Analysis
- max time kernel
150s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
05/11/2026, 03:58
Behavioral task
behavioral1
Sample
2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe
- Size 42KB
- Sample261105-ejp5baw1hs
- SHA256 4c6e1e9666ccf81ccd3a8b3b61e2b575c9f1a022be6d226df2db5437e8499335
- MD5 fb12d16183de0c98c6ee05504f7b4b87
- SHA1 99440f9d41ffd94f3a56d38d77b6a4f1f028ab22
- SHA512 96d5d327028a2da2aae138d88906245645af6c3a2ec4af69f076d60ee367eeea1220145d0d2b05e07a630ff5650b1f51001d07f68b50bbe7c39c91ce74561012
- SSDEEP 768:R7BlpppARFbh6qS+pim22/5Jmwd0V6/gwrclJDZJD+Ys9mg:R7ZppAp6qFpf5Jmwd0V6nglJDZJD+YVg
- TLSH T19C138D0E1617E023E2554130A97B6578947BA03A7F19EF6BEB06BD2EB8616D0D83C05B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral1/memory/3008-0-0x0000000000400000-0x000000000040A000-memory.dmp family_cosmu behavioral1/files/0x000a00000002434a-2.dat family_cosmu behavioral1/files/0x000200000001e56d-5.dat family_cosmu behavioral1/memory/3008-800-0x0000000000400000-0x000000000040A000-memory.dmp family_cosmu - Detects executables packed with eXPressor 4 IoCs
resource yara_rule behavioral1/memory/3008-0-0x0000000000400000-0x000000000040A000-memory.dmp INDICATOR_EXE_Packed_eXPressor behavioral1/files/0x000a00000002434a-2.dat INDICATOR_EXE_Packed_eXPressor behavioral1/files/0x000200000001e56d-5.dat INDICATOR_EXE_Packed_eXPressor behavioral1/memory/3008-800-0x0000000000400000-0x000000000040A000-memory.dmp INDICATOR_EXE_Packed_eXPressor - Renames multiple (5157) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\VGX\VGX.dll.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Tools.dll.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Numerics.dll.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationTypes.resources.dll.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Office Theme.thmx.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Common Files\System\Ole DB\msdaosp.dll.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Interop.MSDASC.dll.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xerces.md.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTest-ppd.xrm-ms.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ul.xrm-ms.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\cs\System.Windows.Forms.resources.dll.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\sunec.dll.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-pl.xrm-ms.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-pl.xrm-ms.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCONTROL.DLL.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Linq.Queryable.dll.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Resources.Extensions.dll.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-ul-oob.xrm-ms.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-ppd.xrm-ms.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\TellMeOneNote.nrr.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msproof7.dll.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-heap-l1-1-0.dll.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.dll.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.ValueTuple.dll.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pl\PresentationCore.resources.dll.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\libEGL.dll.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\fontmanager.dll.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL117.XML.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.dll.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-ppd.xrm-ms.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\BCSRuntimeRes.dll.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\IGX.DLL.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordaccore.dll.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Runtime.Serialization.dll.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\invalid32x32.gif.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-ppd.xrm-ms.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\GRLEX.DLL.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-80.png.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-100.png.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\NPSPWRAP.DLL.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationClientSideProviders.resources.dll.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\jawt.dll.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\msvcp140_2.dll.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.outlookmui.msi.16.en-us.xml.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-100.png.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\sbicuuc53_64.dll.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tipresx.dll.mui.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ul-phn.xrm-ms.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\MidgardStrings.json.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\CONVERT\1033\OLR.SAM.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\Library\EUROTOOL.XLAM.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\DRUMROLL.WAV.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Input.Manipulations.resources.dll.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Grace-ul-oob.xrm-ms.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-ppd.xrm-ms.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-pl.xrm-ms.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2101206053-1414382737-268919432-1000\desktop.ini.tmp
- Size 42KB
- SHA256 8d898f514c98e305d11a3984f2db986e72b24bfaf3e5599f7d5cce96c6be1dab
- MD5 b9ba5385d723965f7f5d68407bede82e
- SHA1 502cc6e68776114e18dd1710dd056f917b0a14ff
- SHA512 0a18de5ae2d0317e410b2ff55bed02e67b3a5a2f0c6678930a55212d0a17e3ca66d2879ecf615ecd7c66b5a96de8174e919cb2b22f6691b1c7ce24112e0a4b07
- SSDEEP 768:R7BlpppARFbh6qS+pim22/5Jmwd0V6/gwrclJDZJD+Ys9me:R7ZppAp6qFpf5Jmwd0V6nglJDZJD+YVe
- TLSH T137138E0E1617E023E2554130A97B7578947BA0397F19EFA7EF16BD2EB8612D0D83C06B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.chm.tmp
- Size 159KB
- SHA256 5401c916d1680f7e40f70846ddf685a7b70572d058e67aed7437ffe85d035818
- MD5 b5e597146476bebf93ccb475e6bfd0a4
- SHA1 aafddee17f9b158a0da27f2823922f9b8be7f316
- SHA512 460b4e07373c66b8e8d187873d158101138e8dfddc69b9442e8ad446323ab724aef01854471da3649ff09fe4cca9b4d289c9391b601fc834ddefc11a9f002da3
- SSDEEP 3072:7pWp6qFx/0ongP4wxMxdrwdaEMePCUlZVpnwzuGSsOOOK:0HxJM4wxMxFELMO9wapsOZK
- TLSH T1AFF3025A2696A022D616023462A3A43E7373685A3F05CF52FF4BFA0F75B17D4B43C12B
- MD5 SHA1 SHA512 SSDEEP TLSH