Analysis
- max time kernel
149s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/08/2026, 14:55
Behavioral task
behavioral1
Sample
2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe
- Size 25KB
- Sample260822-satyssfc97
- SHA256 adb82e622239d15dfb038849f48b730c040eb68b0e72897fa97690aa81f5ac2f
- MD5 5597845ca2a9714c74315dd0f1bf10e3
- SHA1 3de21c4427eb666b1e9af0cfcb4cbac938c32645
- SHA512 149e828d99870095d3fc8bc06787352cf80a14e3baf1e02f86700085b2f584302ce24faab658b451cf093b7dfe831f80e9f1cdd2cd8fd39e9faa1e5ed443303b
- SSDEEP 384:NBt7Br5xjL9AgA71Fbhv/r+k7ha3gzpsVvUaWq9C7:d7BlpppARFbh6qlpim2
- TLSH T1B8B25C5E8B49C032C38550305D2F687D9CB7443C7E26DB6BAB568C18AAB63D0FC3915A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/memory/4444-0-0x0000000000400000-0x0000000000409D5C-memory.dmp family_cosmu behavioral2/files/0x0010000000016ccb-2.dat family_cosmu behavioral2/files/0x000300000001b1a0-6.dat family_cosmu behavioral2/memory/4444-636-0x0000000000400000-0x0000000000409D5C-memory.dmp family_cosmu - Detects executables packed with eXPressor 4 IoCs
resource yara_rule behavioral2/memory/4444-0-0x0000000000400000-0x0000000000409D5C-memory.dmp INDICATOR_EXE_Packed_eXPressor behavioral2/files/0x0010000000016ccb-2.dat INDICATOR_EXE_Packed_eXPressor behavioral2/files/0x000300000001b1a0-6.dat INDICATOR_EXE_Packed_eXPressor behavioral2/memory/4444-636-0x0000000000400000-0x0000000000409D5C-memory.dmp INDICATOR_EXE_Packed_eXPressor - Renames multiple (4886) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\GB.XSL.tmp 2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\EntityDataHandler.dll.tmp 2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\TASKUPD.CFG.tmp 2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml.tmp 2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-string-l1-1-0.dll.tmp 2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-pl.xrm-ms.tmp 2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack2019_eula.txt.tmp 2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OutlookLogoSmall.contrast-black_scale-180.png.tmp 2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.tmp 2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XPath.XDocument.dll.tmp 2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-ppd.xrm-ms.tmp 2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-pl.xrm-ms.tmp 2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\casual.dotx.tmp 2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\CONVERT\1033\OLNOTER.FAE.tmp 2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-140.png.tmp 2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msix.dll.tmp 2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Forms.resources.dll.tmp 2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-debug-l1-1-0.dll.tmp 2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\kk.txt.tmp 2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\coreclr.dll.tmp 2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationFramework.resources.dll.tmp 2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\WindowsFormsIntegration.resources.dll.tmp 2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp 2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ppd.xrm-ms.tmp 2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ul-oob.xrm-ms.tmp 2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-pl.xrm-ms.tmp 2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig-office.xrm-ms.tmp 2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.AccessControl.dll.tmp 2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\WindowsFormsIntegration.resources.dll.tmp 2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp 2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-locale-l1-1-0.dll.tmp 2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-filesystem-l1-1-0.dll.tmp 2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ul.xrm-ms.tmp 2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_COL.HXC.tmp 2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.VisualBasic.dll.tmp 2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_200_percent.pak.tmp 2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCalls.h.tmp 2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\jpeg.md.tmp 2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe.tmp 2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\OutlookMailReadNaiveBayesCommandRanker.txt.tmp 2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.OleDbInterop.dll.tmp 2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\NL7MODELS000C.dll.tmp 2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-private-l1-1-0.dll.tmp 2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\cs\PresentationCore.resources.dll.tmp 2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe File created C:\Program Files\Internet Explorer\de-DE\iexplore.exe.mui.tmp 2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalDemoR_BypassTrial180-ul-oob.xrm-ms.tmp 2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ul-oob.xrm-ms.tmp 2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.reportviewer.common.dll.tmp 2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\Configuration\card_terms_dict.txt.tmp 2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\mscss7wre_en.dub.tmp 2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationTypes.resources.dll.tmp 2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ul-oob.xrm-ms.tmp 2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1036\MSO.ACL.tmp 2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-140.png.tmp 2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\mset7.dll.tmp 2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.dll.tmp 2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationClient.resources.dll.tmp 2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Input.Manipulations.dll.tmp 2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Security.Cryptography.Algorithms.dll.tmp 2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\PresentationUI.resources.dll.tmp 2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Xaml.resources.dll.tmp 2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationProvider.resources.dll.tmp 2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ppd.xrm-ms.tmp 2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\th\msipc.dll.mui.tmp 2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-21_5597845ca2a9714c74315dd0f1bf10e3_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1014449518-1831897916-4205727055-1000\desktop.ini.tmp
- Size 25KB
- SHA256 428f0315f2f90a9fea53cfe35d6b35134ff6b1dc56bd9a019bf5692379026268
- MD5 5b8b91dcd2674c85df99c3ad5a9c029d
- SHA1 802d51ae44b27f120ef9a5cc6a2f6588edab5ec9
- SHA512 b72b9ffa5625de4688b0dbd425e0bc3a39d2f2210b3f9a09cce518e85c5a068962edb37628c152adadbc19b07b6c2d5e23f940c7635c99e9ad85878bc64d69c6
- SSDEEP 384:NBt7Br5xjL9AgA71Fbhv/r+k7ha3gzpsVvUaWq9C7U:d7BlpppARFbh6qlpim2j
- TLSH T155C25C5E8B49D032C38550306D2F687DDDB7403C6E26DB67EB568C18AAB63D0FC3915A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 124KB
- SHA256 d59136cee63fb92e8629861303b3221c2870327a34c342dfe1f93dc30c7268a1
- MD5 b8f6a9ccd8d2b7c0b04214c8d634dfee
- SHA1 d9421b373586a34e956a0456f23d36906148cd7a
- SHA512 591f8a89dc2ca8285b6bc977d5af4a9f927645e8a4984db6554e2d6741d2f98f0f2435fa6e7713a5541b55f9e0b9f403f6ed32e0c4eb4e2697e10ef52f79bcb3
- SSDEEP 3072:npWp6ql55ZMfTiu66I3UwqSsMBlsWb4A+2:gD5MfTinqncsWp+2
- TLSH T137C3E6617CAEF6A0CF441339AD6B9E83C305398F3C5ACE4276A519E3913CD950C9B4E6
- MD5 SHA1 SHA512 SSDEEP TLSH