Analysis
- max time kernel
150s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/10/2026, 06:06
Behavioral task
behavioral1
Sample
2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe
- Size 832KB
- Sample261024-gt67paed48
- SHA256 4968fbb7d6580b73c1b82c17eadfb66ed0916f62ed5aa16c5dab4baa496cc3ec
- MD5 85e77b101a8cc5cdb09d075f60a44540
- SHA1 70dad3607c32b4fdc6376e44d55f0d0317e96e30
- SHA512 2de4fe38be8c89edabc7f81f367f3625ab916f60eb3b0fe360786f49dc570c4007f8b4a0e7fe357e2cd50dfd02979ab5356a5fcfa9dcbb82d54d60ba3ffffcdc
- SSDEEP 12288:Gnnzr6jU7RomhL5DNMuv1cmnIjvYf8mQCmlRvNm1A4bXu:Gnnzr0uRd7AnYszmne
- TLSH T1CD058D40796BB650E6A487BBA717C666031FA02C3E49DCE47020BBF6E9D2D335D147A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/memory/2900-0-0x0000000000400000-0x000000000040A000-memory.dmp family_cosmu behavioral2/files/0x000b00000001b2c5-2.dat family_cosmu behavioral2/files/0x00030000000003b3-5.dat family_cosmu behavioral2/memory/2900-493-0x0000000000400000-0x000000000040A000-memory.dmp family_cosmu - Detects executables packed with eXPressor 4 IoCs
resource yara_rule behavioral2/memory/2900-0-0x0000000000400000-0x000000000040A000-memory.dmp INDICATOR_EXE_Packed_eXPressor behavioral2/files/0x000b00000001b2c5-2.dat INDICATOR_EXE_Packed_eXPressor behavioral2/files/0x00030000000003b3-5.dat INDICATOR_EXE_Packed_eXPressor behavioral2/memory/2900-493-0x0000000000400000-0x000000000040A000-memory.dmp INDICATOR_EXE_Packed_eXPressor - Renames multiple (1970) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ja\PresentationFramework.resources.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\include\jni.h.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\bn.pak.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nl-nl.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\Common Files\System\ado\msadox.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.Primitives.resources.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationTypes.resources.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationTypes.resources.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationTypes.resources.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\fr\PresentationUI.resources.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Tools.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.Primitives.resources.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\PenImc_cor3.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\UIAutomationClientSideProviders.resources.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\Internet Explorer\hmmapi.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Xaml.resources.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\System.Windows.Controls.Ribbon.resources.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\lv.txt.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\or-IN\tipresx.dll.mui.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\Common Files\System\ado\msador28.tlb.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.AppContext.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.IsolatedStorage.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Net.WebSockets.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\rtscom.dll.mui.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tabskb.dll.mui.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordbi.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.DispatchProxy.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.Pkcs.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\PresentationFramework.resources.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\tr\System.Windows.Controls.Ribbon.resources.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationProvider.resources.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\UIAutomationProvider.resources.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\PresentationFramework.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\ne-NP\tipresx.dll.mui.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pl\System.Windows.Forms.Design.resources.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\uk.pak.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.tr-tr.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\dotnet.exe.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Net.WebProxy.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.Win32.SystemEvents.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Permissions.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pl\WindowsFormsIntegration.resources.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Xaml.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\WindowsBase.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\fr\WindowsFormsIntegration.resources.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fi-FI\tipresx.dll.mui.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationProvider.resources.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ja\UIAutomationClient.resources.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Principal.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Design.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\Common Files\System\ado\msado21.tlb.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XPath.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Xml.XPath.dll.tmp 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-22_85e77b101a8cc5cdb09d075f60a44540_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-4154726816-2055034831-2297277433-1000\desktop.ini.tmp
- Size 832KB
- SHA256 1004837686bfc91f977d1b3c0be3c143a9acfd985a058ac02b47f6e29743e32b
- MD5 08193953f7a048f9c0abb1dfff8dc1ac
- SHA1 f260a0855be951b6095332005077dbe3d45766aa
- SHA512 158c410f41a854c9a6c3b936e10720c9972705a6780df7c8693b4cd42485f7ceb3822ec46715e4985b4527154c5acce0c040fba7ae6c208927f6294c79848f7b
- SSDEEP 12288:Gnnzr6jU7RomhL5DNMuv1cmnIjvYf8mQCmlRvNm1A4bXV:Gnnzr0uRd7AnYszmnF
- TLSH T184058D40796BB650E6A487BBA717C666031FA02C3E49DCE47020BBF6E9D2D335D147A3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.chm.tmp
- Size 949KB
- SHA256 2b240037757d6c548d02f0fa1d958c23f1929390dde9ccfe2e08fc65b9a3a288
- MD5 51ff530dc72c6dba98abc477a68d834d
- SHA1 8bd8f819b0d24489b7ca733bebfdcff18dd1616a
- SHA512 2a75146d0be95b59985c11d7a322d2638f87b75cdd5f78716415302a32fcc7873a488e5c97690c5c037cf56d85e73aafaafe614e9d728d7e64000736737a6ddb
- SSDEEP 12288:Gnnzr6jU7RomhL5DNMuv1cmnIjvYf8mQCmlRvNm1A4bX6EqSGy:Gnnzr0uRd7AnYszmnKwGy
- TLSH T10A25AE407967B610E6A487BBA717C66E031BA02C3E49DCE47420BBF6E9D2D335D147A3
- MD5 SHA1 SHA512 SSDEEP TLSH