Analysis
- max time kernel
150s - max time network
132s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/07/2026, 07:51
Behavioral task
behavioral1
Sample
2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe
- Size 86KB
- Sample260730-jptrxatdme
- SHA256 4a72533ef75a1321facc534bd9c3644454ba179895ff23f06c0401ffd1583e6f
- MD5 7950cc188e65b0f3e156830d5edd1955
- SHA1 57d1dd327232bd9054d67b03e5e8331075a61f37
- SHA512 fdce41af20c2198ed15b3c4ad097ec6e0a8fb816edb5e8e363899adde871a29fb1931c47f0be67f96cd90e64efc1e74960bcd20c8ee12c6ea948bb1984f277c9
- SSDEEP 1536:p7ZhA7dAp1++PJHJXA/OsIZfzc3/Q8OyZ2Fdlda+e8ccT+e8ccu:Te76WQSonyZ2Fdldab8ccTb8ccu
- TLSH T199933ABF8F50F06AE72650769C263775EDB0AC0B36A4E9B9BE2005384912FF655CC127
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 2 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral1/files/0x00200000000231d5-1.dat family_cosmu behavioral1/files/0x0006000000021914-5.dat family_cosmu - Renames multiple (4860) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.IO.Pipes.AccessControl.dll.tmp 2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\java.dll.tmp 2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ppd.xrm-ms.tmp 2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ul-phn.xrm-ms.tmp 2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\FUNCRES.XLAM.tmp 2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Specialized.dll.tmp 2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Web.HttpUtility.dll.tmp 2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-ppd.xrm-ms.tmp 2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-ul-oob.xrm-ms.tmp 2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ppd.xrm-ms.tmp 2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ThirdPartyNotices.txt.tmp 2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe.tmp 2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe File created C:\Program Files\Common Files\System\msadc\msadds.dll.tmp 2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\EXITEMS.ICO.tmp 2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\PresentationCore.resources.dll.tmp 2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\mesa3d.md.tmp 2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-140.png.tmp 2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll.tmp 2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.CodeDom.dll.tmp 2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\UIAutomationProvider.resources.dll.tmp 2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Extreme Shadow.eftx.tmp 2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ppd.xrm-ms.tmp 2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-180.png.tmp 2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-100.png.tmp 2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe File created C:\Program Files\ExitEnable.edrwx.tmp 2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_es.properties.tmp 2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-pl.xrm-ms.tmp 2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ul-oob.xrm-ms.tmp 2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ppd.xrm-ms.tmp 2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ul.xrm-ms.tmp 2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\kk\msipc.dll.mui.tmp 2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui.tmp 2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml.tmp 2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipTsf.dll.mui.tmp 2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Grace-ul-oob.xrm-ms.tmp 2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-ul-phn.xrm-ms.tmp 2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml.tmp 2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Diagnostics.Process.dll.tmp 2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Security.Cryptography.Encoding.dll.tmp 2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationTypes.resources.dll.tmp 2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ul-oob.xrm-ms.tmp 2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\sl.txt.tmp 2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp 2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-pl.xrm-ms.tmp 2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\XLLEX.DLL.tmp 2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\ReachFramework.resources.dll.tmp 2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-console-l1-2-0.dll.tmp 2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightDemiBold.ttf.tmp 2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019DemoR_BypassTrial180-ppd.xrm-ms.tmp 2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ppd.xrm-ms.tmp 2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ul-phn.xrm-ms.tmp 2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONDIRECTX.DLL.tmp 2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Office.PowerPivot.ExcelAddIn.dll.tmp 2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Requests.dll.tmp 2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\PresentationFramework.resources.dll.tmp 2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Garamond-TrebuchetMs.xml.tmp 2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-ppd.xrm-ms.tmp 2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\CSIRESOURCES.DLL.tmp 2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\WindowsBase.resources.dll.tmp 2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.PerformanceCounter.dll.tmp 2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe File created C:\Program Files\Internet Explorer\iexplore.exe.tmp 2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp 2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\fre\StartMenu_Win7_RTL.wmv.tmp 2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\nl-NL\tipresx.dll.mui.tmp 2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_7950cc188e65b0f3e156830d5edd1955_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3053180483-1881419501-3594244048-1000\desktop.ini.tmp
- Size 87KB
- SHA256 75fcb70509d9d5d7456befd97bc81775f831aa820540fb7b15cd5dcf08c990a9
- MD5 2718266f833bd24ae72cf55c554b3be2
- SHA1 55b4721ea69150f68bf5ae0bb205bdb9f18cacf2
- SHA512 f49ada78c03b83e3d7cdb7570cbf4baa11950a11a0ed5b496953c71937f4bb88ba9d9ab0c3a0435ad603cafad53156558e064f42698f60e7756d8b1700eb2f35
- SSDEEP 1536:p7ZhA7dAp1++PJHJXA/OsIZfzc3/Q8OyZ2Fdlda+e8ccT+e8cci:Te76WQSonyZ2Fdldab8ccTb8cci
- TLSH T1DF934A7F8F50F06AE72650769C263775EDB0AC0B36A4E9BABE2005384912FF655CC127
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 186KB
- SHA256 03fbcdc55fa069d3f907a55eb4a6c98a9acec38853f4c7b28a08bcfd9f04b9ac
- MD5 40a8643ffc7b6bb05bc7cdd95d55b551
- SHA1 c73cf51725e46e1283fce4deb002e8e153e2ff19
- SHA512 0b6e9c738df657bcbbc953d4ccb905f5cceeca6fb05b71b70df8d3ada5d1aed7bfdfdf9bb52b8df6d305281b44b93c12bc2e184584e9c311d8af270df8df4ed9
- SSDEEP 3072:Te76WQSonyZ2Fdldab8ccTb8ccA5ZMfTiu66I3UwqSsMBlsWb4A+P:SeWQSonyZ2Fdldab8ccTb8ccKMfTinqP
- TLSH T1401428727FAAF1A5CB541239AD1B7E83DE107C4B3C99CD767A6015A24129EF50C8B0A3
- MD5 SHA1 SHA512 SSDEEP TLSH