Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/08/2026, 14:41
Behavioral task
behavioral1
Sample
2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target 2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe
- Size 65KB
- Sample260816-r2sdlsdj4v
- SHA256 f1dc8e60a5735f7858e300c996f60c44ce321ffae6ae7a9eba8a515bc8e972a0
- MD5 413b5e357a0bbe9ca158861d9df58397
- SHA1 fc3a0898a9b4bd617fa9837bd78db16aa276a267
- SHA512 c3266aaef60eb91eb4b00dee4392a569391a11534cf908f0992ec213215cd5fbad97f973ed174faf4dee5e751c659fd2c65560eccf3b1c9de1721bb9f0e4fdf5
- SSDEEP 768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9SBo7Bomu1J48bwRbKtbb:V7Zf/FAxTWoJJ7TFuz47de
- TLSH T13D63E50D9E505402E40945FABD8232BA977AF8C837DDEFF572A5BCD84FC0B19AA18453
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/memory/5928-0-0x0000000000400000-0x000000000040B000-memory.dmp family_cosmu behavioral2/files/0x000600000001b867-2.dat family_cosmu behavioral2/files/0x000500000001b1cd-6.dat family_cosmu behavioral2/memory/5928-554-0x0000000000400000-0x000000000040B000-memory.dmp family_cosmu - Renames multiple (4333) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- UPX dump on OEP (original entry point) 4 IoCs
resource yara_rule behavioral2/memory/5928-0-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral2/files/0x000600000001b867-2.dat UPX behavioral2/files/0x000500000001b1cd-6.dat UPX behavioral2/memory/5928-554-0x0000000000400000-0x000000000040B000-memory.dmp UPX -
resource yara_rule behavioral2/memory/5928-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x000600000001b867-2.dat upx behavioral2/files/0x000500000001b1cd-6.dat upx behavioral2/memory/5928-554-0x0000000000400000-0x000000000040B000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\descript.ion.tmp 2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.DirectoryServices.dll.tmp 2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\PresentationFramework.resources.dll.tmp 2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssv.dll.tmp 2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\localedata.jar.tmp 2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\security\javaws.policy.tmp 2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml.tmp 2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libffi.md.tmp 2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\trusted.libraries.tmp 2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\j2gss.dll.tmp 2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Grace-ppd.xrm-ms.tmp 2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.ConnectionUI.Dialog.dll.tmp 2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\pa-in.txt.tmp 2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe File created C:\Program Files\Common Files\System\msadc\msdaprsr.dll.tmp 2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.Primitives.resources.dll.tmp 2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationClientSideProviders.dll.tmp 2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe File created C:\Program Files\Internet Explorer\it-IT\ieinstal.exe.mui.tmp 2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe.tmp 2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\tzdb.dat.tmp 2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ppd.xrm-ms.tmp 2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.PerformanceCounter.dll.tmp 2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy.jar.tmp 2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-ppd.xrm-ms.tmp 2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml.tmp 2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp 2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-util-l1-1-0.dll.tmp 2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\msvcp120.dll.tmp 2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ul-phn.xrm-ms.tmp 2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Grace-ul-oob.xrm-ms.tmp 2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp 2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Office.dll.tmp 2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\amd64\jvm.cfg.tmp 2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp 2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_EnterpriseSub_Bypass30-ppd.xrm-ms.tmp 2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Grace-ul-oob.xrm-ms.tmp 2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ppd.xrm-ms.tmp 2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINDATAPROVIDER.DLL.tmp 2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Classic.dll.tmp 2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\ReachFramework.resources.dll.tmp 2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Trial-ul-oob.xrm-ms.tmp 2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp 2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\PresentationUI.resources.dll.tmp 2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-stdio-l1-1-0.dll.tmp 2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessDemoR_BypassTrial365-ppd.xrm-ms.tmp 2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalDemoR_BypassTrial180-ppd.xrm-ms.tmp 2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationFramework.resources.dll.tmp 2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationClient.resources.dll.tmp 2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_sv.properties.tmp 2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-pl.xrm-ms.tmp 2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\WindowsFormsIntegration.resources.dll.tmp 2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\lt.pak.tmp 2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\concrt140.dll.tmp 2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-ppd.xrm-ms.tmp 2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui.tmp 2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\WindowsBase.resources.dll.tmp 2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemDrawing.dll.tmp 2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\PresentationFramework.resources.dll.tmp 2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\nb.pak.tmp 2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-ppd.xrm-ms.tmp 2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ul-phn.xrm-ms.tmp 2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml.tmp 2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\WindowsFormsIntegration.dll.tmp 2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jopt-simple.md.tmp 2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-ppd.xrm-ms.tmp 2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-16_413b5e357a0bbe9ca158861d9df58397_coinminer_elex_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5928
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3986082593-3624157295-3514260330-1000\desktop.ini.tmp
- Size 66KB
- SHA256 fc9f2e720912d15567ef69a304a35285d7b0becbfb1569173a5519f0a3918935
- MD5 84042efb5c276807d34906cd06952e2e
- SHA1 78ed0da7d3eab39765c4687bfda169a745ed0090
- SHA512 aa535c8f595cd1dcb08295cb69674b7823a14a14a6d4795275b0bf9362a22c95a5cfd5c97e758bda67711a9502efc8c86a455809b6f045f343a2215e6fcee21e
- SSDEEP 768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9SBo7Bomu1J48bwRbKtbJ:V7Zf/FAxTWoJJ7TFuz47dQ
- TLSH T12863E50D9E505402E40945FABD8232BA973AF8C877DDEFF572A5BCD84FC0B19AA18453
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 165KB
- SHA256 8317aa58f5dcd242bcda13dcd1b1ffedf254bf52782a00e1a9c90f98aef250b8
- MD5 9364955951f9293d70ebd8cad7a20383
- SHA1 a6ba5d91117eb74892517f00247c91fb65569015
- SHA512 af43c5b2128f5ed260f4f548470391e8fe64567ce93fcdb9ca49d3f4b6bdd80ae59e7ca6e876b12bb286f9c4ff12f75c1bf5828d101fab23636db716ce0b39dd
- SSDEEP 3072:fny1JY5ZMfTiu66I3UwqSsMBlsWb4A+rT:K7SMfTinqncsWp+f
- TLSH T1E3F317107CAAF660CE4812B9BD476E93C315798A3D9DCE9272B539E3863CE450C5B4E3
- MD5 SHA1 SHA512 SSDEEP TLSH