Analysis
- max time kernel
150s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/09/2026, 23:23
Behavioral task
behavioral1
Sample
2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe
- Size 89KB
- Sample260905-3dgsragd66
- SHA256 0b752d5f38437693e18c2cac0e4bf68acaf917588eb81e3aca33cdc8fee88374
- MD5 739526ad674b95bf5663f994c22c10c1
- SHA1 6906c043bc9d76a8ab33474bf602de91405e31f8
- SHA512 ac28bdc669a57397d73137da48b224452cdd51f8bfc437cab3f431ff41cbf2047c65930620a674f5e153f70e605b9a1d26b6f7fda593b82c178afb54d96d9e54
- SSDEEP 1536:p7ZhA7dAxJJB7LD2I2IbSyEcnmB7XbGNrHSdkQ0E7OoIwMpGB7EspyIzFAPTLK41:Te76xtD33bSyEC5yfFzY6mK41
- TLSH T161937C7D3A656020E66FF3B5AC877D2C8932311AB2F7D5FDAE3530789463774AA06180
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 2 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000700000001b888-1.dat family_cosmu behavioral2/files/0x000400000001b1ed-5.dat family_cosmu - Renames multiple (4342) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre-1.8\lib\security\javaws.policy.tmp 2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-multibyte-l1-1-0.dll.tmp 2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ppd.xrm-ms.tmp 2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.resources.dll.tmp 2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sv-se.dll.tmp 2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe File created C:\Program Files\Common Files\System\msadc\msaddsr.dll.tmp 2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.Reader.dll.tmp 2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Presentation.dll.tmp 2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\WindowsBase.resources.dll.tmp 2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\WindowsBase.resources.dll.tmp 2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui.tmp 2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Principal.Windows.dll.tmp 2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Drawing.dll.tmp 2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ServiceProcess.dll.tmp 2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.IO.UnmanagedMemoryStream.dll.tmp 2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Runtime.InteropServices.JavaScript.dll.tmp 2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscorrc.dll.tmp 2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\Microsoft.DiaSymReader.Native.amd64.dll.tmp 2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\System.Windows.Input.Manipulations.resources.dll.tmp 2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\nio.dll.tmp 2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Gill Sans MT.xml.tmp 2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.officemuiset.msi.16.en-us.xml.tmp 2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ppd.xrm-ms.tmp 2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ppd.xrm-ms.tmp 2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Sockets.dll.tmp 2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Net.WebSockets.dll.tmp 2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp 2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgePackages.h.tmp 2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\webkit.md.tmp 2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ul-oob.xrm-ms.tmp 2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Grace-ppd.xrm-ms.tmp 2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Grace-ppd.xrm-ms.tmp 2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\InkObj.dll.mui.tmp 2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Windows.Input.Manipulations.dll.tmp 2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\tr\PresentationFramework.resources.dll.tmp 2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-ul-oob.xrm-ms.tmp 2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_COL.HXC.tmp 2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\XLINTL32.DLL.tmp 2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Marquee.xml.tmp 2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\VVIEWRES.DLL.tmp 2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\PowerPivotExcelClientAddIn.tlb.tmp 2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\ReachFramework.resources.dll.tmp 2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ja\UIAutomationClient.resources.dll.tmp 2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHKEY.DAT.tmp 2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Forms.resources.dll.tmp 2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-pl.xrm-ms.tmp 2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_PrepidBypass-ppd.xrm-ms.tmp 2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pl\WindowsBase.resources.dll.tmp 2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ul-oob.xrm-ms.tmp 2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-ul-phn.xrm-ms.tmp 2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\km-KH\tipresx.dll.mui.tmp 2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Buffers.dll.tmp 2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jfxmedia.dll.tmp 2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack_eula.txt.tmp 2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemData.dll.tmp 2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui.tmp 2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\libpng.md.tmp 2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.tmp 2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-pl.xrm-ms.tmp 2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\msvcr120.dll.tmp 2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp 2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.NameResolution.dll.tmp 2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Ping.dll.tmp 2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\sk.txt.tmp 2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-03_739526ad674b95bf5663f994c22c10c1_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-552508041-2681165170-3229858294-1000\desktop.ini.tmp
- Size 90KB
- SHA256 e6e64171d6c64476ad21b69285f88eb1a3c22ffbbcb54c8f7d7a949fbebfaa51
- MD5 69050cefd3e21fe61693bb1edd334dd9
- SHA1 3c69e35ebd0dd58c12bc161cab514ae077dd9a72
- SHA512 08584e257477477133f45c80d18c7a411b11337b2389725b94d927c60d7412df98bc04b7256bf72f65a05b580eb01a4aafaa0682de43b3185cb2c5ba67b1bd37
- SSDEEP 1536:p7ZhA7dAxJJB7LD2I2IbSyEcnmB7XbGNrHSdkQ0E7OoIwMpGB7EspyIzFAPTLK4x:Te76xtD33bSyEC5yfFzY6mK4x
- TLSH T1F5937C7D3A656020E66FF3B5AC877D2C8932311AB2F7D5FDAE3530789463774AA06180
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 188KB
- SHA256 c05bb6b74ae2254391f71fd2e6c08dd7782b00713a0fccc2eacd7178d4b10853
- MD5 895525fbab953917e6223e2777657d26
- SHA1 99ac2d8a97fec0835fd098aac5b9b8d5f89282c8
- SHA512 48a85ba0ad0a196ff99e8526b37cd80b68318608145571346dbf0cdfbadeec7b957d0179e35295252a36a2a47711b64567b7f5b812e15eb687c97a48768f5495
- SSDEEP 3072:Te76xtD33bSyEC5yfFzY6mK4D5ZMfTiu66I3UwqSsMBlsWb4A+E:SeTD7Sy7yfwMfTinqncsWp+E
- TLSH T1011449643CAEF260CB586379AD5B7E4FC211314F3CAACDA67A7531E39139A540C5B0E2
- MD5 SHA1 SHA512 SSDEEP TLSH