Analysis
- max time kernel
149s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/08/2026, 01:19
Behavioral task
behavioral1
Sample
2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe
- Size 85KB
- Sample260802-bpyf4a1gmf
- SHA256 23c655f830f7623ae49b29409d1c739efb418185e65bc75de723863dce80296c
- MD5 1072ac07c4a018b69a0bd12c57f83cd0
- SHA1 30082f42ee7bc55d4a3b778a7026b376f12b92e5
- SHA512 5f55f80a1a4a177b516a14c437e6258c7c27d605d36f4c28aaf178ba3865a1ad632e15bbf31b16597ff0653dd972fb8b5d7a81261b2021c2bd5a0720fa814a76
- SSDEEP 1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEhT:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsi
- TLSH T1F5833A2E9DEEF0D3F3EA2270D92B769C9C19BC0AADF6BC763E4135951801EB2450514B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 2 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral1/files/0x000c0000000242e6-1.dat family_cosmu behavioral1/files/0x00040000000217d7-5.dat family_cosmu - Renames multiple (4885) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md.tmp 2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Riblet.eftx.tmp 2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrfralm.dat.tmp 2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\msinfo32.exe.mui.tmp 2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe File created C:\Program Files\Common Files\System\Ole DB\sqloledb.dll.tmp 2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ja\WindowsBase.resources.dll.tmp 2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\PresentationUI.resources.dll.tmp 2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\MidgardStrings.json.tmp 2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_F_COL.HXK.tmp 2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-140.png.tmp 2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe File created C:\Program Files\Common Files\System\Ole DB\it-IT\msdasqlr.dll.mui.tmp 2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\US_export_policy.jar.tmp 2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ul-phn.xrm-ms.tmp 2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\OutlookMailNaiveBayesCommandRanker.txt.tmp 2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.Common.FrontEnd.dll.tmp 2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART5.BDR.tmp 2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Controls.Ribbon.resources.dll.tmp 2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe.tmp 2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe File created C:\Program Files\Microsoft Office\Office16\OSPP.HTM.tmp 2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ppd.xrm-ms.tmp 2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.DataWarehouse.DLL.tmp 2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\NOTE.CFG.tmp 2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msdaremr.dll.mui.tmp 2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.Annotations.dll.tmp 2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationProvider.resources.dll.tmp 2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-ul-phn.xrm-ms.tmp 2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClientSideProviders.resources.dll.tmp 2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.tmp 2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OutlookLogoSmall.contrast-black_scale-80.png.tmp 2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ValueTuple.dll.tmp 2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe File created C:\Program Files\GroupExpand.vst.tmp 2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-ul-oob.xrm-ms.tmp 2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-pl.xrm-ms.tmp 2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-ul-oob.xrm-ms.tmp 2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-80.png.tmp 2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.Lightweight.dll.tmp 2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp 2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\prism_sw.dll.tmp 2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_K_COL.HXK.tmp 2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy.jar.tmp 2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WordNaiveBayesCommandRanker.txt.tmp 2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ExcelCtxUICellModel.bin.tmp 2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\DRUMROLL.WAV.tmp 2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fr-fr.dll.tmp 2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordaccore.dll.tmp 2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationClientSideProviders.resources.dll.tmp 2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ja\System.Windows.Forms.Primitives.resources.dll.tmp 2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-utility-l1-1-0.dll.tmp 2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_it.properties.tmp 2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-pl.xrm-ms.tmp 2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ppd.xrm-ms.tmp 2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encoding.Extensions.dll.tmp 2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationTypes.resources.dll.tmp 2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\eula.dll.tmp 2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-ppd.xrm-ms.tmp 2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.MemoryMappedFiles.dll.tmp 2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Parallel.dll.tmp 2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Drawing.Common.dll.tmp 2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Resources.Extensions.dll.tmp 2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\LICENSE.tmp 2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ppd.xrm-ms.tmp 2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\TellMeOutlookAppt.nrr.tmp 2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.AnalysisServices.AdomdClientUI.dll.tmp 2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe File created C:\Program Files\Common Files\System\Ole DB\msdasql.dll.tmp 2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-01_1072ac07c4a018b69a0bd12c57f83cd0_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-668679576-120646659-2289335452-1000\desktop.ini.tmp
- Size 85KB
- SHA256 db62b242a4aa3597d3eaa4be648ac6e452fba984eaa976a0c4d578019e1c23a8
- MD5 feb6aeb6f146031fa082f518f9c72ec7
- SHA1 9dd8520229772cd190d3105684b9f90759008b9b
- SHA512 13af5804935b4cee37ee97d4723123a527447cacef0574ab41c6af241618c18e159d58b83a9aa8f999aba688ea9e39593828e99d54bbc03e5808dae200f988b1
- SSDEEP 1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEht:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsc
- TLSH T12883292E9DEEF0D3F3AA2170D92B769C9C1ABC0AADF6BC763E4135D51801EB2450514B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 184KB
- SHA256 43e4ad37c4190f02e505728607c7c054a1840308545670c1f52f0240a68a1c87
- MD5 dcab11d5df907214ba6531d5c99f1c93
- SHA1 2d179ba891ea75a215b40bc1bfd7ad9ba7cf29a2
- SHA512 21ba95dcbee114da9333a05816029a99a311d0d3f25b2a9cc523ab72ab61f9fcc6818b53319e29ecc0d62babeb5f439744973ed0210c7ff1ae616f466ce21705
- SSDEEP 3072:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFslEhLfyB0:PqFF2Ie+eFBMfTinqncsWp+E
- TLSH T1780418217CAEF1E1CB942278A92B7E8B86057D4F7C9ADD7276A135E35028EB10C470D7
- MD5 SHA1 SHA512 SSDEEP TLSH