Analysis
- max time kernel
150s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/09/2026, 22:25
Behavioral task
behavioral1
Sample
2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe
- Size 61KB
- Sample260905-2caglstelf
- SHA256 d0321c50227816f4c44814dc28fe0285bd7d2d036c17c15027023c5903db3c19
- MD5 a2070e1c16778b4dbca7d933f12502df
- SHA1 5a1b9b4ddfbddfd5599d674996d0c54e5e402060
- SHA512 8bd99ffa1ada8cfe5c2c56fe3deb31c981417dc35140e7a3a4e1ea5623f1ff19c1cd10707488cbea8bcfed45fa53fe788c69cd74179953b0ed178cf881529b8b
- SSDEEP 768:p7BlphA7dASbSLJJBZBZaOAOIB3jM2jMO/7OS7ZTOwVFYn0A4K:p7ZhA7dAxJJB7LD2I2IbSFTDVVK
- TLSH T1FA53816A4D1DAAB2CC5975359C27FB342533F03E3A50E66DE87138208352E50DF9B26B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 2 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000a000000011390-1.dat family_cosmu behavioral2/files/0x0005000000016b3f-5.dat family_cosmu - Renames multiple (4405) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\1033\MSQRY32.CHM.tmp 2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_ko.properties.tmp 2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.resources.dll.tmp 2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-ul-phn.xrm-ms.tmp 2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\cmm\CIEXYZ.pf.tmp 2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ul-phn.xrm-ms.tmp 2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcDemoR_BypassTrial365-ul-oob.xrm-ms.tmp 2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ul-oob.xrm-ms.tmp 2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\wxpr.dll.tmp 2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\AdHocReportingExcelClient.dll.tmp 2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\clrgc.dll.tmp 2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\fxplugins.dll.tmp 2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.wordmui.msi.16.en-us.xml.tmp 2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationClient.resources.dll.tmp 2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\include\jawt.h.tmp 2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\amd64\jvm.cfg.tmp 2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\amd64\jvm.cfg.tmp 2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-ppd.xrm-ms.tmp 2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll.tmp 2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Timer.dll.tmp 2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-private-l1-1-0.dll.tmp 2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-ppd.xrm-ms.tmp 2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-ppd.xrm-ms.tmp 2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\TellMeOutlookMailRead.nrr.tmp 2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.AdomdClient.dll.tmp 2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-ppd.xrm-ms.tmp 2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp 2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Trial-ppd.xrm-ms.tmp 2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationCore.resources.dll.tmp 2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Threading.AccessControl.dll.tmp 2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Windows.Forms.Design.Editors.dll.tmp 2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\ms.pak.tmp 2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\TrebuchetMs.xml.tmp 2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ul.xrm-ms.tmp 2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ppd.xrm-ms.tmp 2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe File created C:\Program Files\Common Files\System\ado\msader15.dll.tmp 2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Reflection.TypeExtensions.dll.tmp 2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Xaml.resources.dll.tmp 2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jopt-simple.md.tmp 2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp 2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.AdomdDataExtension.dll.tmp 2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll.tmp 2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml.tmp 2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Drawing.Common.dll.tmp 2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe.tmp 2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe.tmp 2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\attach.dll.tmp 2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-pl.xrm-ms.tmp 2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ul-oob.xrm-ms.tmp 2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\VGX\VGX.dll.tmp 2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationTypes.resources.dll.tmp 2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.dll.tmp 2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe.tmp 2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.cpl.tmp 2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ul-phn.xrm-ms.tmp 2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-ul-oob.xrm-ms.tmp 2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\casual.dotx.tmp 2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\UIAutomationClientSideProviders.resources.dll.tmp 2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe File created C:\Program Files\7-Zip\History.txt.tmp 2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.dll.tmp 2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\PresentationCore.dll.tmp 2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-pl.xrm-ms.tmp 2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe.tmp 2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-util-l1-1-0.dll.tmp 2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-03_a2070e1c16778b4dbca7d933f12502df_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1738198120-2966725515-3980530802-1000\desktop.ini.tmp
- Size 62KB
- SHA256 afa6e0aaf47d330c0dca1a9856cf3fee485abfb7894613a8972586115af3853a
- MD5 bd2b324b7e8d5eaa88b0bb879c1a3cef
- SHA1 296c370d53308d488a08b12dc4b19709afc01f5e
- SHA512 1357895144884b248122a991ea8c3e16d502ef0142e742486de5b7d84a67ddfc16b9673e2a9db528db0711955c226c276d0ec691ea5a0bb44e99567dfcef1e9f
- SSDEEP 768:p7BlphA7dASbSLJJBZBZaOAOIB3jM2jMO/7OS7ZTOwVFYn0A4z:p7ZhA7dAxJJB7LD2I2IbSFTDVVz
- TLSH T1E553806A4D1DAAB2CC5935359C27FB342533F03E3A54E66DE87138208352E50DF9B26B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 160KB
- SHA256 364a7741f04270e898f13c5effda99652bfd3b5e1dd29c110a4b7a64dee2341b
- MD5 7ecd839d4e85d906c2b5795a68b40271
- SHA1 2f8877eac47136dbb7373bebe9c02d2df8025329
- SHA512 98d0dedb0e4a7b6484567d0265d4575167937e30263c498062ddfac7d3f5a512838ab47de72e5654bbf5d29e6d3071d38a377083b08beff512dcd327c95fdffc
- SSDEEP 3072:Te76xtD33bSFTDVVx5ZMfTiu66I3UwqSsMBlsWb4A+L:SeTD7SFTrBMfTinqncsWp+L
- TLSH T1A6F307606C6EF6A1CE442239AD2BFF539212B15F3C59DD49B57138E38239E408C9B1E7
- MD5 SHA1 SHA512 SSDEEP TLSH