Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 00:40
Behavioral task
behavioral1
Sample
2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe
- Size 51KB
- Sample260802-a1f6hszzex
- SHA256 bd596e62fd010d3a147fc2b2ab305626bb9ec4bdf00c5b37aeb791944ac404c2
- MD5 5b69400ac83d30adbe6258b2925bd7a9
- SHA1 b7effb589602af83eeff735af35829f3cb4043cc
- SHA512 77732b3e3316b24273a68b44ae2275226748a1b26541941f8beabe49dc459947b9f9c2b28758beee04ba6487f6644e6a28ffbf3e983556eed72a736d4e33c607
- SSDEEP 768:W7Blp2sspARFbh5YSfff9n1oXKCqzEIn1oXKCqzEakS5evu6kS5evu5:W7Z2sspAp5YSfffUbkbg
- TLSH T1DC33E83D6E0B75F2EB645174220F3AEE9C139DA0AD75ACB24348EC5A0230FB4D49665E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 2 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x001b0000000187a6-1.dat family_cosmu behavioral2/files/0x000300000001b1a7-5.dat family_cosmu - Renames multiple (4438) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\System\ado\msadrh15.dll.tmp 2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Slice.thmx.tmp 2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ul-oob.xrm-ms.tmp 2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Dataflow.dll.tmp 2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp 2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\cs\PresentationUI.resources.dll.tmp 2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\AUTHOR.XSL.tmp 2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Process.dll.tmp 2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\lib\ir.idl.tmp 2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-ul-oob.xrm-ms.tmp 2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Windows.dll.tmp 2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.dll.tmp 2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Collections.Immutable.dll.tmp 2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\WindowsFormsIntegration.resources.dll.tmp 2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationProvider.resources.dll.tmp 2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\dom.md.tmp 2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Reflection.eftx.tmp 2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri-Cambria.xml.tmp 2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-cn.dll.tmp 2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui.tmp 2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe.tmp 2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-pl.xrm-ms.tmp 2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp 2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTest-pl.xrm-ms.tmp 2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PROTOCOLHANDLERINTL.DLL.tmp 2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_COL.HXT.tmp 2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.Primitives.resources.dll.tmp 2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\public_suffix.md.tmp 2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-pl.xrm-ms.tmp 2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sqlpdw.xsl.tmp 2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.Native.dll.tmp 2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\PresentationUI.resources.dll.tmp 2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe File created C:\Program Files\Internet Explorer\ja-JP\ieinstal.exe.mui.tmp 2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp 2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\pt.txt.tmp 2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Security.Cryptography.OpenSsl.dll.tmp 2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationUI.dll.tmp 2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\UIAutomationClientSideProviders.resources.dll.tmp 2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.Authorization.dll.tmp 2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\Microsoft.Ink.Intelligence.TextInput.Implementation.dll.tmp 2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemDrawing.dll.tmp 2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\cmm\sRGB.pf.tmp 2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-ul-oob.xrm-ms.tmp 2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ul-phn.xrm-ms.tmp 2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-pl.xrm-ms.tmp 2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql70.xsl.tmp 2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\sv-SE\tipresx.dll.mui.tmp 2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Json.dll.tmp 2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.Extensions.dll.tmp 2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\WindowsBase.resources.dll.tmp 2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Aero2.dll.tmp 2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\vi.pak.tmp 2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\zip.dll.tmp 2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\calendars.properties.tmp 2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe File created C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui.tmp 2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.Design.resources.dll.tmp 2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_es.properties.tmp 2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.ComponentModel.Primitives.dll.tmp 2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.dll.tmp 2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\UIAutomationClientSideProviders.resources.dll.tmp 2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_Grace-ul-oob.xrm-ms.tmp 2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\WindowsFormsIntegration.resources.dll.tmp 2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\PresentationFramework.resources.dll.tmp 2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\ext\sunec.jar.tmp 2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-01_5b69400ac83d30adbe6258b2925bd7a9_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1079202589-886135813-2527035092-1000\desktop.ini.tmp
- Size 51KB
- SHA256 b5a72fdce5dc4c57616125b394894c8c5e1288505aaeb66fc84f3c22d3afc41b
- MD5 3ca18cfb563f73a52936c1517fc15a1c
- SHA1 7408ba6fbcfc80900271135c758503bc4c253c7d
- SHA512 efe5c856b4fddc942f65e0d5e32b85a79ab5588874e5bec782d4538724cc1518e85bb986ddf358c3fd6c09e13bd9569007a05e13f73e240c5b7aeea0634d3077
- SSDEEP 768:W7Blp2sspARFbh5YSfff9n1oXKCqzEIn1oXKCqzEakS5evu6kS5evuJ:W7Z2sspAp5YSfffUbkbc
- TLSH T12D33E83D6E0B74F2EB645174220F3AEE9C139C60AD75ACB24358FC9A0230FB4D49665E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 150KB
- SHA256 1b3ca680eeb7480884fe16c67df44128819d797c757c77084f9ce8b2168b4222
- MD5 992c75cf453ce49238cca3ad03ef04ae
- SHA1 e45cfb2eb4f74712180d2db3b5f64af66e2a27c6
- SHA512 6f88a125f60173630b6c094916e45fba72d4685ddecbdbe9f9f2aa4d08bea353d39f0e082ce57023e29e2bc3ffb85716d0ab392086bf8a148a75677f8b8b245e
- SSDEEP 3072:62ssWp8AD5ZMfTiu66I3UwqSsMBlsWb4A+T:MVPMfTinqncsWp+T
- TLSH T171E3F6207C6EF6A0CF4413786A5B7E87DE013D8A3C59CDB262A565E3413CEB40C9B5E6
- MD5 SHA1 SHA512 SSDEEP TLSH