Analysis
- max time kernel
150s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/08/2026, 21:39
Behavioral task
behavioral1
Sample
2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe
- Size 27KB
- Sample260830-1hmtfsswft
- SHA256 ce7f75177c07a1720f867ffb656d5548f80e11da8710d5bb50f557d226c45b00
- MD5 125fa252e139a5e75c668800b5d8ce28
- SHA1 2277024f0525cbec9d150c752ae34c37dca908e5
- SHA512 80e516f9ecabe2fd43ac57daaf1a48eaea306011e107108131bee9b978bab595e892ed73d0ea7cd544b6d96f1ab41c153a842645eaa7d01e81508bb5d8489933
- SSDEEP 384:TBt7Br5xjL9AgA71Fbhv/r+k7ha3BzpsVvUaWq9C7i:37BlpppARFbh6qypim21
- TLSH T100C24B5E8B098033C39550305C2F78799CB7583C7F66DA6FAB578C2EAA763D0F829119
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/memory/1052-0-0x0000000000400000-0x0000000000409D5C-memory.dmp family_cosmu behavioral2/files/0x000a000000011390-2.dat family_cosmu behavioral2/files/0x0005000000016b3f-6.dat family_cosmu behavioral2/memory/1052-587-0x0000000000400000-0x0000000000409D5C-memory.dmp family_cosmu - Detects executables packed with eXPressor 4 IoCs
resource yara_rule behavioral2/memory/1052-0-0x0000000000400000-0x0000000000409D5C-memory.dmp INDICATOR_EXE_Packed_eXPressor behavioral2/files/0x000a000000011390-2.dat INDICATOR_EXE_Packed_eXPressor behavioral2/files/0x0005000000016b3f-6.dat INDICATOR_EXE_Packed_eXPressor behavioral2/memory/1052-587-0x0000000000400000-0x0000000000409D5C-memory.dmp INDICATOR_EXE_Packed_eXPressor - Renames multiple (4776) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe.tmp 2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_WHATSNEW.XML.tmp 2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.OleDbInterop.dll.tmp 2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\WindowsFormsIntegration.resources.dll.tmp 2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART9.BDR.tmp 2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.Watcher.dll.tmp 2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ul-oob.xrm-ms.tmp 2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\as90.xsl.tmp 2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\IGX.DLL.tmp 2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.OpenSsl.dll.tmp 2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Xaml.resources.dll.tmp 2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\System.Windows.Controls.Ribbon.resources.dll.tmp 2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\awt.dll.tmp 2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md.tmp 2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe.tmp 2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-pl.xrm-ms.tmp 2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Exchange.WebServices.dll.tmp 2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Runtime.CompilerServices.VisualC.dll.tmp 2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Input.Manipulations.resources.dll.tmp 2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe File created C:\Program Files\dotnet\ThirdPartyNotices.txt.tmp 2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jsdt.dll.tmp 2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-ul-oob.xrm-ms.tmp 2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-ul-oob.xrm-ms.tmp 2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\OutlookTaskNaiveBayesCommandRanker.txt.tmp 2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.VisualStudio.OLE.Interop.dll.tmp 2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\sv.txt.tmp 2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordaccore_amd64_amd64_6.0.2724.6912.dll.tmp 2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ul.xrm-ms.tmp 2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\UmOutlookAddin.dll.tmp 2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.cab.cat.tmp 2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordaccore_amd64_amd64_7.0.1624.6629.dll.tmp 2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-ul-oob.xrm-ms.tmp 2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-pl.xrm-ms.tmp 2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Common.v4.0.Utilities.dll.tmp 2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\MMSS.ICO.tmp 2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe File created C:\Program Files\ClearPublish.xml.tmp 2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Pipes.AccessControl.dll.tmp 2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\net.dll.tmp 2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-pl.xrm-ms.tmp 2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encoding.Extensions.dll.tmp 2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Threading.ThreadPool.dll.tmp 2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.Primitives.resources.dll.tmp 2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ppd.xrm-ms.tmp 2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ExcelCtxUICellModel.bin.tmp 2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sv-se.dll.tmp 2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml.tmp 2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll.tmp 2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red.xml.tmp 2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-pl.xrm-ms.tmp 2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp 2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\tabskb.dll.mui.tmp 2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.Extensions.dll.tmp 2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Channels.dll.tmp 2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\WindowsBase.resources.dll.tmp 2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-2-0.dll.tmp 2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial.xml.tmp 2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\af.txt.tmp 2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ReachFramework.dll.tmp 2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\US_export_policy.jar.tmp 2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.tmp 2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL.HXS.tmp 2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\amRenderer.js.tmp 2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libffi.md.tmp 2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\vcruntime140.dll.tmp 2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-30_125fa252e139a5e75c668800b5d8ce28_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1738198120-2966725515-3980530802-1000\desktop.ini.tmp
- Size 27KB
- SHA256 126daf15aa0ce55136837af2ba79671f83bc383eb6ec368dcc192cff206e24dd
- MD5 0d5f0f3b2ddfc052b2cde56eef5490aa
- SHA1 d5a8f036477d3d2c0b483190fd79f18adaccca69
- SHA512 7e23642e87173506e9c9e81f9c44b57c40ac0ee2175f52fb1e04269fa4be99a33c9fbb9b2d6f19b4fba5ba80759ea8a1bc95fd0412e78056f1519b54c7ac231c
- SSDEEP 384:TBt7Br5xjL9AgA71Fbhv/r+k7ha3BzpsVvUaWq9C7e:37BlpppARFbh6qypim2V
- TLSH T16FC24B1E8B098033D39550305C2F78799CB7543C7F669A6FEB578C2EAAB63D0F829119
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 126KB
- SHA256 8a3fb50d703356efe4c73546d5972d839f675ba634eb0d579952be1c3751c19d
- MD5 693470667a24af5a59ac9ac2be8a3a07
- SHA1 1733accc30e71fbd053571c45e34a6e441b9faa2
- SHA512 b4263192d79c986a54dba2890cab14ad55cc74a94e66e84910de682605beee07a07e545ab0f09f58104da6d2feedb4dbc82e4d0f2bc2abae1c0a126a1da9b04d
- SSDEEP 3072:1pWp6qyr5ZMfTiu66I3UwqSsMBlsWb4A+G:iMrMfTinqncsWp+G
- TLSH T1CFC3F6617CAEF6A0CF4412396D6BBE83C305398F3C5ACE4676A519E3913CD910C5B4E6
- MD5 SHA1 SHA512 SSDEEP TLSH