Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/09/2026, 23:13
Behavioral task
behavioral1
Sample
2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe
- Size 108KB
- Sample260917-27ls5aeb27
- SHA256 e2bb557176534c09b9221067f2b2773d3bf9ae155f70f09d14d4cbe2f2ad7a6b
- MD5 004fee8d3c69b008d9b4dfdb5fb21a10
- SHA1 fc75cc10097a3b6c7201f13a467796aaad3cb737
- SHA512 5551fa5787db1c10596d3d02f79d7f0c54e4f379230941363af3ed60bed521c4547915ddbb321eb5a33f4871f8da8d1b42b255355a4bbe2c3d8c470dda0b430f
- SSDEEP 3072:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFslEhLfyB1:PqFF2Ie+efsim2A5D
- TLSH T112B3A56AB58FB8E3DBF61131157FB52D5E25BD0FA9F838663B0690F88D0A77009C150A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 2 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000600000001b85a-1.dat family_cosmu behavioral2/files/0x000400000001b1bc-5.dat family_cosmu - Renames multiple (4238) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebClient.dll.tmp 2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\WindowsFormsIntegration.dll.tmp 2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\cldr.md.tmp 2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-1-0.dll.tmp 2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Xml.Linq.dll.tmp 2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.dll.tmp 2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md.tmp 2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Excel.Extensions.dll.tmp 2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationClientSideProviders.dll.tmp 2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\PresentationFramework.AeroLite.dll.tmp 2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-ppd.xrm-ms.tmp 2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ul-oob.xrm-ms.tmp 2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-multibyte-l1-1-0.dll.tmp 2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\instrument.dll.tmp 2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp 2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-ppd.xrm-ms.tmp 2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\da.txt.tmp 2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.Serialization.dll.tmp 2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationNative_cor3.dll.tmp 2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\UIAutomationTypes.resources.dll.tmp 2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Drawing.Common.dll.tmp 2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\lv.pak.tmp 2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O17EnterpriseVL_Bypass30-ul-oob.xrm-ms.tmp 2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-pl.xrm-ms.tmp 2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\tt-RU\tipresx.dll.mui.tmp 2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\PresentationUI.resources.dll.tmp 2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-pl.xrm-ms.tmp 2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-ul-oob.xrm-ms.tmp 2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-pl.xrm-ms.tmp 2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-pl.xrm-ms.tmp 2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense2019_eula.txt.tmp 2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.dll.tmp 2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.ServiceModel.Web.dll.tmp 2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_it.properties.tmp 2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-ppd.xrm-ms.tmp 2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Http.Json.dll.tmp 2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\libEGL.dll.tmp 2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2native.dll.tmp 2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Grace-ul-oob.xrm-ms.tmp 2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\splash_11-lic.gif.tmp 2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\thaidict.md.tmp 2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-ppd.xrm-ms.tmp 2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-ul-oob.xrm-ms.tmp 2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub2019_eula.txt.tmp 2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\eula.dll.tmp 2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Grace-ppd.xrm-ms.tmp 2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ul-phn.xrm-ms.tmp 2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe File created C:\Program Files\Common Files\System\ado\msador15.dll.tmp 2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\lcms.md.tmp 2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Violet.xml.tmp 2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ul-oob.xrm-ms.tmp 2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\mk-MK\tipresx.dll.mui.tmp 2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.dll.tmp 2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-pl.xrm-ms.tmp 2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ppd.xrm-ms.tmp 2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe.tmp 2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml.tmp 2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\System.Windows.Forms.Primitives.resources.dll.tmp 2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\JavaAccessBridge-64.dll.tmp 2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-ul-oob.xrm-ms.tmp 2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-ppd.xrm-ms.tmp 2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TabTip.exe.mui.tmp 2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Xml.Serialization.dll.tmp 2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\WindowsBase.resources.dll.tmp 2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-17_004fee8d3c69b008d9b4dfdb5fb21a10_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2714045687-1127350534-2056456672-1000\desktop.ini.tmp
- Size 109KB
- SHA256 2a0a887db0feab12ba6dbb578c1ac2b9909eeceda67ad358b28539e46e76a3dd
- MD5 c504b81b5386e69eb07c71a3535980a3
- SHA1 dcdfb085acf0259e528b85578e257e14e89f6ec6
- SHA512 c408d533e16045c68a3e3a520c82ce1770154f213232ec0c5d71999e1f1c8734e1ea8f9507d0dad7c5d772c1cb4e6c8201bdee9c61b0f9468ccaafab983904e1
- SSDEEP 3072:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFslEhLfyBt:PqFF2Ie+efsim2A5n
- TLSH T13AB3B56AB58FB8E3DBF61131257FB52D5E25BD0FA9F838663B0590F88D0A77009C150A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 207KB
- SHA256 b652b3d9a26f0d4836df24137eea51982c7e5e1edc2d2beda67dd1668422ee86
- MD5 8d3dcaa376db5980dd3168d944b04b65
- SHA1 beb9b575112a133a1e46bca5f5491a68c8b0661a
- SHA512 98ca916c053259d2499afba90c2298c9e14e3697e4ef536d7e974e883dfc503948675dea0a32165bb0f24819f0e1802ff51d8613785aa9c4fbd16886a6107b2f
- SSDEEP 3072:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFslEhLfyB+:PqFF2Ie+efsim2A5lMfTinqncsWp+/
- TLSH T1D1240861B89FF9E2CFA51235696FBD5B9E017D4F3CE9AC523A1550F2852DB700C8308A
- MD5 SHA1 SHA512 SSDEEP TLSH