SysWOW64\Zombie.exe"C:\Windows\system32\Zombie.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1832
-
-
C:\Users\Admin\AppData\Local\Temp\_zynap_service.exe"_zynap_service.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1468
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-204488895-2999877624-296153668-1000\desktop.ini.exe
- Size 95KB
- SHA256 00c82188f659fd4f96987c392f614c0217542854c89fabde5669419509fcd92c
- MD5 c8c9f6d7abe2afdf54c25f0b77e7aa75
- SHA1 bf9904810eeec19f59c8c75e8b3769d679e0cd7e
- SHA512 569dc84fde43cbac5071cf46ee479788335a4c346f4be0fe8677eb889d2e941dbc937804386444bf9f5cefde0dcd67659c379a6addd6ce33a8068d837c585bab
- SSDEEP 1536:W7Z9pApQESOHepOHe8G+6E65dyGdykNdNBK2LUMTcTSbyEmOTcTSbyEmC:69WpQE0zUMTcTSWEmOTcTSWEmC
- TLSH T135A38E2FAF41D3A3D06B2331903770B5C5693C4C3D7AEFD2E6E5EC146926360A05A81B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_zynap_service.exe
- Size 225KB
- SHA256 4196836930ca8fede9b73a776799612a9355a954f8846f8246d615a8b0d76da6
- MD5 3f761645c1ac390afed939827b7cbd47
- SHA1 c4c45b292adacfca5e38f4132c952243c08c63a8
- SHA512 3443435e9c36aab507ab718c31c5d451b16c79e97248f8af5987451bd17f07de80adfa7ded379eae7aa17e55966313ad6a165c026573dba8aadf5ddaf0391290
- SSDEEP 3072:o0kmPHrG3cWR/FzSDsEzt4lQM0QZkrXhsVzeLRfv2iYp:QAHrG3ZR/FWoQGlQ8yXhsVzEY
- TLSH T14C345C87FB86ACA7E605073AC9EF835D3339E3D056869B135E7C71385A476C0AD87206
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Zombie.exe
- Size 95KB
- SHA256 29ddc4d4ed55a0ea0845dec3b994283687776a3dae69e84255a22a4f5f06cdaa
- MD5 a0c090537bd6e8a3ddf63b286ca4615f
- SHA1 cdc3d472eac7f091d97f62eb044094babc86f8c3
- SHA512 d101249684f8b717fba098a08d578d019bf0f589fdc86bd6144b1bb9e9985e29642bf802f886ec5bf24f3a62a26c08f9e9b3eb85c26474eb332e8963104cc7d4
- SSDEEP 1536:W7Z9pApQESOHepOHe8G+6E65dyGdykNdNBK2LUMTcTSbyEmOTcTSbyEmL:69WpQE0zUMTcTSWEmOTcTSWEmL
- TLSH T141938D2FAF41D3A3D06B2331903770B5C5697C4C3D7AEFD2E6E6ED146926360A05A81B
- MD5 SHA1 SHA512 SSDEEP TLSH