Analysis
- max time kernel
150s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 19:52
Behavioral task
behavioral1
Sample
2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe
- Size 2.9MB
- Sample260810-yle7nsxand
- SHA256 7f2e7a16f5a292242f26c9b1187f55a9e075aa70abcc9c1a38072541932c0272
- MD5 b30d9a038e944aaa92665cf9c7c6d147
- SHA1 20cac5c134af007a9ca6b9ee8c18152ecf5ef7d2
- SHA512 2c9c3ef99e3dc816a5ec3d739e42cb549558286e1326cc9323a54cb90ad4a28be3121ea19ee3845ba364b991980f02deec1b75c71eeb3b5883f2a3e16e778c7a
- SSDEEP 49152:wQEt4bg2mH0GGXgZ2lvyHipSKpKXO15/8k/hUwdqomPhyXfMdEl:ZbyGwyyHmUOwk6w0ojfMdY
- TLSH T11DE533D49B1793C1E6E3E6F88B1EEA7EC667A0191AF64147022CDAB23C543005F35E6D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/memory/4564-0-0x0000000000400000-0x0000000000408000-memory.dmp family_cosmu behavioral2/files/0x000a000000019caa-2.dat family_cosmu behavioral2/files/0x000400000001b1c0-6.dat family_cosmu behavioral2/memory/4564-102-0x0000000000400000-0x0000000000408000-memory.dmp family_cosmu - Renames multiple (614) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.NETCore.App.deps.json.tmp 2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe File created C:\Program Files\7-Zip\7-zip.chm.tmp 2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\ga.txt.tmp 2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll.tmp 2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe.tmp 2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Algorithms.dll.tmp 2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.tmp 2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-GB\tipresx.dll.mui.tmp 2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipTsf.dll.mui.tmp 2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui.tmp 2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui.tmp 2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\rtscom.dll.tmp 2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Configuration.dll.tmp 2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.CompilerServices.Unsafe.dll.tmp 2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.DataSetExtensions.dll.tmp 2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\sv.txt.tmp 2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man.tmp 2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll.tmp 2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml.tmp 2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\he-IL\tipresx.dll.mui.tmp 2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\hi-IN\tipresx.dll.mui.tmp 2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tabskb.dll.mui.tmp 2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.AccessControl.dll.tmp 2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe File created C:\Program Files\CheckpointRestore.xhtml.tmp 2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll.tmp 2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.tr-tr.dll.tmp 2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\sq-AL\tipresx.dll.mui.tmp 2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\tipresx.dll.mui.tmp 2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\tipresx.dll.tmp 2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Buffers.dll.tmp 2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.StackTrace.dll.tmp 2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tipresx.dll.mui.tmp 2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\ne-NP\tipresx.dll.mui.tmp 2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui.tmp 2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe File created C:\Program Files\Common Files\System\ado\msado28.tlb.tmp 2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Principal.dll.tmp 2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Windows.dll.tmp 2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscorlib.dll.tmp 2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Dynamic.Runtime.dll.tmp 2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe File created C:\Program Files\7-Zip\7zCon.sfx.tmp 2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.tmp 2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll.tmp 2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe.tmp 2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\mk-MK\tipresx.dll.mui.tmp 2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe File created C:\Program Files\Common Files\System\Ole DB\sqloledb.rll.tmp 2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Console.dll.tmp 2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebHeaderCollection.dll.tmp 2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\ug.txt.tmp 2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.tmp 2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\chr-CHER-US\tipresx.dll.mui.tmp 2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\mshwrwisp.dll.tmp 2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Xml.Linq.dll.tmp 2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Extensions.dll.tmp 2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.Serialization.dll.tmp 2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.TextWriterTraceListener.dll.tmp 2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.tmp 2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe File created C:\Program Files\DismountRevoke.png.tmp 2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-string-l1-1-0.dll.tmp 2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.NameResolution.dll.tmp 2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\.version.tmp 2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\coreclr.dll.tmp 2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Pipes.AccessControl.dll.tmp 2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\fr.txt.tmp 2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-br.dll.tmp 2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b30d9a038e944aaa92665cf9c7c6d147_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-4046655672-1449839301-2197395821-1000\desktop.ini.tmp
- Size 2.9MB
- SHA256 ef61f90a4a72362f6c5fd3b77afc38212f7033c3262a91535cb99c878c5c28ff
- MD5 05240d135194af49858422b52ebcc044
- SHA1 96659e7b6b462f00e704297b03ab8bbe4bed6309
- SHA512 808b1a3ac3547a0ad0837938b5209255f4f3c7e99e539c579cd5e97a928a2c6074e0a952917b34a886d0829c5f2c634c6510430ef20ed92631e909af9541025c
- SSDEEP 49152:wQEt4bg2mH0GGXgZ2lvyHipSKpKXO15/8k/hUwdqomPhyXfMdEf:ZbyGwyyHmUOwk6w0ojfMd+
- TLSH T136E533D49B2793C1E6E3E6F88B1EEA7EC667A0191AF64147022CD9B23C543005F35E6D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 3.0MB
- SHA256 ee9a714775fd10676480413b1a0b993cf830399ef3a48efa290e744fd740bb2f
- MD5 63128510e5d5d0d359328a6bcd70c443
- SHA1 9843d6a2fd39bf344a0d7ca5e271ada1cba56cca
- SHA512 9357601bfb0f717915394ff596d316518d54a366384940e9c059d70fbe536c9797c0e2c45e4fed380de72230fce813bef2d3ddfdb9dd5059b75df184a84d6536
- SSDEEP 49152:wQEt4bg2mH0GGXgZ2lvyHipSKpKXO15/8k/hUwdqomPhyXfMdE7M8:ZbyGwyyHmUOwk6w0ojfMdm
- TLSH T121E523906D6BF3D0DBD293B85B1FAE6FC217744A3DAACD46127C95F324286000D279E9
- MD5 SHA1 SHA512 SSDEEP TLSH