Analysis
- max time kernel
149s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
13/08/2026, 13:02
Behavioral task
behavioral1
Sample
2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe
- Size 24KB
- Sample260813-p91nvabb39
- SHA256 33a6d654657210f25b0eb9de60e812234a2bd4eb59c86eb35da9a5fdd62e7475
- MD5 629dc16dc3d73c557cafd7ac8c0003b0
- SHA1 c33ab5c7c697ea9ee79e8ba5c0dee93f1bc7865e
- SHA512 45cbf8fc99044b0bcecdf47d9a4a2d90b98a0dd2b24ece60951125ac5bfb785a75630611937b65ba2a10226b1b81ba9661e5c07fe72f018f16fd7ada8de7043c
- SSDEEP 768:s7BlpppARFbhdLz8ae+rOn8ae+rOgja0tzmAjUHjkja0tzmAjUHjJ4vfK:s7ZppApdIIgja0tzmAjUHjkja0tzmAjU
- TLSH T1E1B2E6EFBF0ED4ADD3640A342C5F76799423D1087D28EC5EA7068C1929626E5B4DD20F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 2 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral1/files/0x000b000000024273-1.dat family_cosmu behavioral1/files/0x0006000000021758-6.dat family_cosmu - Renames multiple (5123) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-ppd.xrm-ms.tmp 2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\pl\msipc.dll.mui.tmp 2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationClient.resources.dll.tmp 2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ppd.xrm-ms.tmp 2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ppd.xrm-ms.tmp 2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\cs\System.Windows.Forms.Design.resources.dll.tmp 2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Expressions.dll.tmp 2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemXml.dll.tmp 2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ja\WindowsBase.resources.dll.tmp 2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\MICROSOFT.DATA.RECOMMENDATION.CLIENT.CORE.DLL.tmp 2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Input.Manipulations.resources.dll.tmp 2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-heap-l1-1-0.dll.tmp 2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Accessibility.dll.tmp 2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe.tmp 2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-ul-oob.xrm-ms.tmp 2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUTL.OLB.tmp 2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\YAHOO.CO.IN.XML.tmp 2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-memory-l1-1-0.dll.tmp 2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebProxy.dll.tmp 2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveDrop32x32.gif.tmp 2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\content-types.properties.tmp 2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_CopyDrop32x32.gif.tmp 2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-ul-oob.xrm-ms.tmp 2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ul-phn.xrm-ms.tmp 2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ul-oob.xrm-ms.tmp 2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui.tmp 2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE.tmp 2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.dcfmui.msi.16.en-us.xml.tmp 2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml.tmp 2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ConsumerSub_Bypass30-ppd.xrm-ms.tmp 2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\offsymxb.ttf.tmp 2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.tmp 2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe File created C:\Program Files\Common Files\System\ado\adovbs.inc.tmp 2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.Watcher.dll.tmp 2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Resources.Extensions.dll.tmp 2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md.tmp 2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ul-phn.xrm-ms.tmp 2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\YAHOO.COM.BR.XML.tmp 2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Private.CoreLib.dll.tmp 2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\System.Windows.Forms.Design.resources.dll.tmp 2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ul-phn.xrm-ms.tmp 2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.DataWarehouse.Interfaces.DLL.tmp 2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe File created C:\Program Files\Common Files\System\msadc\msadds.dll.tmp 2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XmlDocument.dll.tmp 2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationClientSideProviders.resources.dll.tmp 2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\splash_11-lic.gif.tmp 2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_PrepidBypass-ul-oob.xrm-ms.tmp 2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nl-nl.dll.tmp 2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.PPT.tmp 2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSBARCODE.DLL.tmp 2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\mset7tk.dll.tmp 2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\npdeployJava1.dll.tmp 2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe.tmp 2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\vccorlib140.dll.tmp 2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ppd.xrm-ms.tmp 2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer_eula.txt.tmp 2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.Edm.NetFX35.dll.tmp 2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000050\FA000000050.tmp 2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\OFFSYMXB.TTF.tmp 2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\mip.exe.tmp 2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll.tmp 2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-ppd.xrm-ms.tmp 2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTrial-ppd.xrm-ms.tmp 2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msvcr120.dll.tmp 2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-13_629dc16dc3d73c557cafd7ac8c0003b0_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1074038928-2032447174-945360078-1000\desktop.ini.tmp
- Size 25KB
- SHA256 b596d253f6e05d71fac25341ec8e9cc10a60530d5bf31f93f8d2082f1ce429e9
- MD5 d2844e0743ebfbe1f3e73c0ccf3baa54
- SHA1 544845ab1fab655c82540d3d86b7b38761f7986a
- SHA512 fa34f3e33548be6f51f499eaddae6dafab6fbff06f1226c18403e36ea4adcb551967e8e284320e100a42f72362c9a635a5e56b1c930457832ae92326442fc192
- SSDEEP 768:s7BlpppARFbhdLz8ae+rOn8ae+rOgja0tzmAjUHjkja0tzmAjUHjJ4vf7:s7ZppApdIIgja0tzmAjUHjkja0tzmAjF
- TLSH T1D0C2F7DFBF0ED4ADD3640A342C5F76B99423D1087E28EC5EA7068C1928626E5B4DD21F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.exe
- Size 123KB
- SHA256 5a11bd3a254243bb08256a3971c5b8c6dbe987734f339eee84a13971933fc035
- MD5 de5bbe462990d4f3dff0b70a4b41b896
- SHA1 0130a25861dd2d64d99a06630e5c4a178f5572cf
- SHA512 3dd2eec471dd37d5213d1734e26d2b28e77564a42265bafe5f5f789ba932d2a4e915305a5c684834d7023d1c207ceaca4ec13975ef096621385d9313987498af
- SSDEEP 1536:s7ZppApdIIgja0tzmAjUHjkja0tzmAjUHjm5ZZl8gUTHCmn9DkH61O93UwqvX33+:spWpU5ZMfTiu66I3UwqSsMBlsWb4A+G
- TLSH T1BDC3E3A17DAEF6A8CB4413396D5BBE83C201398B3C59CD4676A609E39138D950CDF0E7
- MD5 SHA1 SHA512 SSDEEP TLSH