Analysis
- max time kernel
150s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/11/2026, 03:58
Behavioral task
behavioral1
Sample
2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe
- Size 42KB
- Sample261105-ejp5baw1hs
- SHA256 4c6e1e9666ccf81ccd3a8b3b61e2b575c9f1a022be6d226df2db5437e8499335
- MD5 fb12d16183de0c98c6ee05504f7b4b87
- SHA1 99440f9d41ffd94f3a56d38d77b6a4f1f028ab22
- SHA512 96d5d327028a2da2aae138d88906245645af6c3a2ec4af69f076d60ee367eeea1220145d0d2b05e07a630ff5650b1f51001d07f68b50bbe7c39c91ce74561012
- SSDEEP 768:R7BlpppARFbh6qS+pim22/5Jmwd0V6/gwrclJDZJD+Ys9mg:R7ZppAp6qFpf5Jmwd0V6nglJDZJD+YVg
- TLSH T19C138D0E1617E023E2554130A97B6578947BA03A7F19EF6BEB06BD2EB8616D0D83C05B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/memory/5828-0-0x0000000000400000-0x000000000040A000-memory.dmp family_cosmu behavioral2/files/0x000600000001b859-2.dat family_cosmu behavioral2/files/0x00030000000003ae-5.dat family_cosmu behavioral2/memory/5828-808-0x0000000000400000-0x000000000040A000-memory.dmp family_cosmu - Detects executables packed with eXPressor 4 IoCs
resource yara_rule behavioral2/memory/5828-0-0x0000000000400000-0x000000000040A000-memory.dmp INDICATOR_EXE_Packed_eXPressor behavioral2/files/0x000600000001b859-2.dat INDICATOR_EXE_Packed_eXPressor behavioral2/files/0x00030000000003ae-5.dat INDICATOR_EXE_Packed_eXPressor behavioral2/memory/5828-808-0x0000000000400000-0x000000000040A000-memory.dmp INDICATOR_EXE_Packed_eXPressor - Renames multiple (4878) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Net.Security.dll.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Internet Explorer\en-US\hmmapi.dll.mui.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngom.md.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\freebxml.md.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationClientSideProviders.dll.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\tr.pak.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ul-phn.xrm-ms.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\offsymk.ttf.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.JavaScript.dll.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.VisualBasic.dll.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ul-oob.xrm-ms.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\WindowsBase.resources.dll.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\ReachFramework.resources.dll.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremDemoR_BypassTrial365-ppd.xrm-ms.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\TellMeOutlookMailRead.nrr.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.ReportingServices.QueryDesigners.Extensions.dll.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tipresx.dll.mui.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\PresentationFramework.resources.dll.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-heap-l1-1-0.dll.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\msvcp140.dll.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages.properties.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-pl.xrm-ms.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-pl.xrm-ms.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL.HXS.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\fr.txt.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationTypes.resources.dll.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019DemoR_BypassTrial180-ppd.xrm-ms.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\EXITEML.ICO.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-80.png.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\Microsoft.WindowsDesktop.App.runtimeconfig.json.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ppd.xrm-ms.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.HttpListener.dll.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\Microsoft.Win32.SystemEvents.dll.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\sunmscapi.dll.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-ppd.xrm-ms.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_COL.HXT.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\7-Zip\Lang\el.txt.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.EventLog.dll.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.Pkcs.dll.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationTypes.dll.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\UIAutomationTypes.resources.dll.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ul-phn.xrm-ms.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ul-phn.xrm-ms.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\UIAutomationClientSideProviders.resources.dll.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Internet Explorer\uk-UA\iexplore.exe.mui.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\gstreamer-lite.dll.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\TellMeOutlookMail.nrr.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe.config.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PMAILEXT.ECF.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.reportviewer.common.dll.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt-BR\msipc.dll.mui.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipTsf.dll.mui.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\PresentationCore.resources.dll.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\PresentationUI.resources.dll.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\ru.pak.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\vcruntime140.dll.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-pl.xrm-ms.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-ppd.xrm-ms.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.ILGeneration.dll.tmp 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-11-04_fb12d16183de0c98c6ee05504f7b4b87_elex_wannacry.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1704430598-3087477806-3297458608-1000\desktop.ini.tmp
- Size 42KB
- SHA256 80a32d92c113accd8e22891a8123863432d9c4f05866b0968c12aec5023cbd7a
- MD5 b456f66b259a139685b5ede434e73bb1
- SHA1 36e5e19a3ebe06d1eaf00be5944df3e4494efc5f
- SHA512 f4244ca30d011e3632661b7ea710e39f3df07a7ae47c36ba06f9b6d9c2d057b8fea06064c96451d64652cbb044f9616ab286fc92e54ad55669cc72e0bbd2b95c
- SSDEEP 768:R7BlpppARFbh6qS+pim22/5Jmwd0V6/gwrclJDZJD+Ys9mu:R7ZppAp6qFpf5Jmwd0V6nglJDZJD+YVu
- TLSH T15D138E0E1617E023E2554130A97B7578947BA0397F19EF67EF16BD2EB8612D0D83C06B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.chm.tmp
- Size 159KB
- SHA256 61599a7c700e4391ac791490dbacbb3bd20a95cbe7cf2b73c358abd7c907a9be
- MD5 912ae67700331281421a536696bbdc23
- SHA1 e729a57631272136048b7abed67bc9c3d9fc7f03
- SHA512 664966125fee4db67cf2872ccc7eba29363cd4e578f0d4241d1f280c66175869e47f57b56121c1c70cee485590445ee4bc4784e55aa604ce83a092b42118ce7f
- SSDEEP 3072:7pWp6qFx/0ongPMGwxMxdrwdaEMePCUlZVpnwzuGSsOOOK:0HxJMTwxMxFELMO9wapsOZK
- TLSH T13AF3025A2696A022D616423462A3A43E7373685A3F05CF52FF4BFA0F75B17D4B43C12B
- MD5 SHA1 SHA512 SSDEEP TLSH