Analysis
- max time kernel
150s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 05:40
Behavioral task
behavioral1
Sample
2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe
- Size 87KB
- Sample260730-gct6ssce38
- SHA256 3c03ea44bac9e4a6ff0421759479134f0b543e7412d8bfd171099fa9e1ab5d2e
- MD5 50baccf716c81d805c93ce1192eeede1
- SHA1 75961d77dd0f06c326f3925ebd08d5e8657e7eae
- SHA512 5f6802e4479aaf74f30838aee1d8619bdccb1b2256b7cc8c9030f69f52d7c3829b48f1da4559486b2537a814d194996d6d35fe5776caaacf2d082ff1ccf56133
- SSDEEP 1536:p7ZhA7dAp1++PJHJXA/OsIZfzc3/Q8OyZ2FdldL:Te76WQSonyZ2FdldL
- TLSH T10F93296B9F50E0AEE7650379881A37B5ED70BC093AA0FDB96F1045384C15FF6A88D11B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 2 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000e000000016cd6-1.dat family_cosmu behavioral2/files/0x000400000001b1b9-5.dat family_cosmu - Renames multiple (4202) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOMessageProvider.dll.tmp 2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Numerics.dll.tmp 2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pl\ReachFramework.resources.dll.tmp 2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\UIAutomationTypes.resources.dll.tmp 2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ppd.xrm-ms.tmp 2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-pl.xrm-ms.tmp 2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe File created C:\Program Files\Common Files\System\Ole DB\msdaosp.dll.tmp 2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationClientSideProviders.resources.dll.tmp 2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\WindowsBase.resources.dll.tmp 2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri Light-Constantia.xml.tmp 2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-ul-oob.xrm-ms.tmp 2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ul-oob.xrm-ms.tmp 2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sl-si.dll.tmp 2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\mraut.dll.tmp 2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Grace-ppd.xrm-ms.tmp 2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Initialization.dll.tmp 2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fil-PH\tipresx.dll.mui.tmp 2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Reflection.Emit.ILGeneration.dll.tmp 2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemXmlLinq.dll.tmp 2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javafx_iio.dll.tmp 2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.powerpointmui.msi.16.en-us.xml.tmp 2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ul-oob.xrm-ms.tmp 2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10.mp4.tmp 2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordVL_KMS_Client-ul-oob.xrm-ms.tmp 2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-util-l1-1-0.dll.tmp 2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe File created C:\Program Files\7-Zip\Uninstall.exe.tmp 2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\VGX\VGX.dll.tmp 2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp 2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\thaidict.md.tmp 2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Slice.thmx.tmp 2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-pl.xrm-ms.tmp 2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.NETCore.App.deps.json.tmp 2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp 2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md.tmp 2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightItalic.ttf.tmp 2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-ul-phn.xrm-ms.tmp 2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_COL.HXC.tmp 2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\de.txt.tmp 2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\PresentationUI.resources.dll.tmp 2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe.tmp 2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe.tmp 2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial3-ppd.xrm-ms.tmp 2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ul-phn.xrm-ms.tmp 2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Controls.Ribbon.dll.tmp 2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\Accessibility.dll.tmp 2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\System.Windows.Forms.Design.resources.dll.tmp 2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\tzmappings.tmp 2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\Welcome.html.tmp 2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.osmmui.msi.16.en-us.xml.tmp 2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Primitives.dll.tmp 2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Timer.dll.tmp 2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\UIAutomationClient.dll.tmp 2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processenvironment-l1-1-0.dll.tmp 2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ul-phn.xrm-ms.tmp 2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\FOLDER.ICO.tmp 2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.EventSource.dll.tmp 2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui.tmp 2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\PresentationUI.resources.dll.tmp 2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\directshow.md.tmp 2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp 2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.resources.dll.tmp 2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe File created C:\Program Files\Common Files\System\ado\msado15.dll.tmp 2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.DiaSymReader.Native.amd64.dll.tmp 2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\WindowsBase.resources.dll.tmp 2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_50baccf716c81d805c93ce1192eeede1_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3989226554-2204910950-1522900112-1000\desktop.ini.tmp
- Size 87KB
- SHA256 8f4558a8000afa1f9927ec16a1c2a4cbe09770424dccd024e89b4ce6966112f6
- MD5 1d7b1efbec4285fe9754810323449359
- SHA1 6fa962661aa37036dd25a95b75686c350d103d15
- SHA512 e3b05216ece5b0cc6e5bd0a1297d6eccae4a666c72fe9372dd129a7d374a8e6eb48c7c78ed11ea223eb4cc77a64267f09c7acefd1a0359abebc585557343bb23
- SSDEEP 1536:p7ZhA7dAp1++PJHJXA/OsIZfzc3/Q8OyZ2FdldT:Te76WQSonyZ2FdldT
- TLSH T1A193396B9F50E0AEE7650379881A37B5ED70BC093AA0FDB56F1046384C15FF6A88D11B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 186KB
- SHA256 ec8beb9af1bce5ae5f8516a90c92a913a334ecd2eb9c279111278681c5d68cf0
- MD5 23004c3a4b57a7bc4503738e89372612
- SHA1 30f1f90b6abcf677a5a7856825e13ab090487f82
- SHA512 b48b63c1253452e20fc7c75402996129364d03e80431eb997c7cb26547fb9438ef9c39e99c384976c9f2cb4ec9b09c6c468a4a5ca7ffea1678ba82267e93585e
- SSDEEP 3072:Te76WQSonyZ2FdldD5ZMfTiu66I3UwqSsMBlsWb4A+Q:SeWQSonyZ2FdldTMfTinqncsWp+Q
- TLSH T1C91428617FAAF1A5CB541379AC1B6E83DE107C4A3C59DDB17A6005F28528EF60C8B0E7
- MD5 SHA1 SHA512 SSDEEP TLSH