Analysis
- max time kernel
150s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 00:15
Behavioral task
behavioral1
Sample
2026-08-01_8fe023ef8330c65e85f6fdf37ebd907f_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-01_8fe023ef8330c65e85f6fdf37ebd907f_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-08-01_8fe023ef8330c65e85f6fdf37ebd907f_elex_wannacry.exe
- Size 98KB
- Sample260802-aj22naam2v
- SHA256 17e4cabd486ef182620b4e4dcac1dfb9b2b46aa65eb0f78134a473d620b7c7de
- MD5 8fe023ef8330c65e85f6fdf37ebd907f
- SHA1 0293f0307b2d0e7a2e0efa8fe7570c45125f76bc
- SHA512 9e9df85c9f6bfbd7cc71d4533655d7435747594af82f7afc1c418827ab24887c4ab749cb628c8d80162ddb3f6a3bb86d56740077bdb656097127d914f31e19fd
- SSDEEP 768:W7BlpDpARFbhYQkQjjLaMaRRpi1xnRpi1xOYJIJDYJIJMFhWFhCmDpBIjsZORReo:W7ZDpApYbWj2WTWJe+e/q7YgPUit
- TLSH T11CA34C99EF52BCC2E1112138EC93B2FC9D39ACE53E43EFA75A9045392392B605CC6547
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 2 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000800000001b1d0-9.dat family_cosmu behavioral2/files/0x000c00000001c64a-12.dat family_cosmu - Renames multiple (4163) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Executes dropped EXE 2 IoCs
pid Process 1884 _OnLineTPV.exe 4928 Zombie.exe - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Zombie.exe 2026-08-01_8fe023ef8330c65e85f6fdf37ebd907f_elex_wannacry.exe File created C:\Windows\SysWOW64\Zombie.exe 2026-08-01_8fe023ef8330c65e85f6fdf37ebd907f_elex_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\msinfo32.exe.mui.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-util-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationTypes.resources.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\fxplugins.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\mesa3d.md.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\lib\javafx.properties.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.IO.Pipes.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Xaml.resources.dll.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-ul-phn.xrm-ms.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Grace-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\System.Windows.Forms.Primitives.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.IO.Packaging.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Grace-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\fa.txt.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.DataSetExtensions.dll.tmp Zombie.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\fa.pak.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Immutable.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\WindowsBase.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\PresentationCore.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.AppContext.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2native.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.VisualStudio.Tools.Applications.Runtime.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\System.Xaml.resources.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\OUTFORM.DAT.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-string-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.IO.Compression.ZipFile.dll.tmp Zombie.exe File created C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-localization-l1-2-0.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipRes.dll.mui.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.Primitives.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\System.Xaml.resources.dll.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ENVELOPR.DLL.tmp Zombie.exe File created C:\Program Files\Common Files\System\Ole DB\oledb32r.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Transactions.Local.dll.tmp Zombie.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\optimization_guide_internal.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\webkit.md.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ul-phn.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\UIAutomationProvider.resources.dll.tmp Zombie.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-01_8fe023ef8330c65e85f6fdf37ebd907f_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Zombie.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language _OnLineTPV.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3056 wrote to memory of 1884 3056 2026-08-01_8fe023ef8330c65e85f6fdf37ebd907f_elex_wannacry.exe 88 PID 3056 wrote to memory of 4928 3056 2026-08-01_8fe023ef8330c65e85f6fdf37ebd907f_elex_wannacry.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_8fe023ef8330c65e85f6fdf37ebd907f_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_8fe023ef8330c65e85f6fdf37ebd907f_elex_wannacry.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\_OnLineTPV.exe"_OnLineTPV.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1884
-
-
C:\Windows\SysWOW64\Zombie.exe"C:\Windows\system32\Zombie.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4928
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1738198120-2966725515-3980530802-1000\desktop.ini.tmp
- Size 74KB
- SHA256 60ec4c141010efd5fc95c0c6f73450be88d44421b667ccf1a17efad04a7be491
- MD5 9e2466fc87118c7058655cbab2110844
- SHA1 8717d20ee38350ce5506452c058ec204584b0bed
- SHA512 879e373892ed26616a435130292083358da660777ac1557a25e83a6ac3a9a545fe990043f3c434e315eee81807dcd904a0607899df154f15b4f428d352f2cd1c
- SSDEEP 768:W7BlpDpARFbhYQkQjjLaMaRRpi1xnRpi1xOYJIJDYJIJMFhWFhCmDpBIjsZORRep:W7ZDpApYbWj2WTWJe+e/qw
- TLSH T12F735AAE9B23F4C2E1062130F91375FCDD362C357D56FDF66AC4992832A2B749486887
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_OnLineTPV.exe
- Size 24KB
- SHA256 f9c97332b9083ad7a87f270f2df64528e219f48f052731972775113c71a18196
- MD5 415f808afc05cfef5ffc37f7887f51dc
- SHA1 70fa9f4bc42cae808d6644b3c391457fa147d9c5
- SHA512 2559aba5c9858be12c931a6747495ceb19ab19acee17b234f652a0e45398dda79fc37f584cca0ff978fcb2e6c3e29e081ee14d37b36e2c0575a3e4dcdcb7dea4
- SSDEEP 384:+YhYnVrpwkj7JvGFFtk4t1cIAxbE9lY4a0kHhU2ixTdepLF7Sq9K:5Y1+kwk4IixiM
- TLSH T18FB262A1FE855DABF661227CCCF7D372A33DF1E10B838B0B4A20513A5752A512ED6607
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Zombie.exe
- Size 74KB
- SHA256 36c6b730b367737cace0f655e8c4fc4c48dba9d0d559099a0f93a5025ed7d923
- MD5 4307a0f695d02d4361f936fc9cdb32f1
- SHA1 117654a239d8cb70459bde5e0d961e2af2e733a3
- SHA512 8c6961b3597430daf7bf27e12d4bd5a62b82f2172c6d07270cf80fcceae60d7873146a2b7d3c53d1059e45343e7c10780105231b62a0ee9de05304830ded54fb
- SSDEEP 768:W7BlpDpARFbhYQkQjjLaMaRRpi1xnRpi1xOYJIJDYJIJMFhWFhCmDpBIjsZORRex:W7ZDpApYbWj2WTWJe+e/qg
- TLSH T169734AAE9B23F4C2E1062130F91375FCDD362C357D56FDF66AC4892832A2B749486987
- MD5 SHA1 SHA512 SSDEEP TLSH