Analysis
- max time kernel
150s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 07:05
Behavioral task
behavioral1
Sample
2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe
- Size 365KB
- Sample260930-hwsbzss18n
- SHA256 74b1d1334315bbafe807b6033f457222c340bef3d29a0242c22e80fa74229a6f
- MD5 e63892399f81209154c1fbd26dde807d
- SHA1 945dd0437cbae49561896defcfa0c07855a379cb
- SHA512 7c7f7692c3172502919ad2e17cae1984cf963de130b20c9d9d4f6b81ba26855ce7a6c1b092b2340e802023f76fa163a44377c6772602c3cc51a0eff1cc43af4f
- SSDEEP 3072:7pWp6qFOqM3k5q6GZmhnVUI1rn/3ulU01fidg5eS8vAlpTmLb14wKYHHuos/fGC3:0HL3rYMv0pilFvAfTtYHHu8C/TXmrILv
- TLSH T1DC842A994093CBC7EF6D08B85A6DBC5858E2E71979CACC64460B1672C318F5F106ECEB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/memory/6008-0-0x0000000000400000-0x000000000040A000-memory.dmp family_cosmu behavioral2/files/0x000e000000019caf-2.dat family_cosmu behavioral2/files/0x000300000001b1c3-6.dat family_cosmu behavioral2/memory/6008-404-0x0000000000400000-0x000000000040A000-memory.dmp family_cosmu - Detects executables packed with eXPressor 4 IoCs
resource yara_rule behavioral2/memory/6008-0-0x0000000000400000-0x000000000040A000-memory.dmp INDICATOR_EXE_Packed_eXPressor behavioral2/files/0x000e000000019caf-2.dat INDICATOR_EXE_Packed_eXPressor behavioral2/files/0x000300000001b1c3-6.dat INDICATOR_EXE_Packed_eXPressor behavioral2/memory/6008-404-0x0000000000400000-0x000000000040A000-memory.dmp INDICATOR_EXE_Packed_eXPressor - Renames multiple (2319) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.dll.tmp 2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\WindowsBase.resources.dll.tmp 2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\it.pak.tmp 2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe File created C:\Program Files\7-Zip\License.txt.tmp 2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Resources.ResourceManager.dll.tmp 2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\WindowsBase.resources.dll.tmp 2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemXml.dll.tmp 2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe.tmp 2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XPath.dll.tmp 2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Console.dll.tmp 2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\lt.pak.tmp 2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui.tmp 2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Thread.dll.tmp 2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.IO.Pipes.dll.tmp 2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Threading.ThreadPool.dll.tmp 2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Controls.Ribbon.resources.dll.tmp 2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\WindowsFormsIntegration.dll.tmp 2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\System.Windows.Forms.resources.dll.tmp 2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe.tmp 2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.tmp 2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe File created C:\Program Files\Internet Explorer\de-DE\ieinstal.exe.mui.tmp 2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe File created C:\Program Files\Internet Explorer\ja-JP\iexplore.exe.mui.tmp 2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\jpeg_fx.md.tmp 2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\jaccess.jar.tmp 2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\chr-CHER-US\tipresx.dll.mui.tmp 2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml.tmp 2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll.tmp 2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.Brotli.dll.tmp 2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Xaml.resources.dll.tmp 2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\WindowsBase.resources.dll.tmp 2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.tmp 2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\attach.dll.tmp 2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui.tmp 2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TabTip.exe.mui.tmp 2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationUI.resources.dll.tmp 2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-namedpipe-l1-1-0.dll.tmp 2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jli.dll.tmp 2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngom.md.tmp 2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ar-sa.dll.tmp 2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp 2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.AeroLite.dll.tmp 2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\PresentationFramework.resources.dll.tmp 2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunmscapi.jar.tmp 2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XmlDocument.dll.tmp 2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Security.Cryptography.dll.tmp 2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\Microsoft.Win32.SystemEvents.dll.tmp 2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l1-2-0.dll.tmp 2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\resource.dll.tmp 2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationProvider.resources.dll.tmp 2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationClientSideProviders.resources.dll.tmp 2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe.tmp 2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\ReachFramework.resources.dll.tmp 2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe File created C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll.tmp 2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.Win32.Registry.dll.tmp 2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\mscordbi.dll.tmp 2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\PresentationUI.dll.tmp 2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Windows.Input.Manipulations.dll.tmp 2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\colorimaging.md.tmp 2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe File created C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.tmp 2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Formatters.dll.tmp 2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Http.Json.dll.tmp 2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationTypes.resources.dll.tmp 2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp 2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Input.Manipulations.resources.dll.tmp 2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-30_e63892399f81209154c1fbd26dde807d_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-461973139-3212354679-1508698038-1000\desktop.ini.tmp
- Size 365KB
- SHA256 8a8aa69a8697dd3c94c31f2ad4ef5e511670da05189f1950ebc67af53a28dd12
- MD5 5936723303a2e641768ad05c227e8bd5
- SHA1 99ae37fc4dc6fe1f77004ae53b1f7084a4bca217
- SHA512 23b99b9d9872d1dc5e8b27768567b1ef1e2f9513d0bbd2de3d588a6b6cf340dcfd9d3323b80884925afea19e338b6b0b15035165dece9d04b9d369e71c6c1e00
- SSDEEP 3072:7pWp6qFOqM3k5q6GZmhnVUI1rn/3ulU01fidg5eS8vAlpTmLb14wKYHHuos/fGCA:0HL3rYMv0pilFvAfTtYHHu8C/TXmrILo
- TLSH T119842A994093CBC7EF6D08B85A6DBC5858E2E71979CACC64460B1672C318F5F106ECEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 464KB
- SHA256 c571790689cc11881932dc3fa152085d17647d531b6258c38b5a818465a3b5d0
- MD5 18b455522bd92cc23d001790b7e00a38
- SHA1 4637d80f8bbf1f5be7defca8fd05e5b778e15b8b
- SHA512 4cc776701f5ba23beea84a1e5c6c1ae2ff9352cbdd74336a6b5bc45a949404c9123fbe7bc82f470d5b1329b5f88c540647204ec82a7553de40725bafc5f4cf9a
- SSDEEP 6144:0HL3rYMv0pilFvAfTtYHHu8C/TXmrILQMfTinqncsWp+4:GDvvUcFvACw7Xmr9MfunbsW84
- TLSH T12BA44A944097DBD3DF5C05BC6A6FBD8654A1A70A3C8ACC64560A12B2C328F5F146FCEB
- MD5 SHA1 SHA512 SSDEEP TLSH