cosmu | f17c8fcb5581b880396d4815525d315ff6b11d202c22f5f06886660386fd014c

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 00:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe
Size 69KB
Sample260723-aferysxejf
SHA256 f17c8fcb5581b880396d4815525d315ff6b11d202c22f5f06886660386fd014c
MD5 35c5173457649ff700e629ee898010e3
SHA1 f3a783316ba9f7ff4c8b7bb6ae301eb8286e7b50
SHA512 41ea15a5364b1771cd7524c853c7b4cf9886b0d22faba35d3142ce0fdccf46624685599ab97a1ebce9282a2a5e7954b0921080da1fdc55cf1cd97676bf9cd889
SSDEEP 768:KI7BlphA7UbSrbhSK0s7OuU2NxAONxAnwwEHUOwwEHUlXCp+19pvQu19pvQc:z7ZhA7FSFgC2N2ON2r6de69pvQq9pvQc
TLSH
T1FB639D1E2D22F4F2D80D037990A572F7CD172EAF9971EAC86B1CEDA23139395552037A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery cosmu ransomware worm

Malware Config

Signatures

Family: Cosmu
Cosmu is a Windows worm written in C++.
worm cosmu

Detects Cosmu payload 4 IoCs

Cosmu is a worm written in C++.

resource	yara_rule
behavioral2/memory/4248-0-0x0000000000400000-0x0000000000408000-memory.dmp	family_cosmu
behavioral2/files/0x000f00000001b87e-2.dat	family_cosmu
behavioral2/files/0x000600000001b1c8-6.dat	family_cosmu
behavioral2/memory/4248-554-0x0000000000400000-0x0000000000408000-memory.dmp	family_cosmu

Renames multiple (4201) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp	2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Diagnostics.Process.dll.tmp	2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\ro.pak.tmp	2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.Win32.Primitives.dll.tmp	2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.AppContext.dll.tmp	2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Drawing.Design.dll.tmp	2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\Microsoft.VisualBasic.Forms.resources.dll.tmp	2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe
File created	C:\Program Files\Internet Explorer\de-DE\ieinstal.exe.mui.tmp	2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-synch-l1-2-0.dll.tmp	2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe.tmp	2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-ppd.xrm-ms.tmp	2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\am-ET\tipresx.dll.mui.tmp	2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Windows.dll.tmp	2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Input.Manipulations.resources.dll.tmp	2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\MEIPreload\preloaded_data.pb.tmp	2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\lib\psfont.properties.ja.tmp	2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-ul-oob.xrm-ms.tmp	2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.tmp	2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InkObj.dll.mui.tmp	2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\kk-KZ\tipresx.dll.mui.tmp	2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms.tmp	2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub_eula.txt.tmp	2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-locale-l1-1-0.dll.tmp	2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\local_policy.jar.tmp	2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md.tmp	2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md.tmp	2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\client_eula.txt.tmp	2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe
File created	C:\Program Files\Common Files\System\ado\msado26.tlb.tmp	2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\PresentationCore.resources.dll.tmp	2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.16.xml.tmp	2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Grace-ppd.xrm-ms.tmp	2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-pl.xrm-ms.tmp	2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Drawing.dll.tmp	2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Dynamic.Runtime.dll.tmp	2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Input.Manipulations.resources.dll.tmp	2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif.tmp	2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\zlib.md.tmp	2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\lib\javaws.jar.tmp	2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-pl.xrm-ms.tmp	2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Threading.Tasks.Dataflow.dll.tmp	2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ul-oob.xrm-ms.tmp	2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.DataIntegration.TransformDataByExample.dll.tmp	2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msaddsr.dll.mui.tmp	2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationClientSideProviders.resources.dll.tmp	2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerView.PowerView.x-none.msi.16.x-none.xml.tmp	2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mshwrwisp.dll.tmp	2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.dll.tmp	2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\server\classes.jsa.tmp	2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-string-l1-1-0.dll.tmp	2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationFramework.resources.dll.tmp	2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\D3DCompiler_47_cor3.dll.tmp	2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Controls.Ribbon.resources.dll.tmp	2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\WindowsBase.resources.dll.tmp	2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\WindowsBase.resources.dll.tmp	2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\WindowsBase.resources.dll.tmp	2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Diagnostics.PerformanceCounter.dll.tmp	2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jli.dll.tmp	2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-string-l1-1-0.dll.tmp	2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Grace-ul-oob.xrm-ms.tmp	2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ko-kr.dll.tmp	2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.ServicePoint.dll.tmp	2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Linq.Expressions.dll.tmp	2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\decora_sse.dll.tmp	2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_35c5173457649ff700e629ee898010e3_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini.tmp
Size 69KB
SHA256 02c1c9472b0f64d171360669285889d25466782c1d76c5174cb709973c5258d5
MD5 495e1c1303a324024f1910aad2698f4d
SHA1 6b895a189d4d9986f4c306cdebd376d31992c92c
SHA512 3c19f7d5626d45a421e913454d5a89ae83f25c447397cbd0135a6ee4885b2cc4485d58d702fb5115f7924ffa207974970740c11f0a8ca0dbeb7879a728dd65f6
SSDEEP 768:KI7BlphA7UbSrbhSK0s7OuU2NxAONxAnwwEHUOwwEHUlXCp+19pvQu19pvQr:z7ZhA7FSFgC2N2ON2r6de69pvQq9pvQr
TLSH
T1E9639D1E2D21F4F2D80D037990A572F7CD172EAF9971EAC9AB1CECA23139395552037A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7-zip.dll.tmp

Path C:\Program Files\7-Zip\7-zip.dll.tmp
Size 168KB
SHA256 c610fc48a5469db9be795633a6fdb44ae31fb6f0885aebe0aebcd7534d3574bb
MD5 b363ed6716b76fae3af1b4d02daacdde
SHA1 ee6a0158c702056ae8695ef2b22ca11f0cfb2009
SHA512 078d645d66a40fcb4bf2414d061940df5d5f85cce69b1405a800e0124aca67da6877029ac27019dde7caf961ef95469d4a4bc844ceeeef7a260b580a249aa058
SSDEEP 3072:Re7F6P2N2ON2/69poq9poM5ZMfTiu66I3UwqSsMBlsWb4A+Y:0Fj469poq9poeMfTinqncsWp+Y
TLSH
T1CBF349613C6EF6B0CE481339A96B6E83CF053D8F3C59CE82766869E3513CA950C575E2
MD5 SHA1 SHA512 SSDEEP TLSH