Analysis
- max time kernel
150s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/10/2026, 03:04
Behavioral task
behavioral1
Sample
2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe
- Size 24KB
- Sample261016-dk447a1s7j
- SHA256 004700a9e27eb60171b448ea8513907680dfe7313407bfabb0992fe8f0d5890c
- MD5 d7dee6094e2c32d6fb5549ee836c0a2c
- SHA1 fb71ebbc0b80d789ce8788f7670f522483cc4b0e
- SHA512 9520448a8fa67248b4a45776f0ac56219533d120d95046a5c2b81bfab12544c6688a5c199f52f33f0ca2f1eb40880414175765114219ff86c48ea39c08e9d884
- SSDEEP 192:NACUADIY0Br5xjL/DAgAQmP1oynLb22vPl2RHH/JFB2JyNomMmV:mBt7Br5xjLrAgA71FbhvPwR/s4N5
- TLSH T1CDB2092FAA45847AD79DC034053EB478F533A0286735EF5BBB19CD3824776A0EC7924A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 2 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x001b00000000696b-1.dat family_cosmu behavioral2/files/0x00030000000003e7-4.dat family_cosmu - Renames multiple (4751) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Trial-ppd.xrm-ms.tmp 2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-pl.xrm-ms.tmp 2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-ppd.xrm-ms.tmp 2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ul-phn.xrm-ms.tmp 2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe File created C:\Program Files\Common Files\System\ado\adojavas.inc.tmp 2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Net.Security.dll.tmp 2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Private.Xml.dll.tmp 2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Gill Sans MT.xml.tmp 2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ppd.xrm-ms.tmp 2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Grace-ul-oob.xrm-ms.tmp 2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_PrepidBypass-ul-oob.xrm-ms.tmp 2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\Informix.xsl.tmp 2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationClient.resources.dll.tmp 2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\PresentationCore.resources.dll.tmp 2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md.tmp 2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\jce.jar.tmp 2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\Microsoft.Office.PolicyTips.dll.tmp 2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-handle-l1-1-0.dll.tmp 2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Top Shadow.eftx.tmp 2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Candara.xml.tmp 2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml.tmp 2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-pl.xrm-ms.tmp 2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-private-l1-1-0.dll.tmp 2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Security.Claims.dll.tmp 2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Controls.Ribbon.resources.dll.tmp 2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\libxslt.md.tmp 2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\dtplugin\deployJava1.dll.tmp 2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Grace-ul-oob.xrm-ms.tmp 2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-ul-oob.xrm-ms.tmp 2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ul.xrm-ms.tmp 2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ul-phn.xrm-ms.tmp 2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Tracing.dll.tmp 2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\WindowsFormsIntegration.resources.dll.tmp 2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\System.Windows.Forms.Design.resources.dll.tmp 2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-pl.xrm-ms.tmp 2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-ul-oob.xrm-ms.tmp 2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\UmOutlookStrings.dll.tmp 2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe File created C:\Program Files\7-Zip\License.txt.tmp 2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\Microsoft.WindowsDesktop.App.runtimeconfig.json.tmp 2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ul-phn.xrm-ms.tmp 2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\sspi_bridge.dll.tmp 2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\jp2native.dll.tmp 2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\16\Built-In Building Blocks.dotx.tmp 2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msaddsr.dll.mui.tmp 2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationProvider.resources.dll.tmp 2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationTypes.resources.dll.tmp 2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Forms.Design.resources.dll.tmp 2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe.tmp 2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\jfr\profile.jfc.tmp 2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-pl.xrm-ms.tmp 2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTrial-ppd.xrm-ms.tmp 2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-ul-oob.xrm-ms.tmp 2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-pl.xrm-ms.tmp 2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\sk.txt.tmp 2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui.tmp 2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe.tmp 2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-pl.xrm-ms.tmp 2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-errorhandling-l1-1-0.dll.tmp 2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue II.xml.tmp 2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_K_COL.HXK.tmp 2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\WindowsBase.dll.tmp 2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_Grace-ppd.xrm-ms.tmp 2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\FilterModule.dll.tmp 2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-180.png.tmp 2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-15_d7dee6094e2c32d6fb5549ee836c0a2c_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1404337215-1550464601-2805570857-1000\desktop.ini.tmp
- Size 24KB
- SHA256 e8f8777a5a65fae510b6a4463ff6e033fddec0635f42eab0ab778ff56ae2e4c5
- MD5 fe138e648ca612900cb9ad48674e2982
- SHA1 424a6957bc2770a3e999ddd85d0a456f3cd81446
- SHA512 5621b7f6aeb100c5a8a9f45bf73def87a3d55ad16bd7c24309bf0b947f04c06116e753a2246a19673d6a786a6fe864eb294c3163aa9b50a8a88fb3e2459e4f6f
- SSDEEP 192:NACUADIY0Br5xjL/DAgAQmP1oynLb22vPl2RHH/JFB2JyNomMmd:mBt7Br5xjLrAgA71FbhvPwR/s4Np
- TLSH T1AAB21A2FAA55847AD39D8034053FB478F533A0286735EF5BBB15CD3828776A0DC39259
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.chm.tmp
- Size 141KB
- SHA256 f9c742a4b9f640b6ff2b62e7f3e19d81bc37747463a833189e399b8e48ae7b7d
- MD5 96c45957964b0de0f820622a43dd1cf6
- SHA1 39275469d302eb2b4f8333b0e161f86ad2b12ff6
- SHA512 d68d875b4904e6d05045b37a106e83fb4cda54ae47b0575b30be8fcea093b3b41d15df3b2bd7633c80a4d0834a9fcdfbbe9815e4144cba0b08efd303aea4a6cb
- SSDEEP 3072:aPWpkTwxMxdrwdaEMePCUlZVpnwzuGSsOOOa:1iTwxMxFELMO9wapsOZa
- TLSH T131E3026B36D41425CB5A41381293E43E73B33C491615CF427F8ACE1E26F6BA9B43A31B
- MD5 SHA1 SHA512 SSDEEP TLSH