Analysis
- max time kernel
150s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/08/2026, 22:33
Behavioral task
behavioral1
Sample
2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe
- Size 25KB
- Sample260822-2gp3vsgf55
- SHA256 d39a9ace20b937cbe7162ea2444de093dbaf7b278d1dfd3fac75dd4acec58cdc
- MD5 e2b34c04ce43ea1b3881293aac828b11
- SHA1 afc2a182431a4af3bc2a02778126ac76d9e1c186
- SHA512 cfbc0586d9413f3d58acbf023b73bc3c18e7fde0397fe73234fcaa4536ecf963f6bf9e058c9d3e5c620a1a2b09e2cf6fbe653574e34ad1ee95d2a911993d4827
- SSDEEP 384:NBt7Br5xjL9AgA71Fbhv/r+k7ha3QzpsVvUaWq9C7:d7BlpppARFbh6qxpim2
- TLSH T161B25C5E8B49C072C38550345C2F687D9CB7443C7E26DB6BAB568C18AABA3D0FC3915A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/memory/2848-0-0x0000000000400000-0x0000000000409D5C-memory.dmp family_cosmu behavioral2/files/0x000600000001b867-2.dat family_cosmu behavioral2/files/0x000500000001b1cd-6.dat family_cosmu behavioral2/memory/2848-591-0x0000000000400000-0x0000000000409D5C-memory.dmp family_cosmu - Detects executables packed with eXPressor 4 IoCs
resource yara_rule behavioral2/memory/2848-0-0x0000000000400000-0x0000000000409D5C-memory.dmp INDICATOR_EXE_Packed_eXPressor behavioral2/files/0x000600000001b867-2.dat INDICATOR_EXE_Packed_eXPressor behavioral2/files/0x000500000001b1cd-6.dat INDICATOR_EXE_Packed_eXPressor behavioral2/memory/2848-591-0x0000000000400000-0x0000000000409D5C-memory.dmp INDICATOR_EXE_Packed_eXPressor - Renames multiple (4865) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationClientSideProviders.resources.dll.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Xaml.resources.dll.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javafx_font.dll.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.osmuxmui.msi.16.en-us.xml.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.Primitives.dll.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\WindowsFormsIntegration.resources.dll.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\PresentationFramework.resources.dll.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\UIAutomationProvider.dll.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\cldr.md.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\CONVERT\1033\OLTASKR.FAE.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\lv.txt.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Common Files\System\fr-FR\wab32res.dll.mui.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Reflection.Emit.Lightweight.dll.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Windows.Extensions.dll.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ppd.xrm-ms.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.dll.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\System.Windows.Forms.resources.dll.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-ppd.xrm-ms.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-ul-oob.xrm-ms.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSPECTRE.DLL.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.InteropServices.RuntimeInformation.dll.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\PresentationCore.resources.dll.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationProvider.resources.dll.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\calendars.properties.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\content-types.properties.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ppd.xrm-ms.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-pl.xrm-ms.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\fi\msipc.dll.mui.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\vstoee.dll.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\ucrtbase.dll.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ul-phn.xrm-ms.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Spatial.NetFX35.dll.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-MX\tipresx.dll.mui.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Common Files\System\Ole DB\msdasql.dll.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-profile-l1-1-0.dll.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Specialized.dll.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.Primitives.dll.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MINSBPROXY.DLL.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.Primitives.resources.dll.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Forms.resources.dll.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-pl.xrm-ms.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\Custom.propdesc.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Transactions.dll.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\PresentationUI.resources.dll.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-console-l1-1-0.dll.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Integration\QFE31927.msp.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSO.FRAMEPROTOCOLWIN32.DLL.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\nl.txt.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationTypes.dll.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ppd.xrm-ms.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-pl.xrm-ms.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-pl.xrm-ms.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\CNFNOT.ICO.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-180.png.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Principal.dll.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Xaml.resources.dll.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\Interceptor.dll.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.TypeExtensions.dll.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.dll.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ReachFramework.dll.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\Microsoft.Win32.SystemEvents.dll.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\VisualElements\SmallLogoCanary.png.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-memory-l1-1-0.dll.tmp 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-22_e2b34c04ce43ea1b3881293aac828b11_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3986082593-3624157295-3514260330-1000\desktop.ini.tmp
- Size 25KB
- SHA256 4423dc1cf79f573c0a6e23dcb35610acb9a07e24f413ddc20612a602272320e0
- MD5 e1bcc6f0e34e0a8822ccfc6f1419efd8
- SHA1 f3d72155aa27a2ff3ad1fc9cc7ef691e3d776b1c
- SHA512 d6ee252689458481c8279c9d2a36107399e3498c23ed745000bea84c2e9a3e717a9b47ce5d6ec65677e4f1d4fe26de0aa9150badad352d61d6be05f0a985cf0e
- SSDEEP 384:NBt7Br5xjL9AgA71Fbhv/r+k7ha3QzpsVvUaWq9C7P:d7BlpppARFbh6qxpim2E
- TLSH T15CC25C5E8B49C032C38550346D2F687DDDB7443C6E26DB67EB568C18AAB63C0FC3415A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 124KB
- SHA256 d7c38acbbf770ee29b0deb9af13228a88175826b08fa870f13e3a1772ca93aac
- MD5 b0bcd7a7901bea0b2ca40601a2751f27
- SHA1 c1d7dc0cb76e8f7464806fb8ec28eb0edc0bd979
- SHA512 d9bf6025c46f53cf06c97cd072bb11b0e18e65bac29d5957847616406c2aad4ecf3aaf40f2d0f44a4e6f1b3ef8549fe5e5cdc436b809f0ac57671fb5abaa83a7
- SSDEEP 3072:npWp6qxa5ZMfTiu66I3UwqSsMBlsWb4A+2:gzsMfTinqncsWp+2
- TLSH T172C3E6617CAEF6A0CF441339AD6B9E83C305398F3C5ACE4276A519E3913CD950C9B4E6
- MD5 SHA1 SHA512 SSDEEP TLSH