Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/08/2026, 12:53
Behavioral task
behavioral1
Sample
2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe
- Size 25KB
- Sample260813-p45evay1ft
- SHA256 3be168d94d38a5255bdad4f099a201607fb2898322a3fccfdb9c363ccf06c1ab
- MD5 724b8bafe7a19d313dd7c60e9fdb1632
- SHA1 c1f075e52871435b5531d7771928abc1b7e1ba95
- SHA512 df55f68baf41263ae620e8c97fba6481a8cf34a68cd987a51d814840c06db9a4a39e95e86123f1cd8c8a056d66a9d007de248f1e26077a1d444a520d593c2561
- SSDEEP 768:s7BlpppARFbhdLz8ae+rOn8ae+rOgja0tzmAjUHjkja0tzmAjUHjJ4A:s7ZppApdIIgja0tzmAjUHjkja0tzmAje
- TLSH T123C2C4EFAF0FD4ADC3540A302D1BB2BA9413D8187D14DCAAB306CC152652AE5B4DD21F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 2 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000f00000001b664-1.dat family_cosmu behavioral2/files/0x000300000001b1af-5.dat family_cosmu - Renames multiple (4406) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Claims.dll.tmp 2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe.tmp 2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Garamond.xml.tmp 2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ul-oob.xrm-ms.tmp 2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-ppd.xrm-ms.tmp 2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Dynamic.Runtime.dll.tmp 2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\WindowsBase.resources.dll.tmp 2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-ppd.xrm-ms.tmp 2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationTypes.resources.dll.tmp 2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe.tmp 2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-pl.xrm-ms.tmp 2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-ppd.xrm-ms.tmp 2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\WindowsFormsIntegration.resources.dll.tmp 2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-pl.xrm-ms.tmp 2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-pl.xrm-ms.tmp 2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial3-ppd.xrm-ms.tmp 2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml.tmp 2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.Primitives.resources.dll.tmp 2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.Win32.SystemEvents.dll.tmp 2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\resources.jar.tmp 2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\MSQRY32.CHM.tmp 2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Xaml.resources.dll.tmp 2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe.tmp 2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md.tmp 2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ppd.xrm-ms.tmp 2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ul-oob.xrm-ms.tmp 2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-pl.xrm-ms.tmp 2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Expressions.dll.tmp 2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Drawing.Design.dll.tmp 2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\Microsoft.VisualBasic.Forms.resources.dll.tmp 2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessDemoR_BypassTrial365-ul-oob.xrm-ms.tmp 2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_Subscription-ul-oob.xrm-ms.tmp 2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Permissions.dll.tmp 2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\WindowsBase.dll.tmp 2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\mng.txt.tmp 2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\sv.txt.tmp 2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Configuration.dll.tmp 2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.Design.resources.dll.tmp 2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-ppd.xrm-ms.tmp 2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\UIAutomationClient.resources.dll.tmp 2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\kn.pak.tmp 2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\jdwp.dll.tmp 2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-pl.xrm-ms.tmp 2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\Client2019_eula.txt.tmp 2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-timezone-l1-1-0.dll.tmp 2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\msinfo32.exe.mui.tmp 2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.dll.tmp 2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-heap-l1-1-0.dll.tmp 2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-ul-oob.xrm-ms.tmp 2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\micaut.dll.tmp 2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationFramework.resources.dll.tmp 2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\System.Windows.Controls.Ribbon.resources.dll.tmp 2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe.tmp 2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ViewOnly_ZeroGrace-ppd.xrm-ms.tmp 2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-pl.xrm-ms.tmp 2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\es-419.pak.tmp 2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-ul-oob.xrm-ms.tmp 2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-pl.xrm-ms.tmp 2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sl-si.dll.tmp 2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.osmuxmui.msi.16.en-us.xml.tmp 2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Trial-ul-oob.xrm-ms.tmp 2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.TypeExtensions.dll.tmp 2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\ReachFramework.resources.dll.tmp 2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Aero2.dll.tmp 2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-13_724b8bafe7a19d313dd7c60e9fdb1632_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini.tmp
- Size 25KB
- SHA256 8d166d27ca0b41a5108cc8db26173c9307144d1e2d0b6ecbb120e28b58f3858e
- MD5 764920973e04deb7d757109c94102fc1
- SHA1 4d7a1590785e59afbda86128f89ec1a20862cf20
- SHA512 73e6190b8f9d21c5f143dcf9579ae07a44617787180ccf536c621f183d3a86612bd002c3e762a7192d80e08eb85e3df1c25d05cd9005095ef64abe8acd25085e
- SSDEEP 768:s7BlpppARFbhdLz8ae+rOn8ae+rOgja0tzmAjUHjkja0tzmAjUHjJ4K:s7ZppApdIIgja0tzmAjUHjkja0tzmAjY
- TLSH T11AC2C4EFAF0FD4ADC3540A306D1BB2BA9813D4187D14DCAAB306CC592652AE5B4DD21F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 124KB
- SHA256 a24873d152a357f2c7dc443301d6ad2699c0f69bc33dad13447210c1e507d670
- MD5 b80311112b3fa50832c3ead0367d8b15
- SHA1 73a8ff59147858b5429abc6833aae56ab9428178
- SHA512 979a55f848987db22d09689c625c041780ade3bdc9909ddf29aadb11517135d272abc44f5592f832c7fa9a234fb8c2db036a97733c1d758d9f2295312374cb8f
- SSDEEP 1536:s7ZppApdIIgja0tzmAjUHjkja0tzmAjUHjK5ZZl8gUTHCmn9DkH61O93UwqvX33e:spWpU5ZMfTiu66I3UwqSsMBlsWb4A+2
- TLSH T195C3D3A17DAEF6A8CB441339AE5BBE83C201398B3C49CD4272A555E3913D9950CDF0E7
- MD5 SHA1 SHA512 SSDEEP TLSH