Analysis
- max time kernel
150s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/08/2026, 13:08
Behavioral task
behavioral1
Sample
2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe
- Size 25KB
- Sample260801-qdam8abm2v
- SHA256 46ccfe9cee3082009551e171c663596c06e7077f314f02884dc898eaa4594ee8
- MD5 a4eb3c09beecd20e8abf14fd8054861e
- SHA1 9d0f7fd534bbc33cde7f1e7988dda2bd55ff11b5
- SHA512 54223869f5b5306113d759c2f5d06f690257c67a2d76a91894bbe5bae7a7833de10d281e310bd2eb16cecd5e0cf34fe03802c426352a06e72a852e935f198271
- SSDEEP 384:hBt7Br5xjLiAgA71Fbhv/r+k7ha3JzpsVvUaWq9C7:R7Blp2pARFbh6qGpim2
- TLSH T19AB24B5E8B49C072C38550345C2F687D9CB7443C7E26DB6BAB56CC18AAB63D0FC3411A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/memory/4664-0-0x0000000000400000-0x000000000040A000-memory.dmp family_cosmu behavioral2/files/0x0010000000019cbf-2.dat family_cosmu behavioral2/files/0x000300000001b1d9-6.dat family_cosmu behavioral2/memory/4664-582-0x0000000000400000-0x000000000040A000-memory.dmp family_cosmu - Detects executables packed with eXPressor 4 IoCs
resource yara_rule behavioral2/memory/4664-0-0x0000000000400000-0x000000000040A000-memory.dmp INDICATOR_EXE_Packed_eXPressor behavioral2/files/0x0010000000019cbf-2.dat INDICATOR_EXE_Packed_eXPressor behavioral2/files/0x000300000001b1d9-6.dat INDICATOR_EXE_Packed_eXPressor behavioral2/memory/4664-582-0x0000000000400000-0x000000000040A000-memory.dmp INDICATOR_EXE_Packed_eXPressor - Renames multiple (4763) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clretwrc.dll.tmp 2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Threading.Overlapped.dll.tmp 2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe.tmp 2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WWINTL.DLL.tmp 2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\OFFICE.DLL.tmp 2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\co.txt.tmp 2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InkObj.dll.mui.tmp 2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\dnsns.jar.tmp 2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\Microsoft.VisualBasic.Forms.resources.dll.tmp 2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-ul-oob.xrm-ms.tmp 2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_Grace-ul-oob.xrm-ms.tmp 2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG.HXS.tmp 2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\wxpr.dll.tmp 2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-140.png.tmp 2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\id.pak.tmp 2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-synch-l1-1-0.dll.tmp 2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\management-agent.jar.tmp 2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\java.security.tmp 2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Aero2.dll.tmp 2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_TW.properties.tmp 2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.ReportDesign.Common.dll.tmp 2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\CSS7DATA0009.DLL.tmp 2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\UIAutomationTypes.resources.dll.tmp 2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe File created C:\Program Files\Internet Explorer\ieinstal.exe.tmp 2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\jfr.jar.tmp 2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp 2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\LyncBasic_Eula.txt.tmp 2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Expressions.dll.tmp 2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\WindowsFormsIntegration.resources.dll.tmp 2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationTypes.resources.dll.tmp 2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\trdtv2r41.xsl.tmp 2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\sw.txt.tmp 2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\PresentationFramework.Aero.dll.tmp 2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ppd.xrm-ms.tmp 2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-pl.xrm-ms.tmp 2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\ko-KR\tipresx.dll.mui.tmp 2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Reflection.Emit.ILGeneration.dll.tmp 2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp 2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\mesa3d.md.tmp 2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo_large.png.tmp 2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.tmp 2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ul-oob.xrm-ms.tmp 2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ul-phn.xrm-ms.tmp 2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.tmp 2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.EventBasedAsync.dll.tmp 2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp 2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe.tmp 2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationCore.resources.dll.tmp 2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ppd.xrm-ms.tmp 2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Globalization.Calendars.dll.tmp 2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Resources.Extensions.dll.tmp 2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-ul-oob.xrm-ms.tmp 2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l2-1-0.dll.tmp 2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationClientSideProviders.resources.dll.tmp 2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\sr.pak.tmp 2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2native.dll.tmp 2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-pl.xrm-ms.tmp 2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MIMEDIR.DLL.tmp 2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\kaa.txt.tmp 2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.da-dk.dll.tmp 2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-timezone-l1-1-0.dll.tmp 2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-140.png.tmp 2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\Microsoft.Ink.Intelligence.TextInput.Skill.dll.tmp 2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\WindowsFormsIntegration.resources.dll.tmp 2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-01_a4eb3c09beecd20e8abf14fd8054861e_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-189034102-168398478-1159367937-1000\desktop.ini.tmp
- Size 25KB
- SHA256 f9a9883ebbfb662d1c93d87f5c33c6a0af06bf08abd1b3f59f0e4f9c0a15308b
- MD5 8ed805e7be6d2bf29eaa90f27e70e6d4
- SHA1 b289dcff5306da08ca17ca4dc50449475de07145
- SHA512 fe3138ef1683bee5765d1f229f636c07efad14539abbd4901b85fc0ab56fafbd25e19c2876958467a59698f1da5cefc0832d763c369fabf57b2e4faaff9c7ffb
- SSDEEP 384:hBt7Br5xjLiAgA71Fbhv/r+k7ha3JzpsVvUaWq9C7Z:R7Blp2pARFbh6qGpim2m
- TLSH T172C24B5E8B49D072C3855034AD2F687D9CB7443C6E26DB6BEB568C18AAB63D0FC3411A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 124KB
- SHA256 66b2a423f489a23b7d105e3f75662d5c942ec27d7f9f413241636fa83bffd1a8
- MD5 217a3f5296026169841d19d87fbe24bb
- SHA1 877874c22863675e72c418e5017f381f83e42879
- SHA512 bb97665cfcaed8f830bf358cc1794ec2da3e35b51e6ebb41e5ab6c994dc5646423adf173adc8b1da5449964e6fdbdb2fff0bb7579001f625cb11e68a44d38208
- SSDEEP 3072:72Wp6qGi5ZMfTiu66I3UwqSsMBlsWb4A+2:7MEMfTinqncsWp+2
- TLSH T1B0C3E6617CAEF6A0CF441339AD6B9E83C305398F3C5ACE4276A515E3913CD950CAB4E6
- MD5 SHA1 SHA512 SSDEEP TLSH