Analysis
- max time kernel
150s - max time network
130s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
22/08/2026, 22:33
Behavioral task
behavioral1
Sample
2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe
- Size 25KB
- Sample260822-2gp3vsgf55
- SHA256 d39a9ace20b937cbe7162ea2444de093dbaf7b278d1dfd3fac75dd4acec58cdc
- MD5 e2b34c04ce43ea1b3881293aac828b11
- SHA1 afc2a182431a4af3bc2a02778126ac76d9e1c186
- SHA512 cfbc0586d9413f3d58acbf023b73bc3c18e7fde0397fe73234fcaa4536ecf963f6bf9e058c9d3e5c620a1a2b09e2cf6fbe653574e34ad1ee95d2a911993d4827
- SSDEEP 384:NBt7Br5xjL9AgA71Fbhv/r+k7ha3QzpsVvUaWq9C7:d7BlpppARFbh6qxpim2
- TLSH T161B25C5E8B49C072C38550345C2F687D9CB7443C7E26DB6BAB568C18AABA3D0FC3915A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral1/memory/5068-0-0x0000000000400000-0x0000000000409D5C-memory.dmp family_cosmu behavioral1/files/0x000a0000000242fc-2.dat family_cosmu behavioral1/files/0x0009000000024495-6.dat family_cosmu behavioral1/memory/5068-600-0x0000000000400000-0x0000000000409D5C-memory.dmp family_cosmu - Detects executables packed with eXPressor 4 IoCs
resource yara_rule behavioral1/memory/5068-0-0x0000000000400000-0x0000000000409D5C-memory.dmp INDICATOR_EXE_Packed_eXPressor behavioral1/files/0x000a0000000242fc-2.dat INDICATOR_EXE_Packed_eXPressor behavioral1/files/0x0009000000024495-6.dat INDICATOR_EXE_Packed_eXPressor behavioral1/memory/5068-600-0x0000000000400000-0x0000000000409D5C-memory.dmp INDICATOR_EXE_Packed_eXPressor - Renames multiple (5195) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\PresentationUI.resources.dll.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\splash_11-lic.gif.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-pl.xrm-ms.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ExcelCombinedFloatieModel.bin.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\Microsoft.Office.PolicyTips.dll.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\cs\UIAutomationClientSideProviders.resources.dll.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-console-l1-1-0.dll.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ul-oob.xrm-ms.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHLTS.DAT.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteFreeR_Bypass-ppd.xrm-ms.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\hi\msipc.dll.mui.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\YAHOO.COM.MY.XML.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Milk Glass.eftx.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-100.png.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.resources.dll.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\PresentationFramework.Aero.dll.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\MSSRINTL.DLL.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.DataIntegration.TransformDataByExample.dll.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\Configuration\card_security_terms_dict.txt.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.dll.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Tracing.dll.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\PresentationUI.resources.dll.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\javaws.jar.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.cpl.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\content-types.properties.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ul-phn.xrm-ms.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\GroupBackup.au3.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ppd.xrm-ms.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WORD_WHATSNEW.XML.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\tr\msipc.dll.mui.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.IO.Compression.Native.dll.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Drawing.Common.dll.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\splash.gif.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\dcpr.dll.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\YAHOO.COM.TW.XML.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-private-l1-1-0.dll.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-math-l1-1-0.dll.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.AdomdClient.dll.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.CompilerServices.VisualC.dll.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemXml.dll.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Drawing.dll.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ul-phn.xrm-ms.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLFLTR.DLL.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Tracing.dll.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\psfont.properties.ja.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN097.XML.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Forms.Design.resources.dll.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Smokey Glass.eftx.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ul.xrm-ms.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-pl.xrm-ms.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\PPCORE.DLL.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\IpsMigrationPlugin.dll.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\PresentationUI.resources.dll.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\pt.txt.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationClient.resources.dll.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTrial-pl.xrm-ms.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-668679576-120646659-2289335452-1000\desktop.ini.tmp
- Size 25KB
- SHA256 aa30f12de704eb1981c9af1cd7f9f81e0b61bc9efe40c870b3fb0e49b27a3106
- MD5 0bf62d9ff874e8339858805c2866de72
- SHA1 e4f0e02cbb9c2c9b062bf9ac663e40afdf025020
- SHA512 aafa7b72fa1a663bbaf353fcb036e1f916096ed675ecab1dc1c0965c9cdb8c71be0bc041bf6720a2bb65a7591da259e666ea28a78804d1b41f7be7c4880d59e8
- SSDEEP 384:NBt7Br5xjL9AgA71Fbhv/r+k7ha3QzpsVvUaWq9C72:d7BlpppARFbh6qxpim2V
- TLSH T162C25C5E8B49C032C38550346D2F687DDDB7403C6E26DB6BEB568C18AAB63D1FC3411A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 124KB
- SHA256 5f6734d90e5e9926f283e549ab028588d4a3d7a12c1394d0d8ff7b892712037a
- MD5 eab78b32ec8561428b9d895214b5ca8f
- SHA1 697f3c300e2062bfb6fa12ab7306bad071c0132a
- SHA512 31e2bda93c22a560f27213d68ddc4ab7e8c3df731365746fc58edfbd87dc5d61a0a9edcc966c9bf1953871efbc9d23c08dd26d8fbafc855be3ecded705051507
- SSDEEP 3072:npWp6qx15ZMfTiu66I3UwqSsMBlsWb4A+2:gzdMfTinqncsWp+2
- TLSH T1B9C3E6617CAEF6A0CF441339AD6B9E83C305398F3C5ACE4276A519E3913CD950C9B4E6
- MD5 SHA1 SHA512 SSDEEP TLSH