Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/10/2026, 06:17
Behavioral task
behavioral1
Sample
2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe
- Size 27KB
- Sample261007-g16jqscy2t
- SHA256 d8deeeaf02cbcad7d4ea1e9432277e2ddbd67aa73e7da4ad5fddb67a47cbae39
- MD5 121bd5a35ce8fe8ecb44629e71b598ef
- SHA1 cfa605b928500a87d3998b3991ebdc70e0b54f31
- SHA512 6fb5477ed2b6a55d8b8248dbfbdabfb5a0388cd54f49bd9e99d186464c1a744059816c9169f296eaf0e72bf2ebfc957165db211987c84dac47f1b681872e6d03
- SSDEEP 384:NBt7Br5xjL9AgA71Fbhv/r+k7ha3KzpsVvUaWq9C7P:d7BlpppARFbh6qnpim2E
- TLSH T12CC25C1E8B06C073D39950345C2FA8B99CB758397FA19E6FAB078C2E69757D0FC28119
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/memory/1844-0-0x0000000000400000-0x0000000000409D5C-memory.dmp family_cosmu behavioral2/files/0x001d00000000696b-2.dat family_cosmu behavioral2/files/0x00030000000003e7-5.dat family_cosmu behavioral2/memory/1844-767-0x0000000000400000-0x0000000000409D5C-memory.dmp family_cosmu - Detects executables packed with eXPressor 4 IoCs
resource yara_rule behavioral2/memory/1844-0-0x0000000000400000-0x0000000000409D5C-memory.dmp INDICATOR_EXE_Packed_eXPressor behavioral2/files/0x001d00000000696b-2.dat INDICATOR_EXE_Packed_eXPressor behavioral2/files/0x00030000000003e7-5.dat INDICATOR_EXE_Packed_eXPressor behavioral2/memory/1844-767-0x0000000000400000-0x0000000000409D5C-memory.dmp INDICATOR_EXE_Packed_eXPressor - Renames multiple (4602) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\Lang\kk.txt.tmp 2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.dll.tmp 2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\PresentationUI.resources.dll.tmp 2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\security\trusted.libraries.tmp 2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_Grace-ul-oob.xrm-ms.tmp 2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Core.NetFX35.V7.dll.tmp 2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.Primitives.dll.tmp 2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp 2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md.tmp 2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial-ul-oob.xrm-ms.tmp 2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Trial-pl.xrm-ms.tmp 2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Trial-pl.xrm-ms.tmp 2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006\FA000000006.tmp 2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunpkcs11.jar.tmp 2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaTypewriterRegular.ttf.tmp 2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ppd.xrm-ms.tmp 2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\Invite or Link.one.tmp 2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\uz-Latn-UZ\tipresx.dll.mui.tmp 2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\PresentationUI.resources.dll.tmp 2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-utility-l1-1-0.dll.tmp 2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\fre\StartMenu_Win7.wmv.tmp 2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-math-l1-1-0.dll.tmp 2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationClient.resources.dll.tmp 2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe.tmp 2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\+Connect to New Data Source.odc.tmp 2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationClient.resources.dll.tmp 2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\psfont.properties.ja.tmp 2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe File created C:\Program Files\7-Zip\Uninstall.exe.tmp 2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Resources.ResourceManager.dll.tmp 2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\fr\System.Windows.Forms.resources.dll.tmp 2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\System.Xaml.resources.dll.tmp 2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-convert-l1-1-0.dll.tmp 2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe File created C:\Program Files\Common Files\System\msadc\msaddsr.dll.tmp 2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\PresentationFramework.resources.dll.tmp 2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Xaml.resources.dll.tmp 2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\decora_sse.dll.tmp 2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md.tmp 2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ul.xrm-ms.tmp 2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\npt.dll.tmp 2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe.tmp 2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Gothic-Palatino Linotype.xml.tmp 2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.ReportingServices.DataExtensions.dll.tmp 2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.tmp 2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\WindowsBase.dll.tmp 2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp 2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp 2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\Graph.exe.manifest.tmp 2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Windows.Controls.Ribbon.dll.tmp 2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\hijrah-config-umalqura.properties.tmp 2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Ion Boardroom.thmx.tmp 2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ppd.xrm-ms.tmp 2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ppd.xrm-ms.tmp 2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-180.png.tmp 2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.tmp 2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-environment-l1-1-0.dll.tmp 2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.Primitives.resources.dll.tmp 2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ppd.xrm-ms.tmp 2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Debug.dll.tmp 2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Drawing.Primitives.dll.tmp 2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe.tmp 2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-ppd.xrm-ms.tmp 2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\ucrtbase.dll.tmp 2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Grace-ul-oob.xrm-ms.tmp 2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTrial-ul-oob.xrm-ms.tmp 2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-05_121bd5a35ce8fe8ecb44629e71b598ef_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1404337215-1550464601-2805570857-1000\desktop.ini.tmp
- Size 27KB
- SHA256 383391bc2f0b28616a4f9bc571acc36f69f22a09dda824d0d8d216a01e646c45
- MD5 92ebdc2cf257d1ec799daaca0b8801d2
- SHA1 fd8af1486484ce83453e5d533fffd0eb84994286
- SHA512 5d5673005efc6b965381908a972deaac6e669a1ddc29aa1c17dd5134552a394911b6d54dca48884d3e9d0715ad22fd12286d3dea04e2c3333c5de162dc3a5eb4
- SSDEEP 384:NBt7Br5xjL9AgA71Fbhv/r+k7ha3KzpsVvUaWq9C75:d7BlpppARFbh6qnpim2e
- TLSH T10FC25C1E8B06C073D39950345C2FA8B9ACB75839BF619E6F9B078C2E69757D0FC28119
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.chm.tmp
- Size 144KB
- SHA256 d5d79dffc952b107d4a0ac0b0ba7e9fa1b16fca20ba512a3249bfbee16537276
- MD5 4d0d69dcb7778ebaa9e69f08c5bc571b
- SHA1 13a4ef343b327760fe584c8904a0c510ed54e1c3
- SHA512 2ef67de4479b278fdd54ee61bd6e0cd79149e0d89d13df51c4d329108f07bb333627a045f5c59ebec27439a3c70bcda24bec25a4697441ce53e877fe853016ad
- SSDEEP 3072:npWp6qnYwxMxdrwdaEMePCUlZVpnwzuGSsOOOC:glYwxMxFELMO9wapsOZC
- TLSH T1E8E3016A6B845422C75601382113E83E77B32C592F51CB5A7F8BCD0F6AB67D4B43922B
- MD5 SHA1 SHA512 SSDEEP TLSH