Analysis
- max time kernel
150s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/10/2026, 03:23
Behavioral task
behavioral1
Sample
2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe
- Size 444KB
- Sample261019-dxth8act2l
- SHA256 b2925b433c92d9555e5779ac75bb49a05d7b6b8f1b7f38f47f9230234f55ba61
- MD5 669215078f35204f20e62fe0f201f86b
- SHA1 496a39a9644b2f16a1b0a96273a46933e7b16a19
- SHA512 75d5c098edde53d92ab447058209b6d58ffb9ddc9a4b12d9c085cea583d93ca02825da8a3e0f8199e52551c928977a9d296a7446b9313ab3800a74fda3c552d6
- SSDEEP 6144:0HakwTfjVLdK65Udg77FKk6ODcnhLN9pzeCWmd0GGFL5FTsns+1qUTLXj59Z92jj:GaPCg7A1nhLN9pqzmdJGl5Wn792v
- TLSH T182A46C734105DE81FE4EB47F862DB062C0E3B50A3EE2C96659D5C831E94AD4B84B9CDB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/memory/3136-0-0x0000000000400000-0x000000000040A000-memory.dmp family_cosmu behavioral2/files/0x000a00000001b2cb-2.dat family_cosmu behavioral2/files/0x00030000000003e7-5.dat family_cosmu behavioral2/memory/3136-611-0x0000000000400000-0x000000000040A000-memory.dmp family_cosmu - Detects executables packed with eXPressor 4 IoCs
resource yara_rule behavioral2/memory/3136-0-0x0000000000400000-0x000000000040A000-memory.dmp INDICATOR_EXE_Packed_eXPressor behavioral2/files/0x000a00000001b2cb-2.dat INDICATOR_EXE_Packed_eXPressor behavioral2/files/0x00030000000003e7-5.dat INDICATOR_EXE_Packed_eXPressor behavioral2/memory/3136-611-0x0000000000400000-0x000000000040A000-memory.dmp INDICATOR_EXE_Packed_eXPressor - Renames multiple (2683) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe.tmp 2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\ext\cldrdata.jar.tmp 2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\ReachFramework.resources.dll.tmp 2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Configuration.ConfigurationManager.dll.tmp 2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\UIAutomationClient.resources.dll.tmp 2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\vk_swiftshader_icd.json.tmp 2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\ka.txt.tmp 2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe File created C:\Program Files\BlockCompare.aifc.tmp 2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\msinfo32.exe.mui.tmp 2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Text.Encoding.dll.tmp 2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Forms.Primitives.resources.dll.tmp 2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Controls.Ribbon.resources.dll.tmp 2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pl\UIAutomationClientSideProviders.resources.dll.tmp 2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\VisualElements\SmallLogoBeta.png.tmp 2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nb-no.dll.tmp 2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe File created C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui.tmp 2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\Microsoft.Win32.Registry.AccessControl.dll.tmp 2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-sysinfo-l1-1-0.dll.tmp 2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libxml2.md.tmp 2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\README.txt.tmp 2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\meta-index.tmp 2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordbi.dll.tmp 2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Primitives.dll.tmp 2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.RuntimeInformation.dll.tmp 2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Xaml.resources.dll.tmp 2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Xaml.resources.dll.tmp 2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\System.Windows.Forms.Primitives.resources.dll.tmp 2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\cmm\LINEAR_RGB.pf.tmp 2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\ko.txt.tmp 2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities.json.tmp 2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe.tmp 2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe File created C:\Program Files\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui.tmp 2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.Win32.Registry.AccessControl.dll.tmp 2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe File created C:\Program Files\Common Files\System\msadc\adcvbs.inc.tmp 2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.Design.resources.dll.tmp 2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\WindowsFormsIntegration.resources.dll.tmp 2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md.tmp 2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Dynamic.Runtime.dll.tmp 2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.IO.Pipes.dll.tmp 2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\ReachFramework.resources.dll.tmp 2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe File created C:\Program Files\7-Zip\Uninstall.exe.tmp 2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipTsf.dll.mui.tmp 2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tipresx.dll.mui.tmp 2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.StackTrace.dll.tmp 2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Json.dll.tmp 2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\System.Windows.Input.Manipulations.resources.dll.tmp 2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\PresentationFramework.resources.dll.tmp 2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\tr\ReachFramework.resources.dll.tmp 2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\clrjit.dll.tmp 2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscorrc.dll.tmp 2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\ReachFramework.resources.dll.tmp 2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ja\PresentationFramework.resources.dll.tmp 2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\tr\PresentationFramework.resources.dll.tmp 2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-handle-l1-1-0.dll.tmp 2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp 2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-namedpipe-l1-1-0.dll.tmp 2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.ReaderWriter.dll.tmp 2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationClient.resources.dll.tmp 2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationTypes.resources.dll.tmp 2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\public_suffix.md.tmp 2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\libxml2.md.tmp 2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.es-es.dll.tmp 2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe File created C:\Program Files\DisableRepair.wvx.tmp 2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationClient.resources.dll.tmp 2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-17_669215078f35204f20e62fe0f201f86b_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1404337215-1550464601-2805570857-1000\desktop.ini.tmp
- Size 445KB
- SHA256 c94035477e94bab2c3cd75475abdc8ca79c0497a5748f2d83ee60581e6b486a2
- MD5 7458d383f8e66426f654c0c83713281c
- SHA1 eba017f652f6fdfbb930b165006b9df439ec8de8
- SHA512 370b03cfcec110e1bcd7c59882f42c4f77831fca0841af94ddad3407583b365e04af35061610d309c894957cec6b586e78e95d1105f1eb5a08558a5d3e9c154f
- SSDEEP 6144:0HakwTfjVLdK65Udg77FKk6ODcnhLN9pzeCWmd0GGFL5FTsns+1qUTLXj59Z92j+:GaPCg7A1nhLN9pqzmdJGl5Wn792K
- TLSH T179A46C734105DE81FE4EB47F862DB062C0E3B50A3EE2C96659D5C831E94AD4B84B9CDB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.chm.tmp
- Size 562KB
- SHA256 a9d8e1e4a6d25c525bd8ca185549a311563238879d5074843e54890f6a9600e0
- MD5 82cc273fb76b81258befc62739d9a88a
- SHA1 46eb506b2fc4dcbab423614ad4bba2df313b6b63
- SHA512 2eb639a4400f7f3b2f0a72807f705236c1b25caa1b5bddd7b5cfd276280e3af8c8d95b3758db3668d89d11b2d963650ee17f145f8670905c9d777123aa9113cb
- SSDEEP 12288:GaPCg7A1nhLN9pqzmdJGl5Wn792pEqSGS:G+O1nhLNXgmdJGqUwGS
- TLSH T1E8C48E734105DE81FD4AB47F862DB07EC0E3B90A3AE1C52659D5C832E94AD4B84B9CDB
- MD5 SHA1 SHA512 SSDEEP TLSH