Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/08/2026, 11:38
Behavioral task
behavioral1
Sample
2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe
- Size 2.0MB
- Sample260808-nrtbdaen3t
- SHA256 67aeef90341f5c97a9218e06d54a15ed8fcaa1ed4099ff19148ba0ca2e4b1091
- MD5 90cc894df6508f6c82a85d1648c95db8
- SHA1 9846e480294b8fdaa16888bf28280f7226a01e08
- SHA512 d258fdca5fa0842c151f7eed2d98b64de4e710c9d3ab0209f1aba37c93e7cdc35dde85ebab6f65baefbf7f4d1ab3ca366eb97dee9ad762df8b92aac70be18e3e
- SSDEEP 24576:GqOVLLpc7ckPc9QlmJMEx2H2zy5skmKGsgvJgtpeuhOfCm/rDAyf/WMjOa+XFL+r:G3d4arkJwam/rE4+MjOhVIale
- TLSH T18095E7F56A7E7ECCCDF24CE42213B0B1E945732F2F34F5D4D1A6118C6224AA655222EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral1/memory/5016-0-0x0000000000400000-0x000000000040A000-memory.dmp family_cosmu behavioral1/files/0x000a000000016817-2.dat family_cosmu behavioral1/files/0x000400000002184a-6.dat family_cosmu behavioral1/memory/5016-239-0x0000000000400000-0x000000000040A000-memory.dmp family_cosmu - Detects executables packed with eXPressor 4 IoCs
resource yara_rule behavioral1/memory/5016-0-0x0000000000400000-0x000000000040A000-memory.dmp INDICATOR_EXE_Packed_eXPressor behavioral1/files/0x000a000000016817-2.dat INDICATOR_EXE_Packed_eXPressor behavioral1/files/0x000400000002184a-6.dat INDICATOR_EXE_Packed_eXPressor behavioral1/memory/5016-239-0x0000000000400000-0x000000000040A000-memory.dmp INDICATOR_EXE_Packed_eXPressor - Renames multiple (1365) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui.tmp 2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.FileSystem.dll.tmp 2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.dll.tmp 2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.dll.tmp 2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationTypes.resources.dll.tmp 2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\WindowsBase.resources.dll.tmp 2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\cs.txt.tmp 2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml.tmp 2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-datetime-l1-1-0.dll.tmp 2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationClientSideProviders.resources.dll.tmp 2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\IpsPlugin.dll.tmp 2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\TabTip.exe.mui.tmp 2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\.version.tmp 2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Contracts.dll.tmp 2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.ThreadPool.dll.tmp 2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.VisualBasic.Core.dll.tmp 2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Reflection.Metadata.dll.tmp 2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationUI.resources.dll.tmp 2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\be.txt.tmp 2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Transactions.dll.tmp 2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.ServicePoint.dll.tmp 2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.OpenSsl.dll.tmp 2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Collections.Immutable.dll.tmp 2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationTypes.resources.dll.tmp 2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationClientSideProviders.dll.tmp 2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationFramework.resources.dll.tmp 2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll.tmp 2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll.tmp 2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\tabskb.dll.mui.tmp 2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml.tmp 2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.UnmanagedMemoryStream.dll.tmp 2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Threading.Tasks.Parallel.dll.tmp 2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationFramework.resources.dll.tmp 2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll.tmp 2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe File created C:\Program Files\dotnet\host\fxr\7.0.16\hostfxr.dll.tmp 2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe.tmp 2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Globalization.dll.tmp 2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Input.Manipulations.dll.tmp 2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Xaml.resources.dll.tmp 2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\ReachFramework.resources.dll.tmp 2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\Microsoft.VisualBasic.Forms.resources.dll.tmp 2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml.tmp 2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-synch-l1-2-0.dll.tmp 2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Handles.dll.tmp 2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Xml.Linq.dll.tmp 2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Private.CoreLib.dll.tmp 2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.Design.resources.dll.tmp 2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Input.Manipulations.resources.dll.tmp 2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Pipes.dll.tmp 2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Runtime.Serialization.Xml.dll.tmp 2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationFramework.resources.dll.tmp 2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemXmlLinq.dll.tmp 2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp 2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.CodeDom.dll.tmp 2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.tmp 2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\InputPersonalization.exe.mui.tmp 2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui.tmp 2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\netstandard.dll.tmp 2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.Serialization.dll.tmp 2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.Native.dll.tmp 2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Transactions.dll.tmp 2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.Serialization.dll.tmp 2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebProxy.dll.tmp 2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ValueTuple.dll.tmp 2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_90cc894df6508f6c82a85d1648c95db8_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini.tmp
- Size 2.0MB
- SHA256 498650e7d86cdb0da02db8b9175ab4d21cc3929c6a19c0c6d7777340fef55b1a
- MD5 63a9eb4ffadb8c9c658964d05a731ea0
- SHA1 007bc3aaec0e97f775b393d3fc2c04a66db93499
- SHA512 dd1ca4bf32243df3e1b9191d67d1496d595207684ed5fb2422d16334a19583544fced3f4833a7d86f9ee373d44eaebc76813e398166dc41a9a1adddf4b9b2a5d
- SSDEEP 24576:GqOVLLpc7ckPc9QlmJMEx2H2zy5skmKGsgvJgtpeuhOfCm/rDAyf/WMjOa+XFL+d:G3d4arkJwam/rE4+MjOhVIalU
- TLSH T15895E7F56A7E7ECCCDF24CE42213B0B1E945732F2F34F5D4D1A6118C6224AA655222EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 2.1MB
- SHA256 72de93d7004a0303ae3979c36a6436cb78554440b0f7faef615512998a3c1e4b
- MD5 7514a02626c6f6273f9225a8e17894db
- SHA1 2a558905a0960361471e6a9b0051168ed3f1e492
- SHA512 d055d0ea896a5405091f64df188d4b4fd35d934f2920b419946033ebe4b613a16e844e6094c8463c0c56df8fe201e0422932ebc5c9620bf2793d192f3e225aba
- SSDEEP 24576:GqOVLLpc7ckPc9QlmJMEx2H2zy5skmKGsgvJgtpeuhOfCm/rDAyf/WMjOa+XFL+d:G3d4arkJwam/rE4+MjOhVIalmMG
- TLSH T18DA5F7F56A7F7ECCCDF248E42113B4B1E945732F2F34F5D4D1A6018C6224AA659222EB
- MD5 SHA1 SHA512 SSDEEP TLSH