Analysis
- max time kernel
150s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/10/2026, 17:48
Behavioral task
behavioral1
Sample
2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe
- Size 24KB
- Sample261007-wdgpessxay
- SHA256 7b965f709fe143ae250c62212bc2731ad3aa54864bb25dea0901f166a225ca82
- MD5 ed3858c6c321f57c87d791eda32ac266
- SHA1 a25fa5f4ac79052fe569c7fa96917d7c1261a811
- SHA512 599f8d05edace24a54e3cbfb3ef02d87037b35b3cca8e5543c54343ec8867873ce48d8c0c4265c13d9ae4f911b5092f41ebaee4cfc70adc11a4b8a976f9b642e
- SSDEEP 192:NACUADIY0Br5xjL/jKCAgAQmP1oynLb22vPl2RHH/JFB2JyNomMmV:mBt7Br5xjL7KCAgA71FbhvPwR/s4N5
- TLSH T1A5B20B2F6A45847AD399C034053F7478F533A0286771EF9BBB19CD382477AA0DC7925A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 2 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000500000000053e-1.dat family_cosmu behavioral2/files/0x00030000000003b3-4.dat family_cosmu - Renames multiple (4890) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipTsf.dll.mui.tmp 2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-process-l1-1-0.dll.tmp 2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ul-oob.xrm-ms.tmp 2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationClient.resources.dll.tmp 2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll.tmp 2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\security\policy\limited\US_export_policy.jar.tmp 2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-pl.xrm-ms.tmp 2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\TASKACC.CFG.tmp 2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Xaml.resources.dll.tmp 2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Input.Manipulations.resources.dll.tmp 2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\PresentationUI.resources.dll.tmp 2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\VisualElements\LogoDev.png.tmp 2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.tmp 2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.tmp 2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ul-phn.xrm-ms.tmp 2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.ReportingServices.QueryDesigners.Extensions.dll.tmp 2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe.tmp 2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.resources.dll.tmp 2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md.tmp 2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightDemiItalic.ttf.tmp 2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\UmOutlookAddin.dll.tmp 2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\Microsoft.VisualBasic.Forms.resources.dll.tmp 2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Grace-ppd.xrm-ms.tmp 2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ONINTL.DLL.tmp 2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ul-phn.xrm-ms.tmp 2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Grace-ul-oob.xrm-ms.tmp 2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\es\msipc.dll.mui.tmp 2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe File created C:\Program Files\Common Files\System\ado\msador28.tlb.tmp 2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.WindowsDesktop.App.runtimeconfig.json.tmp 2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.Primitives.dll.tmp 2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\ext\localedata.jar.tmp 2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\MAPIR.DLL.tmp 2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationProvider.resources.dll.tmp 2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\fr\ReachFramework.resources.dll.tmp 2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ConsumerSub_Bypass30-ul-oob.xrm-ms.tmp 2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe.tmp 2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-ppd.xrm-ms.tmp 2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-ppd.xrm-ms.tmp 2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ppd.xrm-ms.tmp 2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ul-phn.xrm-ms.tmp 2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ul-oob.xrm-ms.tmp 2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Grace-ppd.xrm-ms.tmp 2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-ppd.xrm-ms.tmp 2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-180.png.tmp 2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Console.dll.tmp 2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\UIAutomationClient.resources.dll.tmp 2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Configuration.dll.tmp 2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Process.dll.tmp 2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\tr\System.Windows.Forms.Primitives.resources.dll.tmp 2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe File created C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 6.0.27 (x64).swidtag.tmp 2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe.tmp 2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Median.xml.tmp 2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ul-oob.xrm-ms.tmp 2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ul-phn.xrm-ms.tmp 2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.tmp 2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebHeaderCollection.dll.tmp 2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Xaml.dll.tmp 2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-environment-l1-1-0.dll.tmp 2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART2.BDR.tmp 2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\am-ET\tipresx.dll.mui.tmp 2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\tabskb.dll.tmp 2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\jpeg.dll.tmp 2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.ConnectionUI.dll.tmp 2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\sv.txt.tmp 2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-06_ed3858c6c321f57c87d791eda32ac266_elex_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4548
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:3756
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-4154726816-2055034831-2297277433-1000\desktop.ini.tmp
- Size 24KB
- SHA256 3c5f9b31ed55d5ae4daf0bb84b2740cb602f66127cab85036fbecb9ba0578ec3
- MD5 9eef28d42a0fdf335b983b6402b908ba
- SHA1 9e63ff32f5a457c62bf83e366aad6e80cea5b7f8
- SHA512 5012a490fbea0c76f0a7c493f1e7c6264cc3e92a47a00fd87f99455ef4f395b01ba91f349ddbf811e213f67188b625a3b7411153d04b1f50d757795a9e486403
- SSDEEP 192:NACUADIY0Br5xjL/jKCAgAQmP1oynLb22vPl2RHH/JFB2JyNomMmw:mBt7Br5xjL7KCAgA71FbhvPwR/s4N8
- TLSH T14AB2092F6A15847AD3998034053F7478F933A0286731EF9BFB19CD3828776A0DC7921A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.chm.tmp
- Size 141KB
- SHA256 08c4fcfe468b956f5a53a06919fba5d1f61d6f6937cc54dc9708d8a0b39b4794
- MD5 f1e379443fb8f892e6fff2c49c0e0a7e
- SHA1 9fc2d9aaf93d5d51c5596c5b6f7ac62489245920
- SHA512 6fba9d5259e1466668dd6d3c138c3eef2e43861a942b25b39eba132b22d5f076da7dcc639c198c05a2000f0ea00bc53733f67ce9233a6609697d5bf0c18c146c
- SSDEEP 3072:avWpkEwxMxdrwdaEMePCUlZVpnwzuGSsOOOa:5iEwxMxFELMO9wapsOZa
- TLSH T149E3026B36D41425DB5A41381253E43E73B33C491611CF427F9ACE1E26F6BA9B43A32B
- MD5 SHA1 SHA512 SSDEEP TLSH