Analysis
- max time kernel
149s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/07/2026, 07:57
Behavioral task
behavioral1
Sample
2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe
- Size 94KB
- Sample260730-jtfe3sxvb1
- SHA256 9fdf5c1f66f5ad28e72306298fbdc1f2957779a98d5fba01f39dc55fea8d1457
- MD5 2688ae0197318364dac23c289aad1b60
- SHA1 79f9b2fc42d7b6c66ffca32eef309ce5cc053598
- SHA512 6ae99235812cfcf6f51ec5d28979bc6af65ba973552a574e61f90efac4b63572156dbaa8a8cd802974f3daec0db3253ac806ed4d779d5de17411674698be54b6
- SSDEEP 768:p7BlphA7dASbSzEXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2rcu90TKe+0TKek:p7ZhA7dAinMdyGdy4AnAP4YrMlYgPUiz
- TLSH T113933A0AEE449C9BF3112278DCE772A65239F9C467CA8F735A20B9B40F90F705D9911B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 2 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral1/files/0x0005000000016917-1.dat family_cosmu behavioral1/files/0x000600000002195d-5.dat family_cosmu - Renames multiple (4885) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Document Themes 16\Ion.thmx.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-synch-l1-1-0.dll.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\msvcp140.dll.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-pl.xrm-ms.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ul-phn.xrm-ms.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\CT_ROOTS.XML.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\GRLEX.DLL.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-140.png.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.AccessControl.dll.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.CompilerServices.Unsafe.dll.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ul-oob.xrm-ms.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Runtime.Serialization.Primitives.dll.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicelegant.dotx.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\TellMeOutlookTask.nrr.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\AugLoop\third-party-notices.txt.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ServiceProcess.dll.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.Design.resources.dll.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-ppd.xrm-ms.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationProvider.resources.dll.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationClient.resources.dll.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ja\System.Windows.Forms.Primitives.resources.dll.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pl\System.Windows.Controls.Ribbon.resources.dll.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-pl.xrm-ms.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremDemoR_BypassTrial365-ppd.xrm-ms.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.dll.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\ReachFramework.resources.dll.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ul-oob.xrm-ms.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OutlookLogoSmall.contrast-black_scale-100.png.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.Pkcs.dll.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-ul-oob.xrm-ms.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-pl.xrm-ms.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MINSBPROXY.DLL.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\NL7MODELS0009.dll.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\InkDiv.dll.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\sv-SE\tipresx.dll.mui.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\asm.md.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\AUDIOSEARCHLTS.DLL.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\CLICK.WAV.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.NETCore.App.runtimeconfig.json.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\cs\PresentationFramework.resources.dll.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngom.md.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-memory-l1-1-0.dll.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\jfr\profile.jfc.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-100.png.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrfralm.dat.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Security.Cryptography.X509Certificates.dll.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-pl.xrm-ms.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntry2019R_PrepidBypass-ppd.xrm-ms.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\System.Windows.Controls.Ribbon.resources.dll.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-ppd.xrm-ms.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Grace-ppd.xrm-ms.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\POSTIT.CFG.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Microsoft Office\Office16\SLERROR.XML.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusDemoR_BypassTrial365-ppd.xrm-ms.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Configuration.ConfigurationManager.dll.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationClientSideProviders.resources.dll.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2native.dll.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-ul-phn.xrm-ms.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-889581200-2041691093-2048517887-1000\desktop.ini.tmp
- Size 94KB
- SHA256 8953ace5cb914c6870b7841a4102770582da5c7c190c605aa2b77d5fe7609d21
- MD5 c1ec2c162d824eb012536a36a9120fdb
- SHA1 0d1ce8e05e838e6cdb4102cc3ec94ad03df806b6
- SHA512 2d4759ef3601e111873d60f40a8e57ec745dfdbf256fe6f85c4fb86f77910f02b1d4b1b5f6b384300fdafa9dcc5854885d5e02cbdb7408ff3b258ffc4aaff367
- SSDEEP 768:p7BlphA7dASbSzEXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2rcu90TKe+0TKeO:p7ZhA7dAinMdyGdy4AnAP4YrMlYgPUid
- TLSH T1F5932A0AEF449C9BF2112278DCE772A65239F9C467CA8F735A20B5B40F90F705D9911B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 193KB
- SHA256 f78a4cee89e63b17966ce6e171f07e06a16ecaa781111ae7186bbbc15e89edd7
- MD5 6a4f41ca685c816c2f48d50fbf066bb9
- SHA1 c0ab05ca3570060a377828c21eacc1b3e85ce0ec
- SHA512 37c3152ff8c11731e620aab53da9cc5c128799a8dd570f9503111ec2d106ff92025f34bb93bcdbc869047eca530440ce569ca342ff00b04c44d6cde300794005
- SSDEEP 3072:Te76inpATrMlYaUib5ZMfTiu66I3UwqSsMBlsWb4A+L:SeinpAMlYaUi7MfTinqncsWp+L
- TLSH T16C143A11BD9DF9A5DB042338AD977E83831479CA3ECACF52667075F24638E600C9B0E6
- MD5 SHA1 SHA512 SSDEEP TLSH