Analysis
- max time kernel
150s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 11:29
Behavioral task
behavioral1
Sample
2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe
- Size 660KB
- Sample260808-nl2essel8t
- SHA256 ef526d1e3036dab2126fcf6df3f15414f6d46fd0890b36bbaa8220420221eb63
- MD5 c83b4d112e473901339570b0cfb311d2
- SHA1 023d97061e8c8d60e1f69343950332e408288306
- SHA512 b9ce1f0faf4c9c521edafb525f2eedec89092f1945e8dedb8eb40023d56f06bab7d2ef8a6885dbcce7733b357f4c420005e9bf6a865f85f1504c0701fcc635b5
- SSDEEP 12288:G5xjuub0UuFgDLPL+lj7MCx/5yrDoD6QOk9mzNLb:GSgD6/MrD/QlmJ/
- TLSH T117E418D6377D9BEDDEB749718957C1787B42320F1FACD8ED9036A8ADA204D38984600B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/memory/5816-0-0x0000000000400000-0x000000000040A000-memory.dmp family_cosmu behavioral2/files/0x00150000000118ee-2.dat family_cosmu behavioral2/files/0x000300000001b1a0-6.dat family_cosmu behavioral2/memory/5816-338-0x0000000000400000-0x000000000040A000-memory.dmp family_cosmu - Detects executables packed with eXPressor 4 IoCs
resource yara_rule behavioral2/memory/5816-0-0x0000000000400000-0x000000000040A000-memory.dmp INDICATOR_EXE_Packed_eXPressor behavioral2/files/0x00150000000118ee-2.dat INDICATOR_EXE_Packed_eXPressor behavioral2/files/0x000300000001b1a0-6.dat INDICATOR_EXE_Packed_eXPressor behavioral2/memory/5816-338-0x0000000000400000-0x000000000040A000-memory.dmp INDICATOR_EXE_Packed_eXPressor - Renames multiple (2023) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Private.Uri.dll.tmp 2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.resources.dll.tmp 2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\System.Windows.Forms.resources.dll.tmp 2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp 2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\yo.txt.tmp 2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\System.Windows.Forms.resources.dll.tmp 2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp 2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml.tmp 2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\kn-IN\tipresx.dll.mui.tmp 2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msaddsr.dll.mui.tmp 2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe File created C:\Program Files\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui.tmp 2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationProvider.resources.dll.tmp 2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\Microsoft.WindowsDesktop.App.runtimeconfig.json.tmp 2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-handle-l1-1-0.dll.tmp 2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.StackTrace.dll.tmp 2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.NonGeneric.dll.tmp 2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.OpenSsl.dll.tmp 2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Reflection.Emit.Lightweight.dll.tmp 2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\PresentationCore.resources.dll.tmp 2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\WindowsFormsIntegration.resources.dll.tmp 2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Threading.AccessControl.dll.tmp 2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\cs\System.Xaml.resources.dll.tmp 2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe File created C:\Program Files\CompareFind.m1v.tmp 2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe.tmp 2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.ComponentModel.TypeConverter.dll.tmp 2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Runtime.CompilerServices.VisualC.dll.tmp 2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\WindowsBase.resources.dll.tmp 2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\PresentationCore.resources.dll.tmp 2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\System.Windows.Forms.resources.dll.tmp 2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_elf.dll.tmp 2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\SharedPerformance.man.tmp 2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XmlDocument.dll.tmp 2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe.tmp 2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe.tmp 2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe.tmp 2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Input.Manipulations.resources.dll.tmp 2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\WindowsFormsIntegration.resources.dll.tmp 2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\ReachFramework.resources.dll.tmp 2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationNative_cor3.dll.tmp 2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\tr\System.Xaml.resources.dll.tmp 2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\hi.txt.tmp 2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordaccore_amd64_amd64_7.0.1624.6629.dll.tmp 2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.Design.resources.dll.tmp 2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.Native.dll.tmp 2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebHeaderCollection.dll.tmp 2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Xml.XmlSerializer.dll.tmp 2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationProvider.resources.dll.tmp 2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\PresentationFramework.resources.dll.tmp 2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\fr\System.Windows.Controls.Ribbon.resources.dll.tmp 2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Parallel.dll.tmp 2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\ur.pak.tmp 2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\ReachFramework.resources.dll.tmp 2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\ja.txt.tmp 2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.OpenSsl.dll.tmp 2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Forms.Design.resources.dll.tmp 2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClient.resources.dll.tmp 2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.EventBasedAsync.dll.tmp 2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.TraceSource.dll.tmp 2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.HttpListener.dll.tmp 2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.dll.tmp 2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe File created C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui.tmp 2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.IO.FileSystem.Watcher.dll.tmp 2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\fi.pak.tmp 2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml.tmp 2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_c83b4d112e473901339570b0cfb311d2_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1014449518-1831897916-4205727055-1000\desktop.ini.tmp
- Size 660KB
- SHA256 f0ed068f0f5e1dad76e938671ca47a15589fd1da56ea9fa083f943c4af9f0b8e
- MD5 5562137a7d8c7c7eb840bcbd996451be
- SHA1 ae7f6542df519b65dfbf1ca4d979f196babe2e82
- SHA512 f6a1c02b1b8bc4a354eed7cfb86d2302af2e5530ab6d243b2348acb9ff65c757bdeea6a625a170fe6bc84a5252187e355f8afedc7b1cf91d37ce8a0b2a46eb6f
- SSDEEP 12288:G5xjuub0UuFgDLPL+lj7MCx/5yrDoD6QOk9mzNLH:GSgD6/MrD/QlmJz
- TLSH T101E418D6377D9BEDDEB749718957C1787B42320F1FACD8ED9036A8ADA204D38984600B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 759KB
- SHA256 f7eca947911ad79e9c1884371a6f8a3f0cb728838c0061f6fe1a871eb69b4232
- MD5 6890604d56fd45e165d49cdfeedbba4d
- SHA1 af22a0ec76fb0468e352c3759d3deabbdeca31ae
- SHA512 a121d090b67910e86951bb5ba0510c28c991c7c670064dd566151082fc33a630d5c1340d20cb4058f119a54e902620f0db433c5b5e42319bcc91f94106282544
- SSDEEP 12288:G5xjuub0UuFgDLPL+lj7MCx/5yrDoD6QOk9mzNLdMfunbsW8u:GSgD6/MrD/QlmJ5MfSgWR
- TLSH T100F44BD63B7DABFDCEB709359917C1797741320F2F6CD8A99036A8AD6218D38884704B
- MD5 SHA1 SHA512 SSDEEP TLSH