Analysis
- max time kernel
150s - max time network
131s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/09/2026, 17:29
Behavioral task
behavioral1
Sample
2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe
- Size 2.3MB
- Sample260913-v21xjas1hx
- SHA256 9ed865366b59a535453e79a53d077c3309469a58db2b1c5904a720564af4c263
- MD5 19070d7eb7fd91db0b5db5fb69518686
- SHA1 23ba2f5a434010fd462565fe6f356a58fe6b4794
- SHA512 fc3fcaa974857993da611bde32cb621e067f80fcebe11f6a4101b4f26fb45ab814b7e73dfb4ea9af09919b5aa1309d799dbe059bd9edc45e1013efc592762185
- SSDEEP 49152:iFY4p2laYA7ZA4+zyY9mZFIN9MA70ZL02IYc8t+Uax9Vwtd/pJ:iFT57Zf+2TK7Mk0Z4TYc81aHVq/D
- TLSH T103B533628FEE75DFEAA810345827BABE4C8ABC0D7CEB7C747EC056750644DA118052DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 2 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x0007000000011392-1.dat family_cosmu behavioral2/files/0x000300000001b1c3-5.dat family_cosmu - Renames multiple (585) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\mt-MT\tipresx.dll.mui.tmp 2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.Calendars.dll.tmp 2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Web.HttpUtility.dll.tmp 2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui.tmp 2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.Reader.dll.tmp 2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Parallel.dll.tmp 2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.EventBasedAsync.dll.tmp 2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\br.txt.tmp 2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll.tmp 2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\eu-ES\tipresx.dll.mui.tmp 2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-time-l1-1-0.dll.tmp 2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.DataSetExtensions.dll.tmp 2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encoding.CodePages.dll.tmp 2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Transactions.Local.dll.tmp 2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll.tmp 2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml.tmp 2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\VGX\VGX.dll.tmp 2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe File created C:\Program Files\Common Files\System\ado\msadox.dll.tmp 2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui.tmp 2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.DataContractSerialization.dll.tmp 2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.ResourceManager.dll.tmp 2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Web.dll.tmp 2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll.tmp 2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll.tmp 2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui.tmp 2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\mk-MK\tipresx.dll.mui.tmp 2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.VisualBasic.Core.dll.tmp 2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscorrc.dll.tmp 2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\eu.txt.tmp 2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\fr.txt.tmp 2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\hr.txt.tmp 2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\ta.txt.tmp 2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe File created C:\Program Files\7-Zip\Uninstall.exe.tmp 2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ms-my.dll.tmp 2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\SubsystemController.man.tmp 2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe File created C:\Program Files\Common Files\System\ado\msado26.tlb.tmp 2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\nb.txt.tmp 2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.th-th.dll.tmp 2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\te-IN\tipresx.dll.mui.tmp 2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe File created C:\Program Files\Common Files\System\msadc\adcvbs.inc.tmp 2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l1-2-0.dll.tmp 2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-math-l1-1-0.dll.tmp 2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Quic.dll.tmp 2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Dataflow.dll.tmp 2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities.json.tmp 2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui.tmp 2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.tmp 2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.TextWriterTraceListener.dll.tmp 2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Xml.dll.tmp 2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\TabTip.exe.mui.tmp 2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui.tmp 2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.tmp 2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe File created C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui.tmp 2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Security.dll.tmp 2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.OpenSsl.dll.tmp 2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Windows.dll.tmp 2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Debug.dll.tmp 2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\cs.txt.tmp 2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe File created C:\Program Files\AssertSplit.dotx.tmp 2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml.tmp 2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\sr-Cyrl-BA\tipresx.dll.mui.tmp 2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msadcer.dll.mui.tmp 2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.bg-bg.dll.tmp 2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.es-es.dll.tmp 2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-13_19070d7eb7fd91db0b5db5fb69518686_elex_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2976
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:4196
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-461973139-3212354679-1508698038-1000\desktop.ini.tmp
- Size 2.3MB
- SHA256 88f9a81a4963332d646f59d674c1a8735d4225f988166dd33f3f7ceb1913434b
- MD5 32d273ef993dd7fd5ed70ec0d8bab57d
- SHA1 9e6beb101fa6ea6e00211bc4c388e1b87357c832
- SHA512 192eecda3f305cb4280adb9e5687793923a5685d28df308a8835c4aa6f8d72c23b5cd5e919f7e1dc471ed97a490b458649c0892463c4c15a6451aaaa94e12b34
- SSDEEP 49152:iFY4p2laYA7ZA4+zyY9mZFIN9MA70ZL02IYc8t+Uax9Vwtd/pn:iFT57Zf+2TK7Mk0Z4TYc81aHVq/x
- TLSH T1F1B533628FEE75DFEAA810345827BABE4C8ABC0D7CEB7C747EC056750644DA118052DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 2.4MB
- SHA256 05239880a8712e5d20581c52e8eb3300044793acf1c10847a67c800f08ebbaf8
- MD5 02a270668434146427dab17ab85e795d
- SHA1 5e6e25731528942552e978e7ca60031aa07310d6
- SHA512 2b0d1f6e4a6a85e916b2b54398f716858200d605ba044b9e5005689549f2d6b7d8a39174ec7ae7e6b0d5ccb3fc0198dc56d0d42c255f812d4ab96691cfe5512f
- SSDEEP 49152:iFY4p2laYA7ZA4+zyY9mZFIN9MA70ZL02IYc8t+Uax9Vwtd/pbM8:iFT57Zf+2TK7Mk0Z4TYc81aHVq/p
- TLSH T1CCB523616DEEF6D9CE9411386D27BE9B8E457C0F3CDAEC507AA016F24228DA10C471DB
- MD5 SHA1 SHA512 SSDEEP TLSH