Analysis
- max time kernel
150s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 22:54
Behavioral task
behavioral1
Sample
2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target 2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe
- Size 1004KB
- Sample260810-2vrhvav1e1
- SHA256 451887b8eb638287dd9a5db64a572eaef624ed5b8308029b93a8d10a2c23c413
- MD5 1b6a72e11f9c040af3481f675e1fd4a9
- SHA1 5c0589cb37f06d3ecd09e6edabda6e57d6ff0e40
- SHA512 17d86a5e2f767f497f2bfed844eb17ae58cc6ec27c2f45a569146c3878ae652bfba0d4f9567ba89333e20db380f5370ff6c9286d5d7a31402190110074b6cfe7
- SSDEEP 24576:BPOUu5lAnZXxjvScGH3FKr7Aw3wghLFebPGy:Bju/+DWXFKr7AwAghLFoGy
- TLSH T14925232E8F543A8EFB582175990328F01D715FD8A665FEF6E45A80AD8D43F30F64184E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/memory/3824-0-0x0000000000400000-0x000000000040B000-memory.dmp family_cosmu behavioral2/files/0x000a000000011390-2.dat family_cosmu behavioral2/files/0x000300000001b1d6-6.dat family_cosmu behavioral2/memory/3824-289-0x0000000000400000-0x000000000040B000-memory.dmp family_cosmu - Renames multiple (1601) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- UPX dump on OEP (original entry point) 4 IoCs
resource yara_rule behavioral2/memory/3824-0-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral2/files/0x000a000000011390-2.dat UPX behavioral2/files/0x000300000001b1d6-6.dat UPX behavioral2/memory/3824-289-0x0000000000400000-0x000000000040B000-memory.dmp UPX -
resource yara_rule behavioral2/memory/3824-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x000a000000011390-2.dat upx behavioral2/files/0x000300000001b1d6-6.dat upx behavioral2/memory/3824-289-0x0000000000400000-0x000000000040B000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\lo-LA\tipresx.dll.mui.tmp 2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Security.dll.tmp 2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Core.dll.tmp 2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.ObjectModel.dll.tmp 2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationProvider.resources.dll.tmp 2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.et-ee.dll.tmp 2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.Annotations.dll.tmp 2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.Common.dll.tmp 2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ja\ReachFramework.resources.dll.tmp 2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.CSharp.dll.tmp 2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.resources.dll.tmp 2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.resources.dll.tmp 2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationTypes.resources.dll.tmp 2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\cs\WindowsBase.resources.dll.tmp 2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\tipresx.dll.tmp 2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.Lightweight.dll.tmp 2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Reflection.Emit.ILGeneration.dll.tmp 2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Threading.ThreadPool.dll.tmp 2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationProvider.resources.dll.tmp 2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Design.dll.tmp 2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp 2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui.tmp 2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Threading.Timer.dll.tmp 2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Configuration.ConfigurationManager.dll.tmp 2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp 2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.tmp 2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe File created C:\Program Files\Common Files\System\msadc\adcvbs.inc.tmp 2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebSockets.Client.dll.tmp 2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Xml.XDocument.dll.tmp 2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\ta.txt.tmp 2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-localization-l1-2-0.dll.tmp 2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp 2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Controls.Ribbon.resources.dll.tmp 2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemData.dll.tmp 2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ReachFramework.dll.tmp 2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\UIAutomationTypes.resources.dll.tmp 2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tipresx.dll.mui.tmp 2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.dll.tmp 2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\ReachFramework.resources.dll.tmp 2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml.tmp 2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\lv-LV\tipresx.dll.mui.tmp 2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\sr-Cyrl-RS\tipresx.dll.mui.tmp 2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Formats.Tar.dll.tmp 2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.Lightweight.dll.tmp 2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.dll.tmp 2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui.tmp 2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Uri.dll.tmp 2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui.tmp 2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.DataAnnotations.dll.tmp 2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Configuration.dll.tmp 2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Quic.dll.tmp 2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Xml.dll.tmp 2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Xaml.resources.dll.tmp 2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Forms.resources.dll.tmp 2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\vi.txt.tmp 2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui.tmp 2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Xaml.resources.dll.tmp 2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll.tmp 2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.NetworkInformation.dll.tmp 2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.dll.tmp 2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Loader.dll.tmp 2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\PresentationCore.resources.dll.tmp 2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationFramework.resources.dll.tmp 2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\PresentationUI.resources.dll.tmp 2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_1b6a72e11f9c040af3481f675e1fd4a9_coinminer_elex_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3824
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1738198120-2966725515-3980530802-1000\desktop.ini.tmp
- Size 1004KB
- SHA256 11c73eb06c825e463b7081baaea172eb5e33e0300d94177f19db79c1e8f9305b
- MD5 4bbf9b58595422e16b3977c77d8bd831
- SHA1 107ecd8ca947572e2046f63db69f49670e4d64ad
- SHA512 d2205ffeeb60e9fed4fa461b2d3708637444611d0f643976f86ee3c724b5cc2b45453cdb557bac3b97df79143c8fdad23ab6d860038bf1f44d85c627ce8d19d9
- SSDEEP 24576:BPOUu5lAnZXxjvScGH3FKr7Aw3wghLFebPGM:Bju/+DWXFKr7AwAghLFoGM
- TLSH T14D25232E8F543A8EFB582175A90328F01D715FC8A665FEF6E45A90AD8D43F30F64184E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 1.1MB
- SHA256 556250fa91f3cb1011daa2e8aeb01f52ef4a34836dc1e3c61770c64907c945fc
- MD5 a2d326c7cdb6555ad24a2df9d89bf275
- SHA1 3b8d21a40dce24111903727fafe2e68e5f200266
- SHA512 071537bf14553f866431f844556935f7c5b337a5833cf2e8556f1458593d0084eb55c9782ee710357dee38fc640b83d448213a5bd8a5f5aae9b7a0f1d75ab450
- SSDEEP 24576:BPOUu5lAnZXxjvScGH3FKr7Aw3wghLFebPG0MfSgWc:Bju/+DWXFKr7AwAghLFoG0M5
- TLSH T1BB3512216DAEF795DF442239AD031D939B103ECE3D59DEB2B1A550F7892AE302C434DA
- MD5 SHA1 SHA512 SSDEEP TLSH