Analysis
- max time kernel
150s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 17:17
Behavioral task
behavioral1
Sample
2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe
- Size 1.5MB
- Sample260808-vtwmvaap4v
- SHA256 e39968615a0e06805eb67403629f6925f7db1485e69cfdf2248119539c70227e
- MD5 c3013d81818b52ada0515aeb63a67f5f
- SHA1 8b7e2560efea939eaa00d249df7e3d789bdb1f5d
- SHA512 d53b5b8ff3dff8e0b9ed8ce357f0c0371762a2e9775e3bc5f8d6b35d9c1636d94e6bef98bb72a96e6ff1254eb5f87bc833a618b9917e44764f0d6fe638e78f8f
- SSDEEP 24576:G42F4pOtA123wBahui3dql5N60gY6LmE3+xbZI:G424pOK123wBa1c603wsZI
- TLSH T132656185797CB870D581143FFDBC8682ADCB5E6162454B2C10B982938F5D0A3FC5ABEE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/memory/4344-0-0x0000000000400000-0x000000000040A000-memory.dmp family_cosmu behavioral2/files/0x000f000000019c8f-2.dat family_cosmu behavioral2/files/0x000300000001b1a7-6.dat family_cosmu behavioral2/memory/4344-237-0x0000000000400000-0x000000000040A000-memory.dmp family_cosmu - Detects executables packed with eXPressor 4 IoCs
resource yara_rule behavioral2/memory/4344-0-0x0000000000400000-0x000000000040A000-memory.dmp INDICATOR_EXE_Packed_eXPressor behavioral2/files/0x000f000000019c8f-2.dat INDICATOR_EXE_Packed_eXPressor behavioral2/files/0x000300000001b1a7-6.dat INDICATOR_EXE_Packed_eXPressor behavioral2/memory/4344-237-0x0000000000400000-0x000000000040A000-memory.dmp INDICATOR_EXE_Packed_eXPressor - Renames multiple (1260) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\Lang\th.txt.tmp 2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.tmp 2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msdaremr.dll.mui.tmp 2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-memory-l1-1-0.dll.tmp 2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.SecureString.dll.tmp 2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ServiceModel.Web.dll.tmp 2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\Microsoft.NETCore.App.runtimeconfig.json.tmp 2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Classic.dll.tmp 2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\Microsoft.Ink.Intelligence.TextInput.Skill.dll.tmp 2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.Brotli.dll.tmp 2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Pipes.AccessControl.dll.tmp 2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.TypeConverter.dll.tmp 2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Net.dll.tmp 2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp 2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.resources.dll.tmp 2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationProvider.resources.dll.tmp 2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\SubsystemController.man.tmp 2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\tipskins.dll.tmp 2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui.tmp 2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.DiaSymReader.Native.amd64.dll.tmp 2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.AppContext.dll.tmp 2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.resources.dll.tmp 2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\PresentationUI.resources.dll.tmp 2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationFramework.resources.dll.tmp 2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.tmp 2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipRes.dll.mui.tmp 2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Runtime.Serialization.Primitives.dll.tmp 2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationClientSideProviders.resources.dll.tmp 2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationClientSideProviders.dll.tmp 2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Tools.dll.tmp 2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp 2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Input.Manipulations.resources.dll.tmp 2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\WindowsBase.resources.dll.tmp 2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe File created C:\Program Files\Common Files\System\Ole DB\msdatl3.dll.tmp 2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Transactions.dll.tmp 2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.tmp 2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\is-IS\tipresx.dll.mui.tmp 2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe File created C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui.tmp 2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.SecureString.dll.tmp 2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.IO.Pipes.dll.tmp 2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationProvider.resources.dll.tmp 2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp 2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.th-th.dll.tmp 2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.DiaSymReader.Native.amd64.dll.tmp 2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Resources.Writer.dll.tmp 2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\ca-ES-valencia\tipresx.dll.mui.tmp 2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml.tmp 2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe File created C:\Program Files\Common Files\System\uk-UA\wab32res.dll.mui.tmp 2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.TraceSource.dll.tmp 2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.dll.tmp 2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Overlapped.dll.tmp 2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.resources.dll.tmp 2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.tr-tr.dll.tmp 2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.Annotations.dll.tmp 2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Process.dll.tmp 2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.Reader.dll.tmp 2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationFramework.resources.dll.tmp 2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\D3DCompiler_47_cor3.dll.tmp 2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\sr-Cyrl-BA\tipresx.dll.mui.tmp 2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Threading.Tasks.dll.tmp 2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.AeroLite.dll.tmp 2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp 2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationCore.resources.dll.tmp 2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml.tmp 2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_c3013d81818b52ada0515aeb63a67f5f_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1079202589-886135813-2527035092-1000\desktop.ini.tmp
- Size 1.5MB
- SHA256 53f3a7240f0a8be7025b680cf6e85f0aa5c92a678ba12f8a2088941fd79d871d
- MD5 03eacb78035503a10b37661c50c80260
- SHA1 4d750b87bb046f0d97958727ed68b11a894463e1
- SHA512 3b5a65c8fe84891798e9c521f5577b8614bf8ff91ac75f6d3fe153170ebdf1d448b85a99fa4d4e2eee39412731b1700d30ed5c7fdc1fcad8882daaf951caa93a
- SSDEEP 24576:G42F4pOtA123wBahui3dql5N60gY6LmE3+xbZL:G424pOK123wBa1c603wsZL
- TLSH T188656185797CB870D581143FFDBC8682ADCB5E6162454B2C10B982938F5D0A3FC5ABEE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 1.6MB
- SHA256 087abd729ef4ed4aed74515ab27c1d84f8a32a54a5dde99d354a4fb7816c03ef
- MD5 78503097bb0e6cea6ddbbc744b35f699
- SHA1 422be488ac56dba038f768c7f3bbbb81c058faac
- SHA512 cdf94b4356010b350a0d21f5b3b3da73ff4861f17a5677df4492f9d11253379ba8291bfe924ea7ed88603b5cf217a98e28b369904ed73807e8b8d26fcaf7a027
- SSDEEP 24576:G42F4pOtA123wBahui3dql5N60gY6LmE3+xbZzMfSgWv:G424pOK123wBa1c603wsZzMW
- TLSH T1F8759385797CB870D581143FFDBE8682ADCB5E616A454B2C10B941938F5C0A3FC4ABEE
- MD5 SHA1 SHA512 SSDEEP TLSH