Analysis
- max time kernel
150s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/11/2026, 14:09
Behavioral task
behavioral1
Sample
2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe
- Size 76KB
- Sample261104-rf5rtaxs5k
- SHA256 82b7bed406fb160bffa698079186adc45278e1ad3436980b8b07c969651ca35f
- MD5 8e1887214ef3ca76f5e05bb86fe97382
- SHA1 59560c49e57f44571490d4fed4ce3da42c85a0b3
- SHA512 e4c54d9c76058a8e77968a7b070bf3463c31d1a0c56f2d0e61003dab5bfc71477424d9ecc590ba2e2616324f671d64783a778449fb176ff132032d73323a310a
- SSDEEP 768:R7BlpppARFbh6qS+pim269O7X7vX9O7X7vAiuyIEd7gNZ:R7ZppAp6qFpaMIwYZ
- TLSH T13A7384C9795FF789E24A6030D91317BE0EB694176E608ACBB78DF4EC6761AD0F01C026
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/memory/4644-0-0x0000000000400000-0x000000000040A000-memory.dmp family_cosmu behavioral2/files/0x000700000001b85a-2.dat family_cosmu behavioral2/files/0x00030000000003e7-5.dat family_cosmu behavioral2/memory/4644-781-0x0000000000400000-0x000000000040A000-memory.dmp family_cosmu - Detects executables packed with eXPressor 4 IoCs
resource yara_rule behavioral2/memory/4644-0-0x0000000000400000-0x000000000040A000-memory.dmp INDICATOR_EXE_Packed_eXPressor behavioral2/files/0x000700000001b85a-2.dat INDICATOR_EXE_Packed_eXPressor behavioral2/files/0x00030000000003e7-5.dat INDICATOR_EXE_Packed_eXPressor behavioral2/memory/4644-781-0x0000000000400000-0x000000000040A000-memory.dmp INDICATOR_EXE_Packed_eXPressor - Renames multiple (4433) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe.tmp 2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.Design.resources.dll.tmp 2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\WindowsBase.resources.dll.tmp 2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Xaml.resources.dll.tmp 2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Grace-ul-oob.xrm-ms.tmp 2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\invalid32x32.gif.tmp 2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-pl.xrm-ms.tmp 2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.ComponentModel.Annotations.dll.tmp 2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\WindowsBase.resources.dll.tmp 2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe.tmp 2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Trial-pl.xrm-ms.tmp 2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WORD_WHATSNEW.XML.tmp 2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\HarvardAnglia2008OfficeOnline.xsl.tmp 2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.es-es.dll.tmp 2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.TypeConverter.dll.tmp 2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.DataContractSerialization.dll.tmp 2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Grace-ul-oob.xrm-ms.tmp 2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ppd.xrm-ms.tmp 2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordVL_KMS_Client-ul-oob.xrm-ms.tmp 2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationClient.resources.dll.tmp 2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\System.Windows.Forms.Design.resources.dll.tmp 2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\mshwstaging.dll.tmp 2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp 2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\WindowsFormsIntegration.resources.dll.tmp 2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\cmm\CIEXYZ.pf.tmp 2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\ga.txt.tmp 2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Sockets.dll.tmp 2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\WindowsFormsIntegration.resources.dll.tmp 2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\gu.pak.tmp 2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-localization-l1-2-0.dll.tmp 2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\j2gss.dll.tmp 2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ul-oob.xrm-ms.tmp 2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui.tmp 2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebClient.dll.tmp 2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Net.Requests.dll.tmp 2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Gothic.xml.tmp 2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ul-phn.xrm-ms.tmp 2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Exchange.WebServices.dll.tmp 2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml.tmp 2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\zh-TW.pak.tmp 2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Gill Sans MT.xml.tmp 2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-pl.xrm-ms.tmp 2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue.xml.tmp 2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Frosted Glass.eftx.tmp 2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\id.txt.tmp 2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui.tmp 2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.SecureString.dll.tmp 2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\System.Xaml.resources.dll.tmp 2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe File created C:\Program Files\7-Zip\License.txt.tmp 2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\ga-IE\tipresx.dll.mui.tmp 2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.TypeExtensions.dll.tmp 2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationClient.resources.dll.tmp 2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\Microsoft.WindowsDesktop.App.deps.json.tmp 2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ppd.xrm-ms.tmp 2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationUI.resources.dll.tmp 2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunjce_provider.jar.tmp 2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md.tmp 2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntime2019R_PrepidBypass-ul-oob.xrm-ms.tmp 2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Grace-ppd.xrm-ms.tmp 2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\sq.txt.tmp 2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_LinkDrop32x32.gif.tmp 2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.dll.tmp 2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe.tmp 2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-pl.xrm-ms.tmp 2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-11-03_8e1887214ef3ca76f5e05bb86fe97382_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1404337215-1550464601-2805570857-1000\desktop.ini.tmp
- Size 76KB
- SHA256 0d53389f42c5eb253d75d83a67d0d74d96f46cdc1839790a32f3c2a249796be8
- MD5 6037fdc311a33421f92d0e92c049337e
- SHA1 57320ff89c9e13868ed2ee42d476e60664b20b0f
- SHA512 340562288707fed1f2345432abc0942f70002d05a2b0323faf8030f87f1065cdc44b7d5cdd9b2c959987bd784b1e8d003282114d102694d6f4e71ed47b1de4b3
- SSDEEP 768:R7BlpppARFbh6qS+pim269O7X7vX9O7X7vAiuyIEd7gNR:R7ZppAp6qFpaMIwYR
- TLSH T1D17385C9796FF789E24A6030D91317BE0EB690176E6086CBB79DF4EC6761AD0F41C026
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.chm.tmp
- Size 194KB
- SHA256 7512822e399bc7e78e90d6bd699e472a1530dce4251d737f7bd2b6b807862908
- MD5 a4a2f93b1e71cd1bd7826e06d9f7df92
- SHA1 0aafeba8bf9b98d1dc22d3fc81d83ad33608f097
- SHA512 793f6da5ec8c92a3efe1f87bdfd15f889a54046cf1cd871b9ec7c0b3e4b71abb85029897f03444c7b60508a7ecc9c3960edd49bb72f91c29d539fb41126c475c
- SSDEEP 3072:7pWp6qF8vgwxMxdrwdaEMePCUlZVpnwzuGSsOOOH:0H8YwxMxFELMO9wapsOZH
- TLSH T1771426C979AFF789E60A2034D513577E1EB694172E108ACBBB8EF4DC6761AD4F01C026
- MD5 SHA1 SHA512 SSDEEP TLSH