Analysis
- max time kernel
150s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/08/2026, 04:46
Behavioral task
behavioral1
Sample
2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe
- Size 1.7MB
- Sample260813-fd2rlabl7v
- SHA256 b820d10cf5fe87fd0cea13e6fb02ae76611845e8a9a63754fc40bd0cbb9a32d5
- MD5 66c599dad91dfb9b3bc9d1a8de00b94b
- SHA1 118d635e7e6d29b73a9bdba9c1b66c5758acdd37
- SHA512 a285e979a639de6760619a361eaaf2ab02937843d204bcf971cbba37d94ae92e3b61847b440bc991d0d0d508a444d88b71e6d3fe190fd5db6c0a2e828e8eb187
- SSDEEP 24576:2jC2F4pOtA123wBahui3dql5N60gY6LmE3+xbZgqz2u8Uj6ZNAG6L:R24pOK123wBa1c603wsZga2udEk
- TLSH T1D085088ABA7CF875E111253BB5BDC703AE1CAD4267494768107982E08F9C5F1CC86F9E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/memory/1524-0-0x0000000000400000-0x0000000000408000-memory.dmp family_cosmu behavioral2/files/0x000b000000011377-2.dat family_cosmu behavioral2/files/0x000400000001b1cd-6.dat family_cosmu behavioral2/memory/1524-190-0x0000000000400000-0x0000000000408000-memory.dmp family_cosmu - Renames multiple (1095) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.DataContractSerialization.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.Extensions.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Reflection.DispatchProxy.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Security.Claims.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\as-IN\tipresx.dll.mui.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\Common Files\System\uk-UA\wab32res.dll.mui.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Xaml.resources.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\PresentationFramework.resources.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\Common Files\System\msadc\msadcer.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Formats.Asn1.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Configuration.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.Primitives.resources.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\AddRevoke.png.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\TabTip.exe.mui.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordbi.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Debug.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\ga.txt.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Http.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebHeaderCollection.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Security.Cryptography.Csp.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\sr-Cyrl-BA\tipresx.dll.mui.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\Common Files\System\msadc\msadcor.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Diagnostics.Process.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\ku.txt.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\be-BY\tipresx.dll.mui.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOMessageProvider.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Diagnostics.StackTrace.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\PresentationFramework.resources.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\WindowsFormsIntegration.resources.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msaddsr.dll.mui.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Private.Xml.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\WindowsFormsIntegration.resources.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.resources.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\SubsystemController.man.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\7-Zip\7z.sfx.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\pt.txt.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\sv.txt.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\bn-IN\tipresx.dll.mui.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\ReachFramework.resources.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l1-2-0.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.ResourceManager.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Data.Common.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\ar.txt.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.he-il.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\sv-SE\tipresx.dll.mui.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOLoaderUI.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msadcor.dll.mui.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-synch-l1-1-0.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-environment-l1-1-0.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.TextWriterTraceListener.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\gu.txt.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\msdasqlr.dll.mui.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.AccessControl.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.Serialization.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Collections.dll.tmp 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-13_66c599dad91dfb9b3bc9d1a8de00b94b_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini.tmp
- Size 1.7MB
- SHA256 f9191fd046aaa9a6354ae7a620618cc2912b0119da4f602534f05165c3b4d0d5
- MD5 bbf7514cf498f7feabe55addd700d123
- SHA1 e25ec95dbcfed6132613b3425d49997e999c9199
- SHA512 3196b8cda8d86eff7bd1d11467a5a4be04ac6b56d900d53d8eb4f3a701cba917ae517fc1c8607c694633014be76e94af466e9b347dfa5a6820112043412bc55f
- SSDEEP 24576:2jC2F4pOtA123wBahui3dql5N60gY6LmE3+xbZgqz2u8Uj6ZNAG6P:R24pOK123wBa1c603wsZga2udEs
- TLSH T14485088ABA7CF875E111253BB5BDC703AE1CAD4267494768107982E08F9C5F1CC86F9E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 1.8MB
- SHA256 7812b1a6b2a4ca34dc490a2eb5c82c7ef02c6da090c2064b5cb4eb7b785e56e7
- MD5 f2e158c0778dd286458cf4666fa65e5d
- SHA1 bf2a08e4d29ea8cf3ece88837664c7ee95ee5a95
- SHA512 58df96261f93b7cf5856194c7b536103b2a3818ced41ee6c86485a3d0632031e0f59bd595a38b76bed6cc27d2ed0366a385d2ac67fc2dc22da7bd56cfa20c813
- SSDEEP 24576:2jC2F4pOtA123wBahui3dql5N60gY6LmE3+xbZgqz2u8Uj6ZNAG6qMfSgWX:R24pOK123wBa1c603wsZga2udE5Mu
- TLSH T109950796BA7CF975D110253BB5BFC603AE086D426F494B68107982E08F9C5F1CC86F9E
- MD5 SHA1 SHA512 SSDEEP TLSH