Analysis
- max time kernel
150s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/10/2026, 04:00
Behavioral task
behavioral1
Sample
2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe
- Size 96KB
- Sample261030-ek1bnswt2k
- SHA256 a762e0ed2018787158a31619208c804cd37348700b980bf870992c8ffb5fe769
- MD5 596154b56edc90f98c4cb5d7713a2300
- SHA1 aa7a15dd7350debde3a4f7f7f5bdfe8521651fe0
- SHA512 9683baf1419d446854c1085e16ae511ba6d12ebf56cb6ba19ed6e2eff13bbdbb2fbd29543a2aa3a0b5b429e864a2ce3c61c590080dc4b97ab78db28438cdd565
- SSDEEP 1536:R7ZppAp6qoplG9YDPecjLWzNoZPNTiLL5X5rpPpuiQ8C:7pWp6qobjWz+ZFTiPp7pup8C
- TLSH T1F0A37D0CDBC2D55DC2947031328FAD3E8AAE72E7BCE76847072CB5286F15396F50A865
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/memory/5460-0-0x0000000000400000-0x000000000040A000-memory.dmp family_cosmu behavioral2/files/0x000700000001b85a-2.dat family_cosmu behavioral2/files/0x00030000000003e7-5.dat family_cosmu behavioral2/memory/5460-770-0x0000000000400000-0x000000000040A000-memory.dmp family_cosmu - Detects executables packed with eXPressor 4 IoCs
resource yara_rule behavioral2/memory/5460-0-0x0000000000400000-0x000000000040A000-memory.dmp INDICATOR_EXE_Packed_eXPressor behavioral2/files/0x000700000001b85a-2.dat INDICATOR_EXE_Packed_eXPressor behavioral2/files/0x00030000000003e7-5.dat INDICATOR_EXE_Packed_eXPressor behavioral2/memory/5460-770-0x0000000000400000-0x000000000040A000-memory.dmp INDICATOR_EXE_Packed_eXPressor - Renames multiple (4432) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp 2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe File created C:\Program Files\Common Files\System\ado\msadomd28.tlb.tmp 2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationFramework.resources.dll.tmp 2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ul.xrm-ms.tmp 2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\OUTLLIBR.DLL.tmp 2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Xaml.resources.dll.tmp 2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Grace-ul-oob.xrm-ms.tmp 2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.tmp 2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe.tmp 2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_Grace-ul-oob.xrm-ms.tmp 2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-ppd.xrm-ms.tmp 2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOInstallerUI.dll.tmp 2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Grace-ul-oob.xrm-ms.tmp 2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.tmp 2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Primitives.dll.tmp 2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-pl.xrm-ms.tmp 2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.Design.resources.dll.tmp 2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.WindowsDesktop.App.deps.json.tmp 2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-time-l1-1-0.dll.tmp 2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-pl.xrm-ms.tmp 2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-pl.xrm-ms.tmp 2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\CONVERT\OLMAIL.FAE.tmp 2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\nb.txt.tmp 2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\WindowsFormsIntegration.resources.dll.tmp 2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe.tmp 2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\unicode.md.tmp 2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\fontconfig.bfc.tmp 2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-ppd.xrm-ms.tmp 2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp 2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\glib-lite.dll.tmp 2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ppd.xrm-ms.tmp 2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ppd.xrm-ms.tmp 2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe.tmp 2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe File created C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui.tmp 2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\mscordaccore.dll.tmp 2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationProvider.resources.dll.tmp 2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Input.Manipulations.resources.dll.tmp 2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.properties.src.tmp 2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Grace-ul-oob.xrm-ms.tmp 2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-ppd.xrm-ms.tmp 2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Presentation.dll.tmp 2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jmc.txt.tmp 2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.Common.FrontEnd.XmlSerializers.dll.tmp 2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\Microsoft.DiaSymReader.Native.amd64.dll.tmp 2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\WindowsBase.resources.dll.tmp 2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jpeg.dll.tmp 2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ppd.xrm-ms.tmp 2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-pl.xrm-ms.tmp 2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp 2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\java.policy.tmp 2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-pl.xrm-ms.tmp 2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-ppd.xrm-ms.tmp 2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-ppd.xrm-ms.tmp 2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\XLINTL32.DLL.tmp 2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-handle-l1-1-0.dll.tmp 2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemDrawing.dll.tmp 2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationClientSideProviders.dll.tmp 2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-root-bridge-test.xrm-ms.tmp 2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\CONVERT\1033\TRANSMRR.DLL.tmp 2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\PresentationFramework.resources.dll.tmp 2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\dtplugin\npdeployJava1.dll.tmp 2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Forms.resources.dll.tmp 2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ul-oob.xrm-ms.tmp 2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Grace-ul-oob.xrm-ms.tmp 2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-28_596154b56edc90f98c4cb5d7713a2300_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1404337215-1550464601-2805570857-1000\desktop.ini.tmp
- Size 96KB
- SHA256 c700f383bec5d4a121e7591143205163f05e472566353fd19f374f0bd753e2fb
- MD5 81d3abfe6086bc7bae3215cf1612a64e
- SHA1 abf8a1cd0816f34dfb60e6f33160842b3ea255f2
- SHA512 70ffbd961b3fc1cfd1f5f0a67d2cfb6d620ec5c1640a517b14be9e7c1f5266e8be3a7e9e9906cbb26a428c243cfca1eb5316755ce60344e13a6a8fe2786c3aee
- SSDEEP 1536:R7ZppAp6qoplG9YDPecjLWzNoZPNTiLL5X5rpPpuiQ8g:7pWp6qobjWz+ZFTiPp7pup8g
- TLSH T101A37D0CDBC2D55DC2947031328FAD2E8AAE72E7BDE76847072CB5286F14396F50A865
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.chm.tmp
- Size 213KB
- SHA256 055a4327b02b8288866f1f11a2690aaacf78f581857ab28d9b2376e92dbca6e6
- MD5 deb34f828280b790176c8bc39350f2ab
- SHA1 27393835320a5ef1677a084189ce645cfc860c36
- SHA512 584c0fa9f22154375baab5239939265db1b9134cbbc0cf056624c20041ebfbf303bd1074df9e1197149b4fb626497cb9adc74bda1511bc86a4e8a3b4ba76d4e2
- SSDEEP 3072:7pWp6qobjWz+ZFTiPp7pup8YwxMxdrwdaEMePCUlZVpnwzuGSsOOO2:0qbjn+xMdwxMxFELMO9wapsOZ2
- TLSH T1F724E10DEBC1D558C2912131328FAD3FABAA32D77CE798430F5DF61C2B5439AB10A466
- MD5 SHA1 SHA512 SSDEEP TLSH