Analysis
- max time kernel
150s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 15:20
Behavioral task
behavioral1
Sample
2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe
- Size 24KB
- Sample261002-sq83natdja
- SHA256 18ca4f90fffe9cf3d28dacb39d880ca088377644472c80ae025e477ce0f7174b
- MD5 49bb5bbca6f7323033272f5b735dec98
- SHA1 eb0a2953144180cc3be13c6009c0ba62c02511d4
- SHA512 dc0136817405b0884fc7847c0645071721674691c73aea8a75b958e37662cb27b610d1f14955248a7c5db0d2b117703472c8e8fc44ae3c193bf73d320691ba86
- SSDEEP 192:NACUADIY0Br5xjL/0AgAQmP1oynLb22vPl2RHH/JFB2JyNomMmV:mBt7Br5xjL8AgA71FbhvPwR/s4N5
- TLSH T179B2092FAA05847AD399C034053E7478F933A4286731EF5BBB15CD3824776E0DC7924A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 2 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000600000001b859-1.dat family_cosmu behavioral2/files/0x00030000000003a9-4.dat family_cosmu - Renames multiple (4223) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\System\msadc\msadcor.dll.tmp 2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Configuration.dll.tmp 2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\kab.txt.tmp 2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-process-l1-1-0.dll.tmp 2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG.HXS.tmp 2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\bs-Latn-BA\tipresx.dll.mui.tmp 2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.Win32.Registry.AccessControl.dll.tmp 2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\System.Windows.Forms.Primitives.resources.dll.tmp 2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe.tmp 2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-string-l1-1-0.dll.tmp 2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ul-phn.xrm-ms.tmp 2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-ppd.xrm-ms.tmp 2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-pl.xrm-ms.tmp 2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Buffers.dll.tmp 2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationTypes.resources.dll.tmp 2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\MSOSEC.DLL.tmp 2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-ppd.xrm-ms.tmp 2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Grace-ul-oob.xrm-ms.tmp 2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\sw.txt.tmp 2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp 2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\tzdb.dat.tmp 2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ul-oob.xrm-ms.tmp 2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ppd.xrm-ms.tmp 2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessBasic2019_eula.txt.tmp 2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Forms.Design.resources.dll.tmp 2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\ReachFramework.resources.dll.tmp 2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-pl.xrm-ms.tmp 2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\mashupcompression.dll.tmp 2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pl-pl.dll.tmp 2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe File created C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui.tmp 2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\WindowsFormsIntegration.resources.dll.tmp 2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Input.Manipulations.resources.dll.tmp 2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\UIAutomationProvider.resources.dll.tmp 2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ul-phn.xrm-ms.tmp 2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ul-oob.xrm-ms.tmp 2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\charsets.jar.tmp 2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\icu.md.tmp 2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-ppd.xrm-ms.tmp 2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\LyncVDI_Eula.txt.tmp 2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\cs.txt.tmp 2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe File created C:\Program Files\Common Files\System\Ole DB\msdaosp.dll.tmp 2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clrjit.dll.tmp 2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.resources.dll.tmp 2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCalls.h.tmp 2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-ul-oob.xrm-ms.tmp 2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ul-phn.xrm-ms.tmp 2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe File created C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui.tmp 2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-debug-l1-1-0.dll.tmp 2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-heap-l1-1-0.dll.tmp 2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-pl.xrm-ms.tmp 2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-string-l1-1-0.dll.tmp 2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encoding.Extensions.dll.tmp 2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.Xml.dll.tmp 2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription3-ul-oob.xrm-ms.tmp 2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp 2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\cmm\sRGB.pf.tmp 2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp 2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md.tmp 2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ul-phn.xrm-ms.tmp 2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-pl.xrm-ms.tmp 2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\MSSRINTL.DLL.tmp 2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\ReachFramework.resources.dll.tmp 2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\libxslt.md.tmp 2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processenvironment-l1-1-0.dll.tmp 2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-01_49bb5bbca6f7323033272f5b735dec98_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2251218687-1689653882-3767565116-1000\desktop.ini.tmp
- Size 24KB
- SHA256 3993c52786e7f00768304db2f9c9ac1e61a3388b30b2cd7279265ae04520a66b
- MD5 24020f16dbf7e1bbde2f97644d18bd73
- SHA1 6c7cd297a3ec190470ec5284c4951bd387833f39
- SHA512 f5e3b12bd852e7cd2ffd00b7d47d474736400cebfac4569fb8b71d89f5169c974a368a9ec18c9ce94c021ceb118165051569cc36e4aec40da471b280fde07071
- SSDEEP 192:NACUADIY0Br5xjL/0AgAQmP1oynLb22vPl2RHH/JFB2JyNomMmR:mBt7Br5xjL8AgA71FbhvPwR/s4NF
- TLSH T1E6B2092FAA15847AD39D8034053F7478F933A0286735EF9BAB15CD3829676E0DC79219
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.chm.tmp
- Size 141KB
- SHA256 47ab4dd27f183edcb837995fd0634084fb45df512449cc784dbf1b6f4b5b391b
- MD5 3a5d64d27c821f4c773960fa0356af7e
- SHA1 217805d13376e5a1535c0a7362fc54d7b406da90
- SHA512 a24598b65f341f5e58de17c764e1f24f0e6b0284fab8ec8d01174fb2eb817c3fc9f5357e2214c41ecdf9d8ab44ea514e0d860ab15bb6ccddce2a3d06fdf566ef
- SSDEEP 3072:aQWpkcwxMxdrwdaEMePCUlZVpnwzuGSsOOOa:SicwxMxFELMO9wapsOZa
- TLSH T16DE3026B36945425DB5A42381253E43E73B33C491611CF437F8ACE1E26F6B99B43A31B
- MD5 SHA1 SHA512 SSDEEP TLSH