cosmu | cf4cb308ab774d5ee66725b91373f1863a682e1ef1acd8bfbe3d3e657da92b1f

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 23:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe
Size 85KB
Sample260722-3kf5ssswhy
SHA256 cf4cb308ab774d5ee66725b91373f1863a682e1ef1acd8bfbe3d3e657da92b1f
MD5 96c87a6390bf0cc4f9d70063986f5dd1
SHA1 624f0e295dd0edefee06af393a8cc492f444f7d1
SHA512 f5059dc3802352802454dcd3d47ac5824811e86c720b8cb6978aff503b21aa18d704a84629e747e1c7e8eac5a70b5d14f452fa3d32150b379c742e2c2806a304
SSDEEP 1536:z7ZhA7FSFgC2N2ON28mxmgMSFgC2N2ON28mxmgoL:Re7F6P2N2ON2I6P2N2ON2k
TLSH
T119839E3E3D25EAF2D16D03709463B8BC8473B465BEB0FEC197A239781561B90841CA2F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery cosmu ransomware worm

Malware Config

Signatures

Family: Cosmu
Cosmu is a Windows worm written in C++.
worm cosmu

Detects Cosmu payload 4 IoCs

Cosmu is a worm written in C++.

resource	yara_rule
behavioral2/memory/3672-0-0x0000000000400000-0x0000000000408000-memory.dmp	family_cosmu
behavioral2/files/0x0007000000011394-2.dat	family_cosmu
behavioral2/files/0x0009000000016bc9-6.dat	family_cosmu
behavioral2/memory/3672-552-0x0000000000400000-0x0000000000408000-memory.dmp	family_cosmu

Renames multiple (4389) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.tmp	2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ppd.xrm-ms.tmp	2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Grace-ul-oob.xrm-ms.tmp	2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeServiceBypassR_PrepidBypass-ul-oob.xrm-ms.tmp	2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.BackEnd.dll.tmp	2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Consolas-Verdana.xml.tmp	2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.Win32.Registry.dll.tmp	2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationUI.resources.dll.tmp	2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe.tmp	2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-2-0.dll.tmp	2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-pl.xrm-ms.tmp	2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-pl.xrm-ms.tmp	2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-ppd.xrm-ms.tmp	2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\UIAutomationProvider.resources.dll.tmp	2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe
File created	C:\Program Files\Internet Explorer\ieinstal.exe.tmp	2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-pl.xrm-ms.tmp	2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-ppd.xrm-ms.tmp	2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AUDIOSEARCHLTS.DLL.tmp	2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui.tmp	2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\id-ID\tipresx.dll.mui.tmp	2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Formats.Asn1.dll.tmp	2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-convert-l1-1-0.dll.tmp	2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\management\jmxremote.password.template.tmp	2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-memory-l1-1-0.dll.tmp	2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-private-l1-1-0.dll.tmp	2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTrial-ppd.xrm-ms.tmp	2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\orbd.exe.tmp	2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md.tmp	2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_PrepidBypass-ul-oob.xrm-ms.tmp	2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Document.dll.tmp	2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-math-l1-1-0.dll.tmp	2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\UIAutomationProvider.resources.dll.tmp	2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ppd.xrm-ms.tmp	2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XmlDocument.dll.tmp	2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Forms.Primitives.resources.dll.tmp	2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ko-kr.dll.tmp	2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Xml.dll.tmp	2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\msvcp140_1.dll.tmp	2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Grace-ppd.xrm-ms.tmp	2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Grace-ul-oob.xrm-ms.tmp	2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ul-phn.xrm-ms.tmp	2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_Subscription-pl.xrm-ms.tmp	2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-console-l1-1-0.dll.tmp	2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Extensions.dll.tmp	2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.IO.FileSystem.Watcher.dll.tmp	2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp	2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp	2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\attach.dll.tmp	2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe.tmp	2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Corbel.xml.tmp	2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll.tmp	2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe
File created	C:\Program Files\Common Files\System\wab32.dll.tmp	2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-convert-l1-1-0.dll.tmp	2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Drawing.Design.dll.tmp	2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\DirectWriteForwarder.dll.tmp	2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\localedata.jar.tmp	2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-pl.xrm-ms.tmp	2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-ppd.xrm-ms.tmp	2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.Brotli.dll.tmp	2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Forms.Design.resources.dll.tmp	2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Input.Manipulations.resources.dll.tmp	2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_96c87a6390bf0cc4f9d70063986f5dd1_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-3989226554-2204910950-1522900112-1000\desktop.ini.tmp
Size 85KB
SHA256 e578c560652d78e15f1d1e7d169e128f6bbabd8e3ab56cd2217a3629feaef75e
MD5 9b71f36c09630ebb7031abfb2e71b441
SHA1 62a3520964320301b3770669b77cb7b5b3e7a3cb
SHA512 184d32f0746c98c3855570390a10171410b4a8a0f85d34c38e4a0dc26194e253995851de8343611e7d6112f2ca8a13a5bc0e84b2d5c2ac172f5605c425144fd5
SSDEEP 1536:z7ZhA7FSFgC2N2ON28mxmgMSFgC2N2ON28mxmgoP:Re7F6P2N2ON2I6P2N2ON2U
TLSH
T193839E3E3D25E9F2D16D0370A463B8BC8437B465BEB0FED297A239781561B90541CA2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7-zip.dll.tmp

Path C:\Program Files\7-Zip\7-zip.dll.tmp
Size 184KB
SHA256 0e50cdf8482f8a2abdf325321f50ed0511cdb2ed002ba5c3d3619196e925d361
MD5 72748e402729391300edc76012c81962
SHA1 42eb2e6636bd13f1865d9f7085274db206b806fb
SHA512 c5ead99b212f3339d3227891a5266c55891c81b57510db47b1985cc647d145560d980d9d90ae5edefdbaaf839de3f137a27a12b116fcb9620f3b451965090bd3
SSDEEP 3072:Re7F6P2N2ON2I6P2N2ON2I5ZMfTiu66I3UwqSsMBlsWb4A+w:0Fj5j/MfTinqncsWp+w
TLSH
T1CB044A613C6EF6A0CB481379AC57AE8BC205398B3C69CE8276B525F3513CE910C5B5E7
MD5 SHA1 SHA512 SSDEEP TLSH