Analysis
- max time kernel
150s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/08/2026, 22:43
Behavioral task
behavioral1
Sample
2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe
- Size 28KB
- Sample260814-2nntdatanf
- SHA256 d09568765c0b9645b9c7fcb1a973f40b55d48ddae9a14e4e47deffb1ba9b6c79
- MD5 f5cef4a787e7b4e03b41fd168af30f84
- SHA1 c327e5299ad23fadd619a7f2ad7a3f14c5ed24ff
- SHA512 c19c24885a7c2662371d11d000a69990d17caaaef9628ece02dae3f116ed4bbb1b08aaa9ce906ddbe97bc372666621df6df145dcad812ab834954b77d02a8067
- SSDEEP 768:s7BlpppARFbhdLz8ae+rOn8ae+rOgja0tzmAjUHjkja0tzmAjUHjJ4gBfk/Bfkz:s7ZppApdIIgja0tzmAjUHjkja0tzmAjs
- TLSH T15DD228DFBF0EC9BDD6540E306C1B79B94462C408BE24ED69B3268D152661BA4F0DC26F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 2 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000a000000019cb5-1.dat family_cosmu behavioral2/files/0x000300000001b1af-5.dat family_cosmu - Renames multiple (4545) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\UIAutomationTypes.resources.dll.tmp 2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\zipfs.jar.tmp 2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ppd.xrm-ms.tmp 2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Dallas.OAuthClient.dll.tmp 2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\Microsoft.VisualBasic.Forms.resources.dll.tmp 2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Grace-ppd.xrm-ms.tmp 2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-ul-oob.xrm-ms.tmp 2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe File created C:\Program Files\dotnet\ThirdPartyNotices.txt.tmp 2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\ar.pak.tmp 2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\amd64\jvm.cfg.tmp 2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\OutlookMeetingReqSendNaiveBayesCommandRanker.txt.tmp 2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe File created C:\Program Files\Common Files\System\Ole DB\msdasql.dll.tmp 2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe File created C:\Program Files\Common Files\System\wab32res.dll.tmp 2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\ext\jfxrt.jar.tmp 2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-ppd.xrm-ms.tmp 2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ul-phn.xrm-ms.tmp 2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ul-phn.xrm-ms.tmp 2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationClientSideProviders.resources.dll.tmp 2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\zh-TW.pak.tmp 2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-pl.xrm-ms.tmp 2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-pl.xrm-ms.tmp 2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-ppd.xrm-ms.tmp 2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.WindowsDesktop.App.deps.json.tmp 2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\WindowsBase.resources.dll.tmp 2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\fr\PresentationUI.resources.dll.tmp 2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\VisualElements\Logo.png.tmp 2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Trial-ul-oob.xrm-ms.tmp 2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\eo.txt.tmp 2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\UIAutomationTypes.resources.dll.tmp 2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Grace-ppd.xrm-ms.tmp 2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ul-phn.xrm-ms.tmp 2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp 2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.Parallel.dll.tmp 2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Forms.resources.dll.tmp 2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationProvider.resources.dll.tmp 2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Reflection.eftx.tmp 2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ChakraCore.Debugger.dll.tmp 2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\FilterModule.dll.tmp 2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pl\System.Windows.Forms.resources.dll.tmp 2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\cldr.md.tmp 2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ppd.xrm-ms.tmp 2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipRes.dll.mui.tmp 2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\bcel.md.tmp 2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PMAILEXT.ECF.tmp 2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\WindowsFormsIntegration.resources.dll.tmp 2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationClientSideProviders.resources.dll.tmp 2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-ppd.xrm-ms.tmp 2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ul-oob.xrm-ms.tmp 2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-ppd.xrm-ms.tmp 2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_K_COL.HXK.tmp 2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\ms-MY\tipresx.dll.mui.tmp 2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.Linq.dll.tmp 2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ObjectModel.dll.tmp 2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Diagnostics.StackTrace.dll.tmp 2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\verify.dll.tmp 2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\glib.md.tmp 2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml.tmp 2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ppd.xrm-ms.tmp 2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\coreclr.dll.tmp 2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationClientSideProviders.resources.dll.tmp 2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ul-oob.xrm-ms.tmp 2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_KMS_Client_AE-ppd.xrm-ms.tmp 2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\GostTitle.XSL.tmp 2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll.tmp 2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-14_f5cef4a787e7b4e03b41fd168af30f84_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini.tmp
- Size 29KB
- SHA256 864a9d52ca7aa93067b3e2d7fcdb20ef1425a1c8fe8b94ff95493027539858b8
- MD5 2ad4407346f4ea3f41455676acfba86c
- SHA1 6ad67e59ad177119fea6a9661c55dab9fada9d10
- SHA512 46973b1a23b060c4f7946b0f2e1c5d3a0ed88b6cb5ef64e976b45c10b9fd3278b0c53d94378b41ed3b15aef8d53d25bdd115017943a2668701285690ffbfd403
- SSDEEP 768:s7BlpppARFbhdLz8ae+rOn8ae+rOgja0tzmAjUHjkja0tzmAjUHjJ4gBfk/Bfkw:s7ZppApdIIgja0tzmAjUHjkja0tzmAjv
- TLSH T1DCD229DF7F0EC9BDD6540A306C1B76F94422C408BE24ED69F3268D152661BA5B0DC26F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 127KB
- SHA256 a7b067b0922ca9fbe870c61e2c446c37c94441054db044dd50984ca70dcedc5a
- MD5 8dc9ab8e88f8e09353fb263843d7426b
- SHA1 074e669825c9beaeb5f105c4247315bf6dc4cea4
- SHA512 cbfa668d63639a486c83cf8d8851fa3582d7206b5ec8888ff273e0eb744ec765c6ea13376bcf639d5149daa886eb393e9a27890ed4424e3a99838a033baaa253
- SSDEEP 3072:spWpNkNkq5ZMfTiu66I3UwqSsMBlsWb4A+X:Nk+cMfTinqncsWp+X
- TLSH T111D3E4A17CAEF6A8CF441239AD5BBE83C201798A3C59CD46B2A515E3913CD950CDF0E7
- MD5 SHA1 SHA512 SSDEEP TLSH