Analysis
- max time kernel
150s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/10/2026, 16:47
Behavioral task
behavioral1
Sample
2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe
- Size 932KB
- Sample261007-va1gpac18r
- SHA256 a23b178a4a6f3b9a51a1fc7d8ab3b266edc07896d2c74df99b92912f33a5fb15
- MD5 fd9750f8752ed25d8dcef3a3aa39a6d6
- SHA1 35588dd7bfbcc5b60ee8b3b7058f1aa2549b3785
- SHA512 c6debffad9eb21be45f4f65cdb8557b65cdd19ed23b974adb07ad275ab9b84b79d08614a861f60db5d3a1f077b19657bb4af2fa37d75edb2b5ec5e79dd547527
- SSDEEP 12288:GPklj05a55PJQHbuZ/kPlWzsiqL1SWb3bqnw6wNHy0N0/AnQ63zg2nT:G25Qyc+Aqw6KH+AQ6g2T
- TLSH T177155B01345EB908D6A4D77A222392894717FDB83D4CFCB48464BEF6A9F29339E156C3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/memory/808-0-0x0000000000400000-0x000000000040A000-memory.dmp family_cosmu behavioral2/files/0x0007000000016b39-2.dat family_cosmu behavioral2/files/0x00030000000003ac-5.dat family_cosmu behavioral2/memory/808-442-0x0000000000400000-0x000000000040A000-memory.dmp family_cosmu - Detects executables packed with eXPressor 4 IoCs
resource yara_rule behavioral2/memory/808-0-0x0000000000400000-0x000000000040A000-memory.dmp INDICATOR_EXE_Packed_eXPressor behavioral2/files/0x0007000000016b39-2.dat INDICATOR_EXE_Packed_eXPressor behavioral2/files/0x00030000000003ac-5.dat INDICATOR_EXE_Packed_eXPressor behavioral2/memory/808-442-0x0000000000400000-0x000000000040A000-memory.dmp INDICATOR_EXE_Packed_eXPressor - Renames multiple (1829) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.DriveInfo.dll.tmp 2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\ur.pak.tmp 2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.Design.resources.dll.tmp 2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-libraryloader-l1-1-0.dll.tmp 2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Input.Manipulations.resources.dll.tmp 2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\UIAutomationClient.resources.dll.tmp 2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe File created C:\Program Files\EnableShow.MOD.tmp 2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Contracts.dll.tmp 2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Xaml.resources.dll.tmp 2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationTypes.resources.dll.tmp 2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Forms.resources.dll.tmp 2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Xaml.resources.dll.tmp 2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Aero2.dll.tmp 2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Metadata.dll.tmp 2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Runtime.Serialization.dll.tmp 2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Diagnostics.EventLog.dll.tmp 2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp 2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\mraut.dll.tmp 2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.dll.tmp 2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Xaml.resources.dll.tmp 2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.EventBasedAsync.dll.tmp 2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.CompilerServices.VisualC.dll.tmp 2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Contracts.dll.tmp 2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\fr\WindowsFormsIntegration.resources.dll.tmp 2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Windows.Forms.dll.tmp 2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Primitives.dll.tmp 2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Windows.Input.Manipulations.dll.tmp 2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml.tmp 2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Immutable.dll.tmp 2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Configuration.ConfigurationManager.dll.tmp 2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Xaml.resources.dll.tmp 2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\DirectWriteForwarder.dll.tmp 2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\WindowsBase.resources.dll.tmp 2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\sk.txt.tmp 2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\VC\msdia100.dll.tmp 2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.Calendars.dll.tmp 2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Extensions.dll.tmp 2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\Microsoft.DiaSymReader.Native.amd64.dll.tmp 2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Private.Uri.dll.tmp 2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationClient.resources.dll.tmp 2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\PresentationFramework.resources.dll.tmp 2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\ga-IE\tipresx.dll.mui.tmp 2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clrjit.dll.tmp 2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\WindowsBase.resources.dll.tmp 2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\lv.txt.tmp 2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe File created C:\Program Files\Common Files\System\ado\msadomd.dll.tmp 2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-util-l1-1-0.dll.tmp 2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.ReaderWriter.dll.tmp 2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.VisualBasic.dll.tmp 2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebSockets.dll.tmp 2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp 2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\UIAutomationClient.resources.dll.tmp 2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml.tmp 2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe File created C:\Program Files\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui.tmp 2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\dbgshim.dll.tmp 2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\WindowsBase.resources.dll.tmp 2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\PresentationUI.resources.dll.tmp 2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe File created C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui.tmp 2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Numerics.dll.tmp 2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp 2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\WindowsFormsIntegration.resources.dll.tmp 2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Input.Manipulations.resources.dll.tmp 2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\fr\ReachFramework.resources.dll.tmp 2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\tr\System.Windows.Input.Manipulations.resources.dll.tmp 2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-06_fd9750f8752ed25d8dcef3a3aa39a6d6_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-53044966-3830981193-2402648431-1000\desktop.ini.tmp
- Size 932KB
- SHA256 e43d68cf995428d5ff1ff26d8d3ff271089ef5dbfe53b08e1dfa0b3aca23aa56
- MD5 b040e4fd3820f00f54bf827da1fdda70
- SHA1 c995f369303ed6efebd9a361d4f3fb63e9e7a148
- SHA512 fef5f0ee51079e92c9857cbaa707322210af130705a166a1dc9a9135330c77d95f2136bf121218ee279b16b7878fe967485bcab14dd78463ba5639d0a332fff8
- SSDEEP 12288:GPklj05a55PJQHbuZ/kPlWzsiqL1SWb3bqnw6wNHy0N0/AnQ63zg2nv:G25Qyc+Aqw6KH+AQ6g2v
- TLSH T19E155B01345EB908D6A4D77A222392894717FDB83D4CFCB48464BEF6A9F29339E156C3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.chm.tmp
- Size 1.0MB
- SHA256 4ab3c54c57d7c0a21e854ba178312ffed0ee83b41af41dccafc917038b8c9d83
- MD5 9e5ddadc9dce1ea6646963f74e6d5579
- SHA1 e80ac9ef786c031184d1832c09beb785edd4f912
- SHA512 1d9afabc033fba9e3c22c69b34605521141967a6703356b9629930b80c38f4e24c861c95fbfaa2b315495c3672a7563bfca79ccd433356fd3b2da93948675845
- SSDEEP 12288:GPklj05a55PJQHbuZ/kPlWzsiqL1SWb3bqnw6wNHy0N0/AnQ63zg2nHEqSGN:G25Qyc+Aqw6KH+AQ6g2HwGN
- TLSH T1DB356C01345EB908D6A4D77A2223928D4716FDB83D4CFCB48464BEF6A9F29339E156C3
- MD5 SHA1 SHA512 SSDEEP TLSH