Analysis
- max time kernel
150s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 07:57
Behavioral task
behavioral1
Sample
2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe
- Size 94KB
- Sample260730-jtfe3sxvb1
- SHA256 9fdf5c1f66f5ad28e72306298fbdc1f2957779a98d5fba01f39dc55fea8d1457
- MD5 2688ae0197318364dac23c289aad1b60
- SHA1 79f9b2fc42d7b6c66ffca32eef309ce5cc053598
- SHA512 6ae99235812cfcf6f51ec5d28979bc6af65ba973552a574e61f90efac4b63572156dbaa8a8cd802974f3daec0db3253ac806ed4d779d5de17411674698be54b6
- SSDEEP 768:p7BlphA7dASbSzEXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2rcu90TKe+0TKek:p7ZhA7dAinMdyGdy4AnAP4YrMlYgPUiz
- TLSH T113933A0AEE449C9BF3112278DCE772A65239F9C467CA8F735A20B9B40F90F705D9911B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 2 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000f00000001b1d0-1.dat family_cosmu behavioral2/files/0x000300000001b1d6-5.dat family_cosmu - Renames multiple (4229) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.OpenSsl.dll.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Collections.Immutable.dll.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Grace-ul-oob.xrm-ms.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.AddinTelemetry.dll.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\7-Zip\7z.dll.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.VisualBasic.Forms.dll.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\System.Windows.Controls.Ribbon.resources.dll.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ul-phn.xrm-ms.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ul-phn.xrm-ms.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeServiceBypassR_PrepidBypass-ul-oob.xrm-ms.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.dll.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebHeaderCollection.dll.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Text.Encodings.Web.dll.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ppd.xrm-ms.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\vstoee90.tlb.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\desktop.ini.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntime2019R_PrepidBypass-ppd.xrm-ms.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Runtime.Handles.dll.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\PresentationCore.resources.dll.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\vcruntime140.dll.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ul-phn.xrm-ms.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ul-oob.xrm-ms.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.IO.IsolatedStorage.dll.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-pl.xrm-ms.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\System.Spatial.NetFX35.dll.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.FileSystem.dll.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\System.Windows.Forms.Primitives.resources.dll.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-ul-oob.xrm-ms.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-pl.xrm-ms.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ppd.xrm-ms.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Input.Manipulations.resources.dll.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jsound.dll.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ul-phn.xrm-ms.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_K_COL.HXK.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\TellMeOutlookAppt.nrr.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Channels.dll.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\WindowsBase.resources.dll.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationClient.resources.dll.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.IO.Packaging.dll.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Grace-ppd.xrm-ms.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Forms.resources.dll.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Internet Explorer\uk-UA\iexplore.exe.mui.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ppd.xrm-ms.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.EventLog.dll.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ppd.xrm-ms.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ul-oob.xrm-ms.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ppd.xrm-ms.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\rtscom.dll.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.WindowsDesktop.App.deps.json.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationUI.resources.dll.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\PresentationUI.resources.dll.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\cursors.properties.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-ul-oob.xrm-ms.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-heap-l1-1-0.dll.tmp 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_2688ae0197318364dac23c289aad1b60_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1738198120-2966725515-3980530802-1000\desktop.ini.tmp
- Size 94KB
- SHA256 0c22c01b95cb67a4cbceb3044cbd33ba4de4453487038441975e660a717c9b3b
- MD5 30b750eb53de50378e141a714d7f360c
- SHA1 548186da6c0565c5379d6e7c58215facdb212a82
- SHA512 a1c95f5cee43d9576d153acbaa58b7b772413317f6ed97ab5d6625c009e5dcd1c4a22b62023d3a4bf548e600354ba124d7bd5f3f259f4da53f7a629012e74eff
- SSDEEP 768:p7BlphA7dASbSzEXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2rcu90TKe+0TKe+:p7ZhA7dAinMdyGdy4AnAP4YrMlYgPUit
- TLSH T133932A0AEF449C9BF2112278DCE772A65239F9C467CA8F735A20B5B80F90F705D9911B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 193KB
- SHA256 fd0ea0aad51ddefdf0441baac96691fbe19ca617ec9beb389611d9f7bb02a015
- MD5 3c60ebcbc901f4a418adacda74eb91bd
- SHA1 490b5b8369feb0bb2a6dfda99efe78bb1210681f
- SHA512 9f5b73ee7760c772b6c6e9df10aafac61a9c699964ec2b46508efec3b520e8dbaa13a171669f6aa8e00d55fc950873c70f8fa4c97024fdc685a23d3f9d238a1d
- SSDEEP 3072:Te76inpATrMlYaUio5ZMfTiu66I3UwqSsMBlsWb4A+L:SeinpAMlYaUiCMfTinqncsWp+L
- TLSH T1BF143A11BD9DF9A5DB042338AD977E83831579CA3ECACF52667075F24638E600C9B0E6
- MD5 SHA1 SHA512 SSDEEP TLSH