Analysis
- max time kernel
150s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/08/2026, 19:56
Behavioral task
behavioral1
Sample
2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe
- Size 820KB
- Sample260828-yn7dyaea72
- SHA256 f2d87f644a498d35a6bbd7fa7b4862ad0bfc01edda21d5739adcc79116a6f3a9
- MD5 285e87125021ce3fc0aa24d1db3c4130
- SHA1 8ffaaa0f8340c0cbe32e098f2bd02dc80870cb95
- SHA512 e41560b0bd8a090bed3b91b15d2bbc2db685bd5fe82602724f82f7ab068658b78f0809c959e7fb0a811042c904c5b1ebbc0dc7b7eb3f476539abfbef7c29d6f1
- SSDEEP 24576:GdKN4ALnJO5dKkBDO3q4+PmB+Qz43mSED24aFEDgI5hihF6cLYlr5:GdKNpAEVTRzr5
- TLSH T13305E50E4D63E892C69FBB35F0C77A58243C56ADEEF5C9C8CEE5B0526450AE891E4C70
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/memory/4928-0-0x0000000000400000-0x000000000040A000-memory.dmp family_cosmu behavioral2/files/0x000d000000019caa-2.dat family_cosmu behavioral2/files/0x000400000001b1c0-6.dat family_cosmu behavioral2/memory/4928-310-0x0000000000400000-0x000000000040A000-memory.dmp family_cosmu - Detects executables packed with eXPressor 4 IoCs
resource yara_rule behavioral2/memory/4928-0-0x0000000000400000-0x000000000040A000-memory.dmp INDICATOR_EXE_Packed_eXPressor behavioral2/files/0x000d000000019caa-2.dat INDICATOR_EXE_Packed_eXPressor behavioral2/files/0x000400000001b1c0-6.dat INDICATOR_EXE_Packed_eXPressor behavioral2/memory/4928-310-0x0000000000400000-0x000000000040A000-memory.dmp INDICATOR_EXE_Packed_eXPressor - Renames multiple (1937) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.Win32.SystemEvents.dll.tmp 2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp 2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.tmp 2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.tmp 2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\bn-IN\tipresx.dll.mui.tmp 2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml.tmp 2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encoding.CodePages.dll.tmp 2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\Microsoft.NETCore.App.deps.json.tmp 2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationCore.dll.tmp 2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\mscorlib.dll.tmp 2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ReachFramework.dll.tmp 2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.resources.dll.tmp 2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Windows.Forms.Design.Editors.dll.tmp 2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\PresentationFramework.resources.dll.tmp 2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\is.txt.tmp 2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msaddsr.dll.mui.tmp 2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.AccessControl.dll.tmp 2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationTypes.resources.dll.tmp 2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp 2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\kaa.txt.tmp 2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\si.txt.tmp 2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe File created C:\Program Files\Common Files\System\Ole DB\msdaps.dll.tmp 2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.CSharp.dll.tmp 2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.InteropServices.dll.tmp 2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\System.Windows.Controls.Ribbon.resources.dll.tmp 2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz.dll.tmp 2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.dll.tmp 2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pl\UIAutomationTypes.resources.dll.tmp 2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.IO.Pipes.AccessControl.dll.tmp 2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationFramework.resources.dll.tmp 2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationClientSideProviders.resources.dll.tmp 2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Extensions.dll.tmp 2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationFramework.resources.dll.tmp 2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\WindowsFormsIntegration.resources.dll.tmp 2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XDocument.dll.tmp 2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.Design.resources.dll.tmp 2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\vcruntime140_cor3.dll.tmp 2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationUI.dll.tmp 2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.dll.tmp 2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationClientSideProviders.resources.dll.tmp 2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-private-l1-1-0.dll.tmp 2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipRes.dll.mui.tmp 2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe File created C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui.tmp 2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\netstandard.dll.tmp 2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll.tmp 2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\UIAutomationClientSideProviders.resources.dll.tmp 2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\sk-SK\tipresx.dll.mui.tmp 2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui.tmp 2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe File created C:\Program Files\DisconnectUnlock.xps.tmp 2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.NonGeneric.dll.tmp 2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.MemoryMappedFiles.dll.tmp 2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Thread.dll.tmp 2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Web.dll.tmp 2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationFramework.resources.dll.tmp 2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\pa-IN\tipresx.dll.mui.tmp 2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ServiceProcess.dll.tmp 2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationClientSideProviders.dll.tmp 2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationClientSideProviders.resources.dll.tmp 2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp 2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe File created C:\Program Files\Common Files\System\Ole DB\it-IT\msdasqlr.dll.mui.tmp 2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe File created C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll.tmp 2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Queryable.dll.tmp 2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationClientSideProviders.resources.dll.tmp 2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\PresentationFramework.resources.dll.tmp 2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-28_285e87125021ce3fc0aa24d1db3c4130_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-4046655672-1449839301-2197395821-1000\desktop.ini.tmp
- Size 820KB
- SHA256 c788c0350e21e06c60db6d8cfc6a3aef46bb72ba192ccfbdc029d87803184a09
- MD5 278864ab56f416e0c6e7287ca329914c
- SHA1 fafffe1eb9bee9995f98e0a23b767da593a87472
- SHA512 f39ec4943881a45e76f87aa5b95cf0361c98557c8b820e384ce510cb347c9442a91b5c8eb4eac9a7a0c5c9ba425ce6442186d96297215e04a04d43e96b2fe7d2
- SSDEEP 24576:GdKN4ALnJO5dKkBDO3q4+PmB+Qz43mSED24aFEDgI5hihF6cLYlrH:GdKNpAEVTRzrH
- TLSH T10D05E50E4D63E892C69FBB35F0C77A58243C56ADEEF5C9C8CEE5B0526450AE891E4C70
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 919KB
- SHA256 f73a8a2f442e7dc53023013ff131cf742aedb131d3bb7ede38dc90b8cfb7fea4
- MD5 389625e36630021d472dc8d89f7a622b
- SHA1 9dc5b7b2d4d057cafcb1c2e30742201a70c689d1
- SHA512 5264e09cdc65b565679cfbb682699421bcdb4603ec41ce22e8f9f8f522f1befb571217508fd40902a1f3e7dd62d5d79c34cef23c69cab901d509685f78f192bf
- SSDEEP 24576:GdKN4ALnJO5dKkBDO3q4+PmB+Qz43mSED24aFEDgI5hihF6cLYlrLMfSgWA:GdKNpAEVTRzrLMF
- TLSH T1B01517094C63E891C79FB735F0C77A58503C56AEEEF9C9C8CEE5B0926420AE851E5CB1
- MD5 SHA1 SHA512 SSDEEP TLSH