cosmu | bc61e630a5680b593479185559b5010337f9a04cd932cd58d20254d0057772c7

Analysis

max time kernel
150s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 19:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe
Size 88KB
Sample260723-ydhmtstyes
SHA256 bc61e630a5680b593479185559b5010337f9a04cd932cd58d20254d0057772c7
MD5 ff330010523f188612b28ffa7f5d6bad
SHA1 4f4df8e98c07136d47fccf71cdcd5407eccd71b9
SHA512 06c2b42869cf16bddf6ff3100883d486d416c47a611c36002e94ef5aaae84790965a329d443d410f0fb86cbf74f3281254882601bde2260bb4c5acbd86586cab
SSDEEP 384:GBt7Br5xjL8AgA71FbhvUf2OkxN2Okxj/zFd1vqFd1vqFFFIFFFseS:W7BlpQpARFbh2UM/zX1vqX1vAzWz0
TLSH
T13F93081EDFE744A3E399153938DAF47C58B2DA80777DECB9BA924CE98C90CB0561005B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery cosmu ransomware worm

Malware Config

Signatures

Family: Cosmu
Cosmu is a Windows worm written in C++.
worm cosmu

Detects Cosmu payload 2 IoCs

Cosmu is a worm written in C++.

resource	yara_rule
behavioral2/files/0x000a000000011390-1.dat	family_cosmu
behavioral2/files/0x000300000001b1d6-5.dat	family_cosmu

Renames multiple (4332) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red Violet.xml.tmp	2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui.tmp	2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee100.tlb.tmp	2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe
File created	C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui.tmp	2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe.tmp	2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe
File created	C:\Program Files\LimitResume.vsx.tmp	2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-string-l1-1-0.dll.tmp	2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ul-oob.xrm-ms.tmp	2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ul-oob.xrm-ms.tmp	2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Debug.dll.tmp	2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.DiagnosticSource.dll.tmp	2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationTypes.resources.dll.tmp	2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\lib\tzdb.dat.tmp	2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-ul-oob.xrm-ms.tmp	2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-ul-oob.xrm-ms.tmp	2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ppd.xrm-ms.tmp	2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-ppd.xrm-ms.tmp	2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Windows.dll.tmp	2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Presentation.dll.tmp	2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\splash.gif.tmp	2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-console-l1-1-0.dll.tmp	2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.16.xml.tmp	2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Georgia.xml.tmp	2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ul-oob.xrm-ms.tmp	2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-pl.xrm-ms.tmp	2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\offreg.dll.tmp	2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\tabskb.dll.mui.tmp	2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Metadata.dll.tmp	2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Runtime.Extensions.dll.tmp	2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\Microsoft.VisualBasic.dll.tmp	2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\splash_11-lic.gif.tmp	2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ppd.xrm-ms.tmp	2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql70.xsl.tmp	2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.tmp	2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui.tmp	2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\et-EE\tipresx.dll.mui.tmp	2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui.tmp	2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.dll.tmp	2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.FileSystem.dll.tmp	2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\OUTLOOK_WHATSNEW.XML.tmp	2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe
File created	C:\Program Files\7-Zip\Lang\mng2.txt.tmp	2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.dll.tmp	2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Diagnostics.EventLog.dll.tmp	2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\vcruntime140.dll.tmp	2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\javaws.policy.tmp	2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremDemoR_BypassTrial365-ppd.xrm-ms.tmp	2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-pl.xrm-ms.tmp	2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\.version.tmp	2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.Primitives.dll.tmp	2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationClient.resources.dll.tmp	2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe.tmp	2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\instrument.dll.tmp	2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win7_RTL.wmv.tmp	2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ul-phn.xrm-ms.tmp	2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\ecc.md.tmp	2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.tmp	2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Grace-ppd.xrm-ms.tmp	2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.AdHoc.Excel.Client.dll.tmp	2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe
File created	C:\Program Files\7-Zip\Lang\it.txt.tmp	2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe
File created	C:\Program Files\7-Zip\Lang\tr.txt.tmp	2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe.tmp	2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\Microsoft.DiaSymReader.Native.amd64.dll.tmp	2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Security.Cryptography.Cng.dll.tmp	2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationProvider.resources.dll.tmp	2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_ff330010523f188612b28ffa7f5d6bad_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-1738198120-2966725515-3980530802-1000\desktop.ini.tmp
Size 88KB
SHA256 83dc5cb82e3ea618174a089be3a38a568c55e76c635a8a4c110400f46b9851f3
MD5 e7c490d9fc77266d74197ba61d2facbb
SHA1 f909c8fcad7c107d4de3f1ae40a25f50fa086946
SHA512 7f01352cf11adcd747be8f7fb0a60a2c59bd152aa5ef20477dbfccd5594883490880e351d7c121a06d6dee3aaeca583445b40a6809beaa6ce76341cee3fa2c81
SSDEEP 384:GBt7Br5xjL8AgA71FbhvUf2OkxN2Okxj/zFd1vqFd1vqFFFIFFFseq:W7BlpQpARFbh2UM/zX1vqX1vAzWz8
TLSH
T10393071EDFE744A3E399153938DAF47C58B2DA80777DECB9BA924CE98C90CB0561005B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7-zip.dll.tmp

Path C:\Program Files\7-Zip\7-zip.dll.tmp
Size 187KB
SHA256 0368e7eaf1004053ae5af5f61dff1267ea63e6f4bdeaf85a7f7d977863a4773b
MD5 f5a6ad098dec0d5a30a13b1d823c64bc
SHA1 83533cb7cddf8c73f3baab3e77a2c926e976b91e
SHA512 a604d81a2fb99a3d4154e220cf129f2f5be9ead2a4836a90feb61e9df0a1a6fd11d38d33b718409e7ec80e1cea682b3e04791cb0701b830956ac533773fae573
SSDEEP 1536:W7ZQpAp05ZZl8gUTHCmn9DkH61O93UwqvX33xv/PosMFHiR5QBW4dP8tBUL3xb4U:6QWp05ZMfTiu66I3UwqSsMBlsWb4A+s
TLSH
T122140710BCAEF5A1CB4812396D5BBE8F82017A8B3E5DCD7676A205E38538CB10C574E7
MD5 SHA1 SHA512 SSDEEP TLSH