Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
13/08/2026, 04:46
Behavioral task
behavioral1
Sample
2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe
- Size 1.7MB
- Sample260813-fd2rlabl7v
- SHA256 b820d10cf5fe87fd0cea13e6fb02ae76611845e8a9a63754fc40bd0cbb9a32d5
- MD5 66c599dad91dfb9b3bc9d1a8de00b94b
- SHA1 118d635e7e6d29b73a9bdba9c1b66c5758acdd37
- SHA512 a285e979a639de6760619a361eaaf2ab02937843d204bcf971cbba37d94ae92e3b61847b440bc991d0d0d508a444d88b71e6d3fe190fd5db6c0a2e828e8eb187
- SSDEEP 24576:2jC2F4pOtA123wBahui3dql5N60gY6LmE3+xbZgqz2u8Uj6ZNAG6L:R24pOK123wBa1c603wsZga2udEk
- TLSH T1D085088ABA7CF875E111253BB5BDC703AE1CAD4267494768107982E08F9C5F1CC86F9E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral1/memory/5768-0-0x0000000000400000-0x0000000000408000-memory.dmp family_cosmu behavioral1/files/0x00100000000231f3-2.dat family_cosmu behavioral1/files/0x0006000000021914-6.dat family_cosmu behavioral1/memory/5768-277-0x0000000000400000-0x0000000000408000-memory.dmp family_cosmu - Renames multiple (1570) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\System\msadc\msdaprst.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\Common Files\System\Ole DB\msdasql.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\PresentationFramework.resources.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationCore.resources.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordaccore_amd64_amd64_6.0.2724.6912.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Tracing.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.Brotli.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\ka.txt.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\InkObj.dll.mui.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\Common Files\System\ado\msado27.tlb.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebSockets.Client.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encodings.Web.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.DataAnnotations.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.ResourceManager.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Text.RegularExpressions.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\ko.txt.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fi-fi.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.MemoryMappedFiles.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Controls.Ribbon.resources.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationUI.resources.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\WindowsFormsIntegration.resources.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.EventBasedAsync.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.Writer.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Security.Cryptography.Csp.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\PresentationUI.resources.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Dynamic.Runtime.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Extensions.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.IO.UnmanagedMemoryStream.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationClient.resources.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Forms.resources.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\ca.txt.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.IsolatedStorage.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Security.AccessControl.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\WindowsBase.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.resources.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.VisualBasic.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sr-latn-rs.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\Common Files\System\msadc\msadds.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.MemoryMappedFiles.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Private.DataContractSerialization.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\ReachFramework.resources.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Forms.Primitives.resources.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-environment-l1-1-0.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.VisualBasic.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.Design.resources.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\fr.txt.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\7-Zip\License.txt.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-utility-l1-1-0.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.Pkcs.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\he.txt.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.CompilerServices.Unsafe.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOLoader.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Windows.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.Design.resources.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ms-my.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sv-se.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3053180483-1881419501-3594244048-1000\desktop.ini.tmp
- Size 1.7MB
- SHA256 53ab47aef9842df4a9e1b1721f994c819f24865c5be187a5a9ee3ef7995a9bfc
- MD5 eb4bf6f3bd32d53f0a95847e8ba3a302
- SHA1 f1e275be2d1638ac9c33bd2b1825500d6cf24a9d
- SHA512 c8251cebd52e9fb6b1774f03516c438ae8b1983a898a906f8a4c798812c4825f9b556969642d11852469c8050d0b45804058a2f938b139937ccd9bc3800ff6f7
- SSDEEP 24576:2jC2F4pOtA123wBahui3dql5N60gY6LmE3+xbZgqz2u8Uj6ZNAG6/:R24pOK123wBa1c603wsZga2udEo
- TLSH T1DA85088ABA7CF875E111253BB5BDC703AE1CAD4267494768107982E08F9C5F1CC86F9E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 1.8MB
- SHA256 70635af7cef75b5c409bb52b8fd975db809bcb407b641b48bae2040cf01e8dac
- MD5 43937f962439448214c0e1e66f1d4c8c
- SHA1 775a397343968b72d817b1404edce3ecc1d765ee
- SHA512 2bb99c89adfbeda4e5daa0d328eb2f03ef73136c0370f24c703a61f105783afe1fa7fa5d63fc98acd27f21e3e3081646d9540dcc71bf68efda13fa7048a07a0d
- SSDEEP 24576:2jC2F4pOtA123wBahui3dql5N60gY6LmE3+xbZgqz2u8Uj6ZNAG6UMfSgWX:R24pOK123wBa1c603wsZga2udEDMu
- TLSH T1AC950796BA7CF975D110253BB5BFC603AE086D426F494B68107982E08F9C5F1CC86F9E
- MD5 SHA1 SHA512 SSDEEP TLSH