Analysis
- max time kernel
150s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 08:11
Behavioral task
behavioral1
Sample
2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target 2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe
- Size 84KB
- Sample260804-j3ng2sfh49
- SHA256 aa2279c883cb09aa272b20b3903d9cd6a41677e352feca6908f916d90732e92e
- MD5 190e2760ad915f2d7277c48b364ffec7
- SHA1 5627c59d335df8c7b3a50962b06c02a76ca1016b
- SHA512 d6ec5522dfbc11ca8f608dd1cfaf9b5b0906fbac947b0df64a7f2c3521fceb47fccd151c15387bf5c4b2b66205579f253b2f2b2b2b11ce6e6f06fbbf53d052b8
- SSDEEP 1536:67Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q4xFrphg3:+nyiQSo+hg3
- TLSH T1BF831AFA8B11E03DECDB0539989AB763CD317C0DB1E5EEB9EBA4586806947C178CD019
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/memory/3676-0-0x0000000000400000-0x000000000040B000-memory.dmp family_cosmu behavioral2/files/0x000700000001b884-2.dat family_cosmu behavioral2/files/0x000400000001b1ed-6.dat family_cosmu behavioral2/memory/3676-519-0x0000000000400000-0x000000000040B000-memory.dmp family_cosmu - Renames multiple (4222) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- UPX dump on OEP (original entry point) 4 IoCs
resource yara_rule behavioral2/memory/3676-0-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral2/files/0x000700000001b884-2.dat UPX behavioral2/files/0x000400000001b1ed-6.dat UPX behavioral2/memory/3676-519-0x0000000000400000-0x000000000040B000-memory.dmp UPX -
resource yara_rule behavioral2/memory/3676-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x000700000001b884-2.dat upx behavioral2/files/0x000400000001b1ed-6.dat upx behavioral2/memory/3676-519-0x0000000000400000-0x000000000040B000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.tmp 2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe File created C:\Program Files\Common Files\System\ado\msadox28.tlb.tmp 2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe File created C:\Program Files\Internet Explorer\hmmapi.dll.tmp 2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-ul-oob.xrm-ms.tmp 2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-pl.xrm-ms.tmp 2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-debug-l1-1-0.dll.tmp 2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ServiceProcess.dll.tmp 2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationCore.resources.dll.tmp 2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\he.pak.tmp 2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-ul-oob.xrm-ms.tmp 2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-pl.xrm-ms.tmp 2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Grace-ul-oob.xrm-ms.tmp 2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msadcor.dll.mui.tmp 2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe File created C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll.tmp 2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.Brotli.dll.tmp 2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-ul-phn.xrm-ms.tmp 2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.UnmanagedMemoryStream.dll.tmp 2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javafx_iio.dll.tmp 2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ul-phn.xrm-ms.tmp 2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\Microsoft.Ink.Intelligence.TextInput.Implementation.dll.tmp 2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\WindowsBase.resources.dll.tmp 2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jpeg.md.tmp 2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-pl.xrm-ms.tmp 2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-datetime-l1-1-0.dll.tmp 2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscorlib.dll.tmp 2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\PresentationFramework.resources.dll.tmp 2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Grace-ul-oob.xrm-ms.tmp 2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Garamond-TrebuchetMs.xml.tmp 2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\rtscom.dll.mui.tmp 2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.ILGeneration.dll.tmp 2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Xaml.resources.dll.tmp 2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\zip.dll.tmp 2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_MoveDrop32x32.gif.tmp 2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-ul-oob.xrm-ms.tmp 2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\ku.txt.tmp 2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\fr\System.Xaml.resources.dll.tmp 2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-pl.xrm-ms.tmp 2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-pl.xrm-ms.tmp 2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\clrgc.dll.tmp 2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.IO.dll.tmp 2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Reflection.Emit.dll.tmp 2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-errorhandling-l1-1-0.dll.tmp 2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-ppd.xrm-ms.tmp 2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ul-oob.xrm-ms.tmp 2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\offsymxb.ttf.tmp 2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-string-l1-1-0.dll.tmp 2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Trial-ppd.xrm-ms.tmp 2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe File created C:\Program Files\7-Zip\descript.ion.tmp 2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Principal.dll.tmp 2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Diagnostics.StackTrace.dll.tmp 2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp 2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ppd.xrm-ms.tmp 2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms.tmp 2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ppd.xrm-ms.tmp 2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe File created C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui.tmp 2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe File created C:\Program Files\Internet Explorer\ja-JP\ieinstal.exe.mui.tmp 2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe.tmp 2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ppd.xrm-ms.tmp 2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ul-phn.xrm-ms.tmp 2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPackEula.txt.tmp 2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml.tmp 2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationFramework.resources.dll.tmp 2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Xaml.dll.tmp 2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\deploy.dll.tmp 2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_190e2760ad915f2d7277c48b364ffec7_coinminer_elex_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3676
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-552508041-2681165170-3229858294-1000\desktop.ini.tmp
- Size 85KB
- SHA256 33b81a3283fd70fc38fd2f9efa30cb48a8075756924b06cf10be4bb7733b7481
- MD5 c966f7cff9dda97844b95cf9e6c8178a
- SHA1 2cd3772e73210c621cb431c0934f6cd4ea2362ea
- SHA512 2e86b197ba0efe84d9a8b646f14718b252b56527a81dc37ee31936b926157a9e98c612f3ecb5d2e42265ab9f08489f48aaf451c3a2280673aa0aff2871fcbd7b
- SSDEEP 1536:67Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q4xFrphgh:+nyiQSo+hgh
- TLSH T137831AFA8B11E03DECDB05399896B763CD317C0DB1E5EEB9EBA4586806947C178CD029
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 183KB
- SHA256 29aff737783d86a74e3bad56d934d9bf108ef760abb4944a169ae94b5d00e078
- MD5 6bcad22d39a9924eb8cdcbccc89d2637
- SHA1 cb949f6a38022a67bba2734f5f2ce108b2140ba0
- SHA512 26d4bb68032c1ce21308706ee3e0b03d9af0896f5a059f27a7485a79125236fec1d06f2ab6454bf680b1c62324574a803028d2c062c0b013ebe715894be4862a
- SSDEEP 3072:+nyiQSo+hgm5ZMfTiu66I3UwqSsMBlsWb4A+s:JiQSoegQMfTinqncsWp+s
- TLSH T1EE04F7E16F6AF26CCE891239AD5B7F43CE113D4E3CD9CD56A6B415E24128AC11CCF0A6
- MD5 SHA1 SHA512 SSDEEP TLSH