Analysis
- max time kernel
150s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/10/2026, 06:06
Behavioral task
behavioral1
Sample
2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe
- Size 832KB
- Sample261024-gt67paed48
- SHA256 4968fbb7d6580b73c1b82c17eadfb66ed0916f62ed5aa16c5dab4baa496cc3ec
- MD5 85e77b101a8cc5cdb09d075f60a44540
- SHA1 70dad3607c32b4fdc6376e44d55f0d0317e96e30
- SHA512 2de4fe38be8c89edabc7f81f367f3625ab916f60eb3b0fe360786f49dc570c4007f8b4a0e7fe357e2cd50dfd02979ab5356a5fcfa9dcbb82d54d60ba3ffffcdc
- SSDEEP 12288:Gnnzr6jU7RomhL5DNMuv1cmnIjvYf8mQCmlRvNm1A4bXu:Gnnzr0uRd7AnYszmne
- TLSH T1CD058D40796BB650E6A487BBA717C666031FA02C3E49DCE47020BBF6E9D2D335D147A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral1/memory/720-0-0x0000000000400000-0x000000000040A000-memory.dmp family_cosmu behavioral1/files/0x000a00000002426f-2.dat family_cosmu behavioral1/files/0x000800000001e53a-5.dat family_cosmu behavioral1/memory/720-607-0x0000000000400000-0x000000000040A000-memory.dmp family_cosmu - Custom signatureDetects executables packed with eXPressor 4 IoCs
resource yara_rule behavioral1/memory/720-0-0x0000000000400000-0x000000000040A000-memory.dmp INDICATOR_EXE_Packed_eXPressor behavioral1/files/0x000a00000002426f-2.dat INDICATOR_EXE_Packed_eXPressor behavioral1/files/0x000800000001e53a-5.dat INDICATOR_EXE_Packed_eXPressor behavioral1/memory/720-607-0x0000000000400000-0x000000000040A000-memory.dmp INDICATOR_EXE_Packed_eXPressor - Renames multiple (2592) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\optimization_guide_internal.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\giflib.md.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Ping.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.ZipFile.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\PresentationUI.resources.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\PresentationFramework.resources.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\Internet Explorer\ja-JP\iexplore.exe.mui.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xalan.md.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\webkit.md.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Memory.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Xml.Linq.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-synch-l1-1-0.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\blacklisted.certs.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\gstreamer.md.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\j2pkcs11.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\ru.txt.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\tabskb.dll.mui.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\Common Files\System\msadc\msdarem.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\System.Windows.Forms.Primitives.resources.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.CodeDom.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\UIAutomationProvider.resources.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\asm.md.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\gstreamer-lite.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightRegular.ttf.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Http.Json.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.NetworkInformation.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\ReachFramework.resources.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationClientSideProviders.resources.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\WindowsFormsIntegration.resources.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\PresentationCore.resources.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\Internet Explorer\ExtExport.exe.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.th-th.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Diagnostics.Contracts.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Reflection.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\bcel.md.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\java.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\ext\meta-index.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\an.txt.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\is.txt.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Reflection.Emit.Lightweight.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Security.Cryptography.X509Certificates.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.PerformanceCounter.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationUI.resources.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ja\System.Windows.Forms.Design.resources.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\wpfgfx_cor3.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tipresx.dll.mui.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\Microsoft.VisualBasic.Forms.resources.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Xaml.resources.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\UIAutomationProvider.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-profile-l1-1-0.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\TabTip.exe.mui.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\Common Files\System\msadc\msadds.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Net.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.VisualBasic.Forms.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Xaml.resources.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationClient.resources.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-240542094-4193773837-3211495583-1000\desktop.ini.tmp
- Size 832KB
- SHA256 68df569797deee788766d7427a6de3616a2426d1176a3545cfa94d8592222f85
- MD5 1b9b1adfd3bd92341ea5f1fe847a4bc6
- SHA1 48921e3fb5053379a26bc4f078bf52e15bbd5593
- SHA512 a78e114f34d3c2a766179a6a164e3621e6352ac5048164bdd6c1149f344c43888ae9edeba4606d14f4368bd9233595897953fcf7fef61f5c30c8b9482eeae127
- SSDEEP 12288:Gnnzr6jU7RomhL5DNMuv1cmnIjvYf8mQCmlRvNm1A4bXM:Gnnzr0uRd7AnYszmnc
- TLSH T186058D40796BB650E6A487BBA717C666031FA02C3E49DCE47020BBF6E9D2D335D147A3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.chm.tmp
- Size 949KB
- SHA256 e1036c3abbbcac5c6fd7f30290fea9c97099b1ecef8d3d1f9b058a75b80e2d8b
- MD5 e41f1e896d80d14d6323236fd09d8baf
- SHA1 a18984046d8f4655f2575d768803703e5368035c
- SHA512 1e91fa3976c8d2dba0e52ae4306ebd4aeb7ccb1f1083eecbdf5d3792dcd424162a071bcc5714e7added0411c06a8287d539fa1d0ed2dff4e392c5337b70f6ac1
- SSDEEP 12288:Gnnzr6jU7RomhL5DNMuv1cmnIjvYf8mQCmlRvNm1A4bXSEqSGy:Gnnzr0uRd7AnYszmnCwGy
- TLSH T16E25AE407967B610E6A487BBA717C66E031BA02C3E49DCE47420BBF6E9D2D335D147A3
- MD5 SHA1 SHA512 SSDEEP TLSH