Analysis
- max time kernel
150s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 18:33
Behavioral task
behavioral1
Sample
2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe
- Size 48KB
- Sample260802-w7nd3aeb45
- SHA256 c2cf170316fae22c1abec1d3b30d307d86f65d295a9326ae132e7939ee7ae824
- MD5 55d21461e474aac2b295fb07ebb7d9dd
- SHA1 9e76964c4ec7cfc1d5391b49c3c0d196c86b1f60
- SHA512 cfc2f68efe517bb2b55a4642cfa8be6668ea52d0746fdfe18382dff1f8677c0b728cc1a8ed12bd85f2323456cfa1a99b1df8df2ee06dcff428b87808e82cf8bf
- SSDEEP 768:W7Blp2sspARFbhVgNNHpQRNHpQRBBdMLBdM:W7Z2sspApctpQRtpQRCk
- TLSH T188236C1DAB07CA51FB1A2330640B89385173212C2D75DDEBEA22CD997232AF9F43569D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 2 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000a000000019caa-1.dat family_cosmu behavioral2/files/0x000400000001b1c0-5.dat family_cosmu - Renames multiple (4336) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-ul-phn.xrm-ms.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Net.dll.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Printing.dll.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\VisualElements\SmallLogoCanary.png.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Configuration.dll.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Collections.Immutable.dll.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.ConnectionUI.dll.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Accessibility.dll.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 8.0.15 (x64).swidtag.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Integration\SPPRedist.msi.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ppd.xrm-ms.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_K_COL.HXK.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll.manifest.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-string-l1-1-0.dll.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.Design.Editors.dll.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\UIAutomationClient.resources.dll.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-time-l1-1-0.dll.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ServiceProcess.dll.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\WindowsFormsIntegration.dll.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINCORE.DLL.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.UnmanagedMemoryStream.dll.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\cs.pak.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\fontconfig.properties.src.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_Subscription-pl.xrm-ms.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.AccessControl.dll.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-ppd.xrm-ms.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\tr\System.Windows.Input.Manipulations.resources.dll.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ul-oob.xrm-ms.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-ppd.xrm-ms.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\TellMeOutlookMeetingReqSend.nrr.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processthreads-l1-1-1.dll.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\cmm\sRGB.pf.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ppd.xrm-ms.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Web.HttpUtility.dll.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Metadata.dll.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Overlapped.dll.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pl\WindowsFormsIntegration.resources.dll.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\README.html.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ppd.xrm-ms.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Formats.Tar.dll.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\libGLESv2.dll.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremDemoR_BypassTrial365-ul-oob.xrm-ms.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-ppd.xrm-ms.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ul-phn.xrm-ms.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ul-oob.xrm-ms.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_K_COL.HXK.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\splashscreen.dll.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\lib\deployment.config.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javafx_font.dll.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Grace-ppd.xrm-ms.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\offsymt.ttf.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msadcor.dll.mui.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ppd.xrm-ms.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\mng.txt.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig-office.xrm-ms.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-private-l1-1-0.dll.tmp 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_55d21461e474aac2b295fb07ebb7d9dd_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-4046655672-1449839301-2197395821-1000\desktop.ini.tmp
- Size 48KB
- SHA256 06137a312c228fde5c965bfd1e3faf54eb6b9a0ad0a6072c45f2550df95a9444
- MD5 c4e4aa65062d6fdcf9e287d75d4ac9c3
- SHA1 2171e47b81ffc184a31e798348e7dabd09f98fa2
- SHA512 91fbf5ef8b38d3d9adf85cd967bdb14f5a5aabd69503c6424e8d87fbcd439b846bbe137149cf2e889bd11705ba4948f42eaac7acf2dcafb40f23d2c5897cb89f
- SSDEEP 768:W7Blp2sspARFbhVgNNHpQRNHpQRBBdMLBdMr:W7Z2sspApctpQRtpQRCkr
- TLSH T15D237D1DAB07CA51FB1A1330640B89385173212C2D759DEBEA32CD997232BF9F43569D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 147KB
- SHA256 601239708d63b53f8f42c66becafe739f84a5f38f01b3b17f04b3db879b3a2b1
- MD5 1f02b12690292305917fee5d62caecbf
- SHA1 89c874254081248912ae0344ca54ddb7daed7a46
- SHA512 ce9250034d12107d7a1bafa0c5fb723234a6d66817c948391da323c61e5396ceab85394b8a3798a3b05d6c6e429830dd31485a64231ff2a2e92924a494f9e7a9
- SSDEEP 3072:62ssWpACa5ZMfTiu66I3UwqSsMBlsWb4A+7:MVSCsMfTinqncsWp+7
- TLSH T1D6E317607CAEF6A0CF4413796D5B9E83C301398F3C5ACE82B6B545E39139D950CAB4E6
- MD5 SHA1 SHA512 SSDEEP TLSH