Analysis
- max time kernel
150s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 18:47
Behavioral task
behavioral1
Sample
2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe
- Size 760KB
- Sample260810-xe665sfl4s
- SHA256 1827222b4f3cc1ab03cca5daf5c16eacdc177565b2d96d022632705c8d514c4a
- MD5 4b49216ab4d1b8c8821012c071f78159
- SHA1 25241d55807b27ee5a5a7efe1615ba4dd81871db
- SHA512 7c58358de30f33a6eb3113615e854e912bcba337a5c0af8fe857fcf672a35946cfdf2ace86f3c38b5c080428d85db84401981298ba12a8cb58c045738685683b
- SSDEEP 12288:iFF23PluC+9hku5vdRLcxvvZXBIwFJ2NrKtqcSW5DypQ/WzH3PNa/geY+Dt+b6bN:iFF23POUu5lAnZXxjvScGH3FKr7AwT
- TLSH T141F4121E5FECB4CBE3683174952375AC5995BE08DEF2B876BC49748A2803FB1A14214F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 2 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000e000000019ca9-1.dat family_cosmu behavioral2/files/0x000400000001b1b2-5.dat family_cosmu - Renames multiple (1929) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\ur-PK\tipresx.dll.mui.tmp 2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\hostpolicy.dll.tmp 2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.dll.tmp 2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ReachFramework.dll.tmp 2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\cs.pak.tmp 2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe File created C:\Program Files\7-Zip\7zG.exe.tmp 2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipTsf.dll.mui.tmp 2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe File created C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui.tmp 2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationClientSideProviders.dll.tmp 2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\el.pak.tmp 2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\PresentationCore.resources.dll.tmp 2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\System.Windows.Input.Manipulations.resources.dll.tmp 2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe File created C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 8.0.15 (x64).swidtag.tmp 2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-MX\tipresx.dll.mui.tmp 2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.NetworkInformation.dll.tmp 2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.VisualBasic.Forms.dll.tmp 2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\WindowsFormsIntegration.resources.dll.tmp 2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe File created C:\Program Files\Internet Explorer\es-ES\ieinstal.exe.mui.tmp 2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\hi.txt.tmp 2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.tmp 2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\PresentationFramework.resources.dll.tmp 2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemCore.dll.tmp 2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui.tmp 2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\System.Windows.Forms.Design.resources.dll.tmp 2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe.tmp 2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationClient.resources.dll.tmp 2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Net.Http.dll.tmp 2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Input.Manipulations.resources.dll.tmp 2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\fr\PresentationFramework.resources.dll.tmp 2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\UIAutomationTypes.resources.dll.tmp 2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\tr\UIAutomationTypes.resources.dll.tmp 2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\tr\WindowsFormsIntegration.resources.dll.tmp 2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml.tmp 2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.Design.resources.dll.tmp 2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\ReachFramework.resources.dll.tmp 2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\PresentationFramework.dll.tmp 2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fi-fi.dll.tmp 2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\tabskb.dll.mui.tmp 2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.dll.tmp 2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.ComponentModel.Primitives.dll.tmp 2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\D3DCompiler_47_cor3.dll.tmp 2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\WindowsBase.resources.dll.tmp 2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp 2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe File created C:\Program Files\Internet Explorer\en-US\hmmapi.dll.mui.tmp 2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Immutable.dll.tmp 2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Threading.Tasks.Dataflow.dll.tmp 2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp 2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ja\System.Windows.Forms.Primitives.resources.dll.tmp 2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.el-gr.dll.tmp 2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\kok-IN\tipresx.dll.mui.tmp 2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Contracts.dll.tmp 2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe File created C:\Program Files\Internet Explorer\iexplore.exe.tmp 2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\ka.txt.tmp 2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll.tmp 2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Cng.dll.tmp 2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Net.NetworkInformation.dll.tmp 2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\fr\System.Windows.Input.Manipulations.resources.dll.tmp 2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui.tmp 2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Net.Sockets.dll.tmp 2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationFramework.resources.dll.tmp 2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\UIAutomationProvider.resources.dll.tmp 2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\th.pak.tmp 2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.et-ee.dll.tmp 2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\mk-MK\tipresx.dll.mui.tmp 2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_4b49216ab4d1b8c8821012c071f78159_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2301830172-776172150-2531349243-1000\desktop.ini.tmp
- Size 760KB
- SHA256 41bf757d724409022d748a9af7816fab78fe43e7bc635c7145e589867fca15cd
- MD5 e6464475ff4e121a05210348bf310407
- SHA1 9dfc80aee51b2f4676bd7406c07317445a564967
- SHA512 a37b5362c4424babb1e41d56c829ae8e933b2ece0c327bd35d3af48a6259c9d393b5efb18f2e61c5c55c6c272b39f7ae17dbfcf53490a2b012e5ce51115dee3f
- SSDEEP 12288:iFF23PluC+9hku5vdRLcxvvZXBIwFJ2NrKtqcSW5DypQ/WzH3PNa/geY+Dt+b6bK:iFF23POUu5lAnZXxjvScGH3FKr7AwE
- TLSH T1B8F4121E5FECB4CBE3683174952375AC5995BE08DEF2B876BC49748A2803FB1A14214F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 859KB
- SHA256 b7f6bb7903ccc1b20ada0f0695fa5ecc7bfbcb70185d258a42200959c519bc35
- MD5 92e4eb13112134c923282ab3ecbdf0f8
- SHA1 facdbadeebd5e735f04a3313d6944a74779cff4b
- SHA512 dfb88d644a0b123f5d1be19125fea2d52d24e9ed5556ca3cb132fb8c92c402a9aa9c1377bdd4803fd1d2cca442b76a2e11f180d5d26dce2bc59b48daee2cc25f
- SSDEEP 24576:iFF23POUu5lAnZXxjvScGH3FKr7AwiMfSgWE:iF2ju/+DWXFKr7AwiMh
- TLSH T1DF1502213DEEF5E5CB542238A9137E8B83047D4E7DAAEC72796531E3542AEB118430DB
- MD5 SHA1 SHA512 SSDEEP TLSH