Analysis
- max time kernel
150s - max time network
116s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 15:31
Behavioral task
behavioral1
Sample
2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe
- Size 3.1MB
- Sample260808-sx1pvstvbx
- SHA256 5066658a33ce6860c68d058f203c7e2588eda5670eaf0028c32474cfa5dc6879
- MD5 d897342ff7e980b43df84553098d3448
- SHA1 27d28632f23f508b932e0cc8c934683931bb6f9b
- SHA512 e84c4ab9482044c830a25b2d050b1d753bae8b2bbcb3345cbf18e594c760496ce28072c444ff9aab34cdf8528f77a53f774b1a0fd571a0e0a0825c9863be4b1f
- SSDEEP 49152:G424pOK123wBa1c603wsZga2udET1I+51Oj1CvTA+GG6OHrR:3qEv60gsOTGMNLR
- TLSH T1EAE5299A767CB870E481553FAEA886839D8B5D113285DF7C00B541A34F580A7FC4AFAF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/memory/1096-0-0x0000000000400000-0x000000000040A000-memory.dmp family_cosmu behavioral2/files/0x000600000001b85f-2.dat family_cosmu behavioral2/files/0x000400000001b1cd-6.dat family_cosmu behavioral2/memory/1096-117-0x0000000000400000-0x000000000040A000-memory.dmp family_cosmu - Detects executables packed with eXPressor 4 IoCs
resource yara_rule behavioral2/memory/1096-0-0x0000000000400000-0x000000000040A000-memory.dmp INDICATOR_EXE_Packed_eXPressor behavioral2/files/0x000600000001b85f-2.dat INDICATOR_EXE_Packed_eXPressor behavioral2/files/0x000400000001b1cd-6.dat INDICATOR_EXE_Packed_eXPressor behavioral2/memory/1096-117-0x0000000000400000-0x000000000040A000-memory.dmp INDICATOR_EXE_Packed_eXPressor - Renames multiple (557) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\InkObj.dll.mui.tmp 2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipTsf.dll.mui.tmp 2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe File created C:\Program Files\Common Files\System\msadc\adcvbs.inc.tmp 2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.NETCore.App.runtimeconfig.json.tmp 2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\nn.txt.tmp 2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.tmp 2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\as-IN\tipresx.dll.mui.tmp 2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\msinfo32.exe.mui.tmp 2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe File created C:\Program Files\Common Files\System\ado\adovbs.inc.tmp 2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui.tmp 2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tipresx.dll.mui.tmp 2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l1-2-0.dll.tmp 2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-synch-l1-1-0.dll.tmp 2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Pipes.AccessControl.dll.tmp 2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Queryable.dll.tmp 2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.bg-bg.dll.tmp 2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.FileVersionInfo.dll.tmp 2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Web.dll.tmp 2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\hr.txt.tmp 2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordaccore.dll.tmp 2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Uri.dll.tmp 2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Metadata.dll.tmp 2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordaccore.dll.tmp 2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\lij.txt.tmp 2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\ne.txt.tmp 2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp 2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui.tmp 2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml.tmp 2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\tipskins.dll.tmp 2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\msinfo32.exe.mui.tmp 2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-util-l1-1-0.dll.tmp 2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe File created C:\Program Files\7-Zip\License.txt.tmp 2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.tmp 2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll.tmp 2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe File created C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui.tmp 2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\netstandard.dll.tmp 2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebSockets.Client.dll.tmp 2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clrjit.dll.tmp 2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Immutable.dll.tmp 2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\tr.txt.tmp 2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll.tmp 2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll.tmp 2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tipresx.dll.mui.tmp 2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe File created C:\Program Files\Common Files\System\ado\msadomd28.tlb.tmp 2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Encoding.dll.tmp 2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.NETCore.App.runtimeconfig.json.tmp 2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\mk.txt.tmp 2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe File created C:\Program Files\7-Zip\readme.txt.tmp 2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll.tmp 2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fi-fi.dll.tmp 2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\gu-IN\tipresx.dll.mui.tmp 2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\Microsoft.Ink.dll.tmp 2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.dll.tmp 2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\pt-br.txt.tmp 2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TabTip.exe.mui.tmp 2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe.tmp 2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe File created C:\Program Files\Common Files\System\msadc\msdarem.dll.tmp 2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.ReaderWriter.dll.tmp 2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\fr.txt.tmp 2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll.tmp 2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\ta-IN\tipresx.dll.mui.tmp 2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l1-1-0.dll.tmp 2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Concurrent.dll.tmp 2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Specialized.dll.tmp 2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_d897342ff7e980b43df84553098d3448_cobalt-strike_elex_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1096
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini.tmp
- Size 3.1MB
- SHA256 9a21319ac7149f89a54ed88aed7e082545dbffbcf76ac1f54f692dd4afa1039f
- MD5 eef564d174b54525e52a80429b9fbbc8
- SHA1 2d3f346c951ae5ec580ee21a803b5f3409959722
- SHA512 cd8570b63ed3d1fb94e6a19747a9c19f39718ae98e1ebd716a0268577bcf51507a53016730f6338c1c5f5895d2dc6b2e4bc0c9b82a79d2833c04909e54ff8455
- SSDEEP 49152:G424pOK123wBa1c603wsZga2udET1I+51Oj1CvTA+GG6OHrd:3qEv60gsOTGMNLd
- TLSH T1EFE5299A767CB870E481553FAEA886839D8B5D113285DF7C00B541A34F580A7FC4AFAF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 3.2MB
- SHA256 341f6c9da48766145e50c40959a365c0265bad854e1447697b67f8aadaaa43b9
- MD5 30171e5087e035a777075e232dc2cbbe
- SHA1 28ebe090f8f0170f2be972ec8b2f880464ff4999
- SHA512 16d5d1b22d64e19521162fbeb79e26ef1ced930264e54ce0dde7e5551ca8807991b89e2b99605c81c29650bf1409760e66c5fff3db65477c55a0ea59f326264c
- SSDEEP 49152:G424pOK123wBa1c603wsZga2udET1I+51Oj1CvTA+GG6OHr9M1:3qEv60gsOTGMNL8
- TLSH T17DF52999763CB870D481513FAEAA86839D8B5D113A85DF7C00B541A34F580A7FC4AFAF
- MD5 SHA1 SHA512 SSDEEP TLSH