Analysis
- max time kernel
150s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/10/2026, 22:57
Behavioral task
behavioral1
Sample
2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe
- Size 980KB
- Sample261024-2xdprsew7p
- SHA256 d6b922a1d0a6eda6920e0a5d6dc478cfffef1cbe7b6c042721b3c375ac1c8cc2
- MD5 045301a8b0166221520cf0e9a0a7c431
- SHA1 da5c1238abe51443df73d79ad69dea50223e3d57
- SHA512 1750d4c7f2d4e0e756ccd352b9caa560a5554d240a4582e714352366a36706e02a0cc42d12efb176f3afe3582d195d00d0d162a26325c8a149df771dab0b6f45
- SSDEEP 24576:GFqje6yrOtkQuF5bjtzQWwN0t+l+Lp0rlK+Rl:GFxrOmQuF5bjtzQWwNC+l+Lp0rlK+Rl
- TLSH T1E4254D5D2B63EAF1F3D896354DA7C55CCC27430EAD24603CE0B61A36B39DE78E824196
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/memory/5136-0-0x0000000000400000-0x000000000040A000-memory.dmp family_cosmu behavioral2/files/0x001800000000a619-2.dat family_cosmu behavioral2/files/0x000300000000039a-5.dat family_cosmu behavioral2/memory/5136-458-0x0000000000400000-0x000000000040A000-memory.dmp family_cosmu - Detects executables packed with eXPressor 4 IoCs
resource yara_rule behavioral2/memory/5136-0-0x0000000000400000-0x000000000040A000-memory.dmp INDICATOR_EXE_Packed_eXPressor behavioral2/files/0x001800000000a619-2.dat INDICATOR_EXE_Packed_eXPressor behavioral2/files/0x000300000000039a-5.dat INDICATOR_EXE_Packed_eXPressor behavioral2/memory/5136-458-0x0000000000400000-0x000000000040A000-memory.dmp INDICATOR_EXE_Packed_eXPressor - Renames multiple (1832) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.OpenSsl.dll.tmp 2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\quz-PE\tipresx.dll.mui.tmp 2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe File created C:\Program Files\Common Files\System\uk-UA\wab32res.dll.mui.tmp 2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOLoader.dll.tmp 2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.Primitives.dll.tmp 2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\UIAutomationClientSideProviders.resources.dll.tmp 2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\tr\ReachFramework.resources.dll.tmp 2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe.tmp 2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sl-si.dll.tmp 2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msdaremr.dll.mui.tmp 2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Diagnostics.Tracing.dll.tmp 2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Net.WebProxy.dll.tmp 2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\WindowsFormsIntegration.resources.dll.tmp 2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp 2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\PresentationUI.resources.dll.tmp 2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp 2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.tmp 2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml.tmp 2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Encoding.dll.tmp 2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationProvider.resources.dll.tmp 2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\System.Windows.Input.Manipulations.resources.dll.tmp 2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\IwaKeyDistribution\iwa-key-distribution.pb.tmp 2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\kk.txt.tmp 2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Windows.dll.tmp 2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.IO.Compression.Brotli.dll.tmp 2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Forms.Design.resources.dll.tmp 2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.DirectoryServices.dll.tmp 2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipRes.dll.mui.tmp 2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.Primitives.resources.dll.tmp 2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui.tmp 2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.dll.tmp 2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationUI.resources.dll.tmp 2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp 2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\UIAutomationClient.resources.dll.tmp 2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\sk.pak.tmp 2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe File created C:\Program Files\7-Zip\readme.txt.tmp 2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\gl-ES\tipresx.dll.mui.tmp 2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.ReaderWriter.dll.tmp 2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Numerics.Vectors.dll.tmp 2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\System.Windows.Input.Manipulations.resources.dll.tmp 2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Windows.Forms.Primitives.dll.tmp 2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_100_percent.pak.tmp 2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipTsf.dll.mui.tmp 2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml.tmp 2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Contracts.dll.tmp 2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.ComponentModel.dll.tmp 2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\UIAutomationProvider.resources.dll.tmp 2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.dll.tmp 2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationProvider.resources.dll.tmp 2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\Microsoft.VisualBasic.Forms.resources.dll.tmp 2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\ReachFramework.resources.dll.tmp 2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordaccore_amd64_amd64_7.0.1624.6629.dll.tmp 2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.NameResolution.dll.tmp 2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Security.dll.tmp 2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Text.RegularExpressions.dll.tmp 2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe File created C:\Program Files\7-Zip\7z.dll.tmp 2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\InkObj.dll.mui.tmp 2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.ComponentModel.Primitives.dll.tmp 2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Aero.dll.tmp 2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Xaml.resources.dll.tmp 2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.CodeDom.dll.tmp 2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\fr\WindowsFormsIntegration.resources.dll.tmp 2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\hi.pak.tmp 2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.tr-tr.dll.tmp 2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-22_045301a8b0166221520cf0e9a0a7c431_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2304238888-3968896904-642854331-1000\desktop.ini.tmp
- Size 980KB
- SHA256 ebc0c3cd3e9f21b94cdef17940a148f2fc678e8ee2b6ffce5213befe3d1bb9a0
- MD5 e041c1a6d00fd7e955455977f9445bbe
- SHA1 7eec8346978080af82c3d3a0cf9963fe3af275a9
- SHA512 70be4a529264c62e8736770759e4c7614c9a7df0384bc895dee2016526c5ad15ea56659664cd23c74fec72d0e2f95ea62181a6fb58206708dd7b1856f3c5a8b8
- SSDEEP 24576:GFqje6yrOtkQuF5bjtzQWwN0t+l+Lp0rlK+Rm:GFxrOmQuF5bjtzQWwNC+l+Lp0rlK+Rm
- TLSH T144254D5D2B63EAF1F3D896354DA7C55CCC27430EAD24603CE0B61A36B39DE78E824196
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.chm.tmp
- Size 1.1MB
- SHA256 a5c0121f7e965404ea92a347014623430e0f2f1226a737a5aba63095b71dfda6
- MD5 35a76053cd3d4b1f1b73448f0e17b736
- SHA1 82777d73ef807fc4c43626f06ba2d0f0986bb79e
- SHA512 836bc041745640050340f87b26d12c6e3b8228cb2f0927f0ecf27cede92b2dc763ca695ae80f4f896c55e86a786c1bf38e8731f52d40cae768969d1bc763f9dc
- SSDEEP 24576:GFqje6yrOtkQuF5bjtzQWwN0t+l+Lp0rlK+RYwGt:GFxrOmQuF5bjtzQWwNC+l+Lp0rlK+RYn
- TLSH T156356D5D2B63EAF1F3D896354D97C55CCC27430EAD24603CE0B61A36B3ADE78E824196
- MD5 SHA1 SHA512 SSDEEP TLSH