Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/08/2026, 18:33
Behavioral task
behavioral1
Sample
2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe
- Size 48KB
- Sample260802-w7nd3aeb45
- SHA256 c2cf170316fae22c1abec1d3b30d307d86f65d295a9326ae132e7939ee7ae824
- MD5 55d21461e474aac2b295fb07ebb7d9dd
- SHA1 9e76964c4ec7cfc1d5391b49c3c0d196c86b1f60
- SHA512 cfc2f68efe517bb2b55a4642cfa8be6668ea52d0746fdfe18382dff1f8677c0b728cc1a8ed12bd85f2323456cfa1a99b1df8df2ee06dcff428b87808e82cf8bf
- SSDEEP 768:W7Blp2sspARFbhVgNNHpQRNHpQRBBdMLBdM:W7Z2sspApctpQRtpQRCk
- TLSH T188236C1DAB07CA51FB1A2330640B89385173212C2D75DDEBEA22CD997232AF9F43569D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 2 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral1/files/0x0013000000024353-1.dat family_cosmu behavioral1/files/0x00060000000217ac-5.dat family_cosmu - Renames multiple (4910) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\PrivacySandboxAttestationsPreloaded\privacy-sandbox-attestations.dat.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-heap-l1-1-0.dll.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\jsound.dll.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_LinkDrop32x32.gif.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-pl.xrm-ms.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTest-ppd.xrm-ms.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\ClearGroup.xltx.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationCore.resources.dll.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationFramework.resources.dll.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Drawing.dll.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\WindowsAccessBridge-64.dll.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\charsets.jar.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\EXITEM.CFG.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-140.png.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Xml.ReaderWriter.dll.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_Grace-ul-oob.xrm-ms.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-pl.xrm-ms.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Grace-ul-oob.xrm-ms.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\NPSPWRAP.DLL.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Immutable.dll.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.dll.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationTypes.resources.dll.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Internet Explorer\es-ES\iexplore.exe.mui.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ul-phn.xrm-ms.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ul-oob.xrm-ms.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-ul-oob.xrm-ms.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ppd.xrm-ms.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-80.png.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\DRUMROLL.WAV.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-100.png.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OutlookLogo.contrast-white_scale-100.png.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\mce.dll.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tabskb.dll.mui.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.AppContext.dll.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationCore.resources.dll.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-pl.xrm-ms.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-ul-oob.xrm-ms.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-pl.xrm-ms.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\CSS7DATA0009.DLL.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\mscss7wre_fr.dub.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSTYLE.DLL.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationClient.resources.dll.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\sunec.dll.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\accessibility.properties.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-ul-oob.xrm-ms.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-pl.xrm-ms.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-ppd.xrm-ms.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\linesdistinctive.dotx.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\CHICAGO.XSL.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial.xml.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ppd.xrm-ms.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql70.xsl.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-140.png.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\mfc140u.dll.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.TypeExtensions.dll.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\System.Windows.Forms.Design.resources.dll.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Violet II.xml.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ul-oob.xrm-ms.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\trdtv2r41.xsl.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2937465464-4167303362-2236413517-1000\desktop.ini.tmp
- Size 48KB
- SHA256 7acf025c1af40e9716357cd835f15434412050a0866b4c1cd6313e57daa992a4
- MD5 a7f075505b0af5c28459c67d9e53ae12
- SHA1 43f1cd847720a0fc6cbcad1599075da76fe07585
- SHA512 78daa769e0b1522c01172172b2264bfd1618e66bf8a28c5c7b4721e3e327fd510193c284f0439b4141ce22b7910e1c8ef837ed96e49c804f92aa2d8cd25d1a8d
- SSDEEP 768:W7Blp2sspARFbhVgNNHpQRNHpQRBBdMLBdMp:W7Z2sspApctpQRtpQRCkp
- TLSH T14E237D1DAB07CA51FB1A1330640B89385173212C2D759DEBEA32CD997232BF9F43569D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 147KB
- SHA256 61239808a7ae2347d85c521fde7200e2162d027b005919f5592690f087aa7ed1
- MD5 969da9077b8a3d2dc5d152403934562c
- SHA1 ac3fdc1d76f346687529110483056e7e62cd0a51
- SHA512 a61893a80ffe7d7866fcf371e050a4a9749b25ac245be04a19c97bad97aa438aa8650546042519d87cbe3ab94cc73b21066ae0614f71f06eb7f53ee7d77cdae3
- SSDEEP 3072:62ssWpACV5ZMfTiu66I3UwqSsMBlsWb4A+7:MVSC9MfTinqncsWp+7
- TLSH T126E317607CAEF6A0CF4413796D5B9E83C301398F3C5ACE82B6B545E39139D950CAB4E6
- MD5 SHA1 SHA512 SSDEEP TLSH