Analysis
- max time kernel
150s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/10/2026, 14:35
Behavioral task
behavioral1
Sample
2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
- Size 24KB
- Sample261002-ryc5hs1ckd
- SHA256 e99b9502a8f3fb72fe3d36e0a1eeb1a0dd3801668af14d42172fb81fafcf994e
- MD5 540d37176d9009625dd696c92a01c612
- SHA1 4bd5b8bacea0b86e4b930256c373afa5f9b3af00
- SHA512 0a9557b2ed80c423541531f666563a4dbcc56a17d2bbbdc39dea780cfdd69aa816b3eeed9268e328b000a98f527730bb1d77c5c7745c9ab5a0805d3525957d1e
- SSDEEP 192:NACUADIY0Br5xjL/uAgAQmP1oynLb22vPl2RHH/JFB2JyNomMmV:mBt7Br5xjLWAgA71FbhvPwR/s4N5
- TLSH T1BFB2F92F6A05847AD39A8034052E7438F973A0286731EE5BAB19CD3838776A0DC7964A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 2 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral1/files/0x00070000000004e8-1.dat family_cosmu behavioral1/files/0x000200000001e53d-4.dat family_cosmu - Renames multiple (4934) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ul.xrm-ms.tmp 2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-ul-oob.xrm-ms.tmp 2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll.tmp 2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-pl.xrm-ms.tmp 2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\OUTLOOK_K_COL.HXK.tmp 2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\TellMeWord.nrr.tmp 2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPackEula.txt.tmp 2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe.tmp 2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-ul-phn.xrm-ms.tmp 2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipTsf.dll.mui.tmp 2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\PresentationFramework.Royale.dll.tmp 2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ul-phn.xrm-ms.tmp 2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE.tmp 2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.resources.dll.tmp 2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Threading.Overlapped.dll.tmp 2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ppd.xrm-ms.tmp 2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\orcl7.xsl.tmp 2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-180.png.tmp 2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\OFFSYML.TTF.tmp 2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml.tmp 2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\TipRes.dll.tmp 2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Candara.xml.tmp 2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_COL.HXT.tmp 2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.VisualStudio.OLE.Interop.dll.tmp 2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.dll.tmp 2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Core.dll.tmp 2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe.tmp 2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jsoundds.dll.tmp 2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-pl.xrm-ms.tmp 2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml.tmp 2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-locale-l1-1-0.dll.tmp 2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationProvider.resources.dll.tmp 2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-stdio-l1-1-0.dll.tmp 2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-ppd.xrm-ms.tmp 2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-pl.xrm-ms.tmp 2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\DocumentFormat.OpenXml.dll.tmp 2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-80.png.tmp 2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml.tmp 2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationClientSideProviders.resources.dll.tmp 2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationProvider.resources.dll.tmp 2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\management\management.properties.tmp 2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.tmp 2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.tmp 2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\hi\msipc.dll.mui.tmp 2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\[email protected] 2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe File created C:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui.tmp 2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationClient.resources.dll.tmp 2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\System.Windows.Forms.Primitives.resources.dll.tmp 2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssv.dll.tmp 2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ul-phn.xrm-ms.tmp 2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-ul-oob.xrm-ms.tmp 2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-ul-oob.xrm-ms.tmp 2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ul-phn.xrm-ms.tmp 2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp 2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\j2pcsc.dll.tmp 2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ppd.xrm-ms.tmp 2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ul-phn.xrm-ms.tmp 2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ul-oob.xrm-ms.tmp 2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\System.Web.Mvc.dll.tmp 2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA\openssl64.dlla.manifest.tmp 2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\mng.txt.tmp 2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui.tmp 2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Configuration.dll.tmp 2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe.tmp 2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-939655444-3071939294-1401108526-1000\desktop.ini.tmp
- Size 24KB
- SHA256 6ad9715d970aa9f71e39b628cb51569a11c9f367011d971b6912e46aeb51e241
- MD5 fa814c75c4863e237f3318e458e24980
- SHA1 b438ccfd24aea78087177a4a65dd1d6827810429
- SHA512 f6db10d69536c4fff1a9d9b85fa373747c4ff837ee33c0a81cfc6caf3262b6c630edbfa0e5f9205c486a6fdd1eaf000621290b6f90f83027a87c7a1fe82a00f6
- SSDEEP 192:NACUADIY0Br5xjL/uAgAQmP1oynLb22vPl2RHH/JFB2JyNomMmS:mBt7Br5xjLWAgA71FbhvPwR/s4N2
- TLSH T1CAB2092F6A05807BD3998034053F7478F933A0286735EE9BAB19CD3828776E0DC79259
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.chm.tmp
- Size 141KB
- SHA256 5834b2f6a7b0ad7dd7c4ef8e24a8c1ad83a75d6ab30dc98a274ed256e8573342
- MD5 d95f70b10cb98aa6c17e0307011aaf24
- SHA1 bac1de6807de47f47c90c44c85f36cf87cc968f9
- SHA512 59463aab8286af00c8997e8293e50e0a175231fe5693a850865507112893773bffe32b386a649d30716e7e305bacf1b0f413b54b10ce7ce6e7489f7cd5559411
- SSDEEP 3072:a6WpkzwxMxdrwdaEMePCUlZVpnwzuGSsOOOa:YizwxMxFELMO9wapsOZa
- TLSH T1B3E3026B36941426DB5B41381253E43E73B33C491611CF427F9ACE1E26F6B99B43A31B
- MD5 SHA1 SHA512 SSDEEP TLSH