Analysis
- max time kernel
150s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
26/08/2026, 19:39
Behavioral task
behavioral1
Sample
2026-08-25_8079d8243995b13c2b795839a103f4c9_amadey_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-25_8079d8243995b13c2b795839a103f4c9_amadey_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-08-25_8079d8243995b13c2b795839a103f4c9_amadey_elex_wannacry.exe
- Size 54KB
- Sample260826-ydb52sfa68
- SHA256 7ae0c39a7e2da77f148c56528614a1eca2777fdbdf7a99e646fa3b4f94ff9fa4
- MD5 8079d8243995b13c2b795839a103f4c9
- SHA1 73a77de149a7ded60efdfec5afb58577aa865b59
- SHA512 f0143ab09534cce3280314ce96e8e5bf97f6de1294d3d414ec513638ab10ade9958a0694db64120bc22ebbd1a550680a82b7e186e6a397148811311e16dc00a7
- SSDEEP 768:/7BlpQpARFbhS101h/5sl1zYaAsu/XGQL:/7ZQpAprsXPWeQL
- TLSH T1B9436E478B4480E2E359AB341E3B397564317D4C9CA1FE0B9798ED5B2C34E50D4EAE3A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/memory/5476-0-0x0000000000400000-0x0000000000408000-memory.dmp family_cosmu behavioral2/files/0x000700000001b867-10.dat family_cosmu behavioral2/files/0x000c00000001c5f9-13.dat family_cosmu behavioral2/memory/5476-549-0x0000000000400000-0x0000000000408000-memory.dmp family_cosmu - Renames multiple (4864) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Executes dropped EXE 2 IoCs
pid Process 4628 _Uninstall.exe 6128 Zombie.exe - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Zombie.exe 2026-08-25_8079d8243995b13c2b795839a103f4c9_amadey_elex_wannacry.exe File created C:\Windows\SysWOW64\Zombie.exe 2026-08-25_8079d8243995b13c2b795839a103f4c9_amadey_elex_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\PresentationCore.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack_eula.txt.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Text.Json.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Threading.AccessControl.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ExcelNaiveBayesCommandRanker.txt.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\micaut.dll.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\bin\jaas_nt.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sv-se.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Core.dll.tmp Zombie.exe File created C:\Program Files\dotnet\ThirdPartyNotices.txt.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-180.png.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProDemoR_BypassTrial180-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\word2013bw.dotx.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\CONVERT\OL.SAM.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-80.png.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Controls.Ribbon.resources.dll.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\bin\prism_d3d.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART11.BDR.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processthreads-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTest-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Grace-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Interop.MSDASC.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\TASKREQS.ICO.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\km-KH\tipresx.dll.mui.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\WindowsFormsIntegration.resources.dll.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-math-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.CSharp.dll.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_fr.properties.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\TASKDECL.ICO.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\InkObj.dll.tmp Zombie.exe File created C:\Program Files\Internet Explorer\it-IT\ieinstal.exe.mui.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O17EnterpriseVL_Bypass30-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ul-phn.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.ReportingServices.DataExtensions.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\TASKACCL.ICO.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.MemoryMappedFiles.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.IO.Compression.FileSystem.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Reflection.Emit.ILGeneration.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Threading.Tasks.Extensions.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\HAMMER.WAV.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.ILGeneration.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationUI.resources.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libxslt.md.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngcc.md.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\jvm.hprof.txt.tmp Zombie.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language _Uninstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-25_8079d8243995b13c2b795839a103f4c9_amadey_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Zombie.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 5476 wrote to memory of 4628 5476 2026-08-25_8079d8243995b13c2b795839a103f4c9_amadey_elex_wannacry.exe 89 PID 5476 wrote to memory of 6128 5476 2026-08-25_8079d8243995b13c2b795839a103f4c9_amadey_elex_wannacry.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-25_8079d8243995b13c2b795839a103f4c9_amadey_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-25_8079d8243995b13c2b795839a103f4c9_amadey_elex_wannacry.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5476 -
C:\Users\Admin\AppData\Local\Temp\_Uninstall.exe"_Uninstall.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4628
-
-
C:\Windows\SysWOW64\Zombie.exe"C:\Windows\system32\Zombie.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:6128
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3986082593-3624157295-3514260330-1000\desktop.ini.tmp
- Size 40KB
- SHA256 1cba222d1dcb6c95ebbf4055126876264778082460ade406551c280afb382e18
- MD5 26613f825e4b98529bf4af772ae4be8e
- SHA1 034acddf929a14ba4e6a582032082585dd02c992
- SHA512 a7970be34fc8c0441cb65c8d1dd72a9d211df9f89b003cffee1a5cd0ed4351976d3ecfea79dae1e490d5925553d0e45356bb43ce3430837df5415bcf06f0bd34
- SSDEEP 384:yBs7Br5xjL8AgA71Fbhva4S04Sh/A2U2dsc:/7BlpQpARFbhS101h/5sc
- TLSH T13E131B5B4A45D0E3C208F7384E3B7578A825298C9DB5BE47EB8CCC1B7839D9050EAD6C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_Uninstall.exe
- Size 14KB
- SHA256 6cd2baf18d885881e9d91fc8fc7a9062eeb2120b1efd852d2339cf8db9bc776f
- MD5 43ba0b2491205c6f45d642f555cc976a
- SHA1 8968632ee4be8693e3e87d2e182a95ff3c13ce42
- SHA512 b31d44eae6f2e0fb3f3d4b5dd77328577f55b5547a8c2435cbe7e8126b99447d3383b1c096f2c09c8edeb34f09970f17583fd79b3f6187b8c24b746cd8d64595
- SSDEEP 192:W5sB1zFNst1xohoLWHOO71thUNpWP1oynJ+y7ihXGY28d/o:jB1z0t1x3WHlApA13+y7+XGQ
- TLSH T12B52E742DBE404E5FBBB1B303AFA59535576BE214895EF0E467077DE1D30A00EAA6323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Zombie.exe
- Size 40KB
- SHA256 3b93ffaada2bc49731bbcdd40245f24bf1d2bc3a99febd8003bfe81129039be8
- MD5 835c17c175a68060d11a87be3b356b6e
- SHA1 01b9fbfebbb1a8c6df3dafd7b81f41bba2af09e3
- SHA512 f25c1c86f2d76fd15d817b7f5db36424a5ffbcd3af4336f92d47608d0cc57e46ed599a3b896dfa26fc8584fa0a1df0efd1bbc6a27a30de36692ed7f38082b56a
- SSDEEP 384:yBs7Br5xjL8AgA71Fbhva4S04Sh/A2U2dsZ:/7BlpQpARFbhS101h/5sZ
- TLSH T142031B5B4A45D0E2C209FB384E3B7578A825298C9DB5BE47EB8CCC1B7439D9050EED6C
- MD5 SHA1 SHA512 SSDEEP TLSH