Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/08/2026, 09:56
Behavioral task
behavioral1
Sample
2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe
- Size 93KB
- Sample260825-lydhdszenc
- SHA256 4ae90389de6d2a62c0cf71bf77ed6add103465a93ffcdb9f5ebdc8bc58766e0a
- MD5 79bca20adfc96df1263ebfba57403a27
- SHA1 7bbcc0e0b976765c017c9ed136f19ae9e9280486
- SHA512 e66267e2e88b8601fc329ce7ac4540a476a60eafabb0cbf6a67608323e4086f8234d01d07c88e192eba553ae6afc159cddf92d6e7a8ed3f3df79ca654eee6f3f
- SSDEEP 1536:W7ZhA7pApw03vR03vxSKSWu0SWuM2T7ZhA7pApw03vR03pHe:6e7WpwYRYxSKSWu0SWuM2xe7WpwYREHe
- TLSH T13993287B8680E067F4268A395A637572C52B1CCEBF9DED4EB922CCDF0C72271861E145
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 2 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x0008000000016cfd-1.dat family_cosmu behavioral2/files/0x0006000000019cb4-5.dat family_cosmu - Renames multiple (4555) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3102-0000-1000-0000000FF1CE.xml.tmp 2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ppd.xrm-ms.tmp 2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-pl.xrm-ms.tmp 2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\ba.txt.tmp 2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\tt.txt.tmp 2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.Design.resources.dll.tmp 2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Grace-ppd.xrm-ms.tmp 2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_BypassTrial180-ppd.xrm-ms.tmp 2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ul-oob.xrm-ms.tmp 2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ul-phn.xrm-ms.tmp 2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-ul-oob.xrm-ms.tmp 2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_F_COL.HXK.tmp 2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\offsymxb.ttf.tmp 2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe File created C:\Program Files\DismountLock.TS.tmp 2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Web.dll.tmp 2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-ppd.xrm-ms.tmp 2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeServiceBypassR_PrepidBypass-ul-oob.xrm-ms.tmp 2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Process.dll.tmp 2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RIntLoc.en-us.16.msi.tmp 2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-ul-oob.xrm-ms.tmp 2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-ppd.xrm-ms.tmp 2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-tw.dll.tmp 2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\WindowsFormsIntegration.dll.tmp 2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCalls.h.tmp 2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jdwp.dll.tmp 2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.ServiceModel.Web.dll.tmp 2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-processthreads-l1-1-1.dll.tmp 2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-handle-l1-1-0.dll.tmp 2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-pl.xrm-ms.tmp 2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp 2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\TASKACC.CFG.tmp 2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l1-1-0.dll.tmp 2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-localization-l1-2-0.dll.tmp 2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ppd.xrm-ms.tmp 2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\ga-IE\tipresx.dll.mui.tmp 2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Extensions.dll.tmp 2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Formats.Tar.dll.tmp 2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\WindowsFormsIntegration.dll.tmp 2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Permissions.dll.tmp 2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-multibyte-l1-1-0.dll.tmp 2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-pl.xrm-ms.tmp 2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp 2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp 2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Xaml.resources.dll.tmp 2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-heap-l1-1-0.dll.tmp 2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp 2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp 2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp 2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe File created C:\Program Files\Common Files\System\Ole DB\oledb32r.dll.tmp 2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\System.Windows.Forms.resources.dll.tmp 2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-pl.xrm-ms.tmp 2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\ar.txt.tmp 2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\joni.md.tmp 2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Tw Cen MT-Rockwell.xml.tmp 2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.DataSetExtensions.dll.tmp 2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\WindowsBase.resources.dll.tmp 2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe.tmp 2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages.properties.tmp 2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ul-phn.xrm-ms.tmp 2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-pl.xrm-ms.tmp 2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\SECRECS.ICO.tmp 2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\ko-KR\tipresx.dll.mui.tmp 2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Forms.Design.resources.dll.tmp 2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\Microsoft.VisualBasic.Forms.resources.dll.tmp 2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-24_79bca20adfc96df1263ebfba57403a27_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3611646547-550105268-947503007-1000\desktop.ini.tmp
- Size 94KB
- SHA256 5eb4cbd223595477f83ba59eab2bc6aa27db3e5b1c0b92fb0f1b2a7d092c3117
- MD5 99a34bd27d86be96633729aeae62940f
- SHA1 290e3e2420a07193434599ee59638f02866de2a1
- SHA512 60ae48edca48487ebb130d5999c74a72239b4f2f963227658106d5a0dd0d1693fb4fe8089cb537874774a9f051fff8dc5bd8c8f2a471acd6490e2be8f8ad390b
- SSDEEP 1536:W7ZhA7pApw03vR03vxSKSWu0SWuM2T7ZhA7pApw03vR03pHy:6e7WpwYRYxSKSWu0SWuM2xe7WpwYREHy
- TLSH T10F93387BC680E067F4268A395A637572C52B18CEBF9DED4EB922CCDF0C72271861E145
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 192KB
- SHA256 06ee9f29f0f21c46a399e0d181077af28595e04c3cf1c64fbf3c7309c893bc06
- MD5 8f9015fe23870ca827a09a9436605d64
- SHA1 61de4982b68d572faaa5161fc3c7f3d8252a86f5
- SHA512 ef310dcb03feb98e0e78119718e3062027ab7eb8bbbb410c2defe985d83fff06e0b3564292de0b88b9981966c2623a0bffa895c33d3e73222746e66ed2220180
- SSDEEP 6144:Rq7axSKSWu0SWuM2Uq7aMfTinqncsWp+G:vS22sMfunbsW8G
- TLSH T1581439627CAAF162DE5413396D577E93C20638CF3F4DCD46B66288E74C399A10C5B0E2
- MD5 SHA1 SHA512 SSDEEP TLSH