cosmu | db5d795df01e0794ae389bccf4e224b97e668a690164dedd70d2853e566a1646

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 09:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe
Size 54KB
Sample260724-lb35jafd55
SHA256 db5d795df01e0794ae389bccf4e224b97e668a690164dedd70d2853e566a1646
MD5 707936424a3b8ca4a7bd0670a1028c12
SHA1 30367cd87701e10ce264d3b89a79f93499416f4e
SHA512 8213cec512b5f76bfd71e404d45ab3749880bbb26bff3566d9e076623ea563b132e006312b686d3e680054f562310011c4bed5d424c162cb8da5c9cbe68ab087
SSDEEP 1536:z7ZhA7FSFgC2N2ON2xKbx9ex98cNVcNwXCEoxQq8:Re7F6P2N2ON229G9bXR
TLSH
T15C438E7DBB22B862D13D56303DAB74FCCE263E40FFF4B6C6EB3A14860566B654044668
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery cosmu ransomware worm

Malware Config

Signatures

Family: Cosmu
Cosmu is a Windows worm written in C++.
worm cosmu

Detects Cosmu payload 4 IoCs

Cosmu is a worm written in C++.

resource	yara_rule
behavioral2/memory/4468-0-0x0000000000400000-0x0000000000408000-memory.dmp	family_cosmu
behavioral2/files/0x000e00000001b664-2.dat	family_cosmu
behavioral2/files/0x000300000001b1af-6.dat	family_cosmu
behavioral2/memory/4468-559-0x0000000000400000-0x0000000000408000-memory.dmp	family_cosmu

Renames multiple (4402) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-ppd.xrm-ms.tmp	2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-heap-l1-1-0.dll.tmp	2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationProvider.resources.dll.tmp	2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\UIAutomationProvider.resources.dll.tmp	2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Violet.xml.tmp	2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-ppd.xrm-ms.tmp	2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightRegular.ttf.tmp	2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Integration\QFE31928.msp.tmp	2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ppd.xrm-ms.tmp	2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ppd.xrm-ms.tmp	2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\rtscom.dll.mui.tmp	2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\PresentationFramework-SystemDrawing.dll.tmp	2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ppd.xrm-ms.tmp	2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-pl.xrm-ms.tmp	2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Controls.Ribbon.resources.dll.tmp	2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\fr\PresentationFramework.resources.dll.tmp	2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\tr\System.Windows.Input.Manipulations.resources.dll.tmp	2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcDemoR_BypassTrial365-ppd.xrm-ms.tmp	2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ul-oob.xrm-ms.tmp	2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-ul-oob.xrm-ms.tmp	2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.SqlServer.Types.dll.tmp	2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe
File created	C:\Program Files\7-Zip\Lang\ko.txt.tmp	2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\et-EE\tipresx.dll.mui.tmp	2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Memory.dll.tmp	2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ppd.xrm-ms.tmp	2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_COL.HXC.tmp	2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ppd.xrm-ms.tmp	2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-ul-oob.xrm-ms.tmp	2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\XLLEX.DLL.tmp	2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Forms.resources.dll.tmp	2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pl\ReachFramework.resources.dll.tmp	2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Windows.Controls.Ribbon.dll.tmp	2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\net.properties.tmp	2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\lib\dt.jar.tmp	2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Grace-ppd.xrm-ms.tmp	2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ne-NP\tipresx.dll.mui.tmp	2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msdaremr.dll.mui.tmp	2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\te.pak.tmp	2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\XLMACRO.CHM.tmp	2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tpcps.dll.tmp	2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Cryptography.Pkcs.dll.tmp	2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Security.Cryptography.ProtectedData.dll.tmp	2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe
File created	C:\Program Files\FormatConvertFrom.m1v.tmp	2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\default_apps\external_extensions.json.tmp	2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe.tmp	2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\Sybase.xsl.tmp	2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe
File created	C:\Program Files\7-Zip\Lang\pa-in.txt.tmp	2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll.tmp	2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\rtscom.dll.mui.tmp	2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Private.DataContractSerialization.dll.tmp	2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\javafx.properties.tmp	2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ul-oob.xrm-ms.tmp	2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ul-oob.xrm-ms.tmp	2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Grace-ppd.xrm-ms.tmp	2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe
File created	C:\Program Files\7-Zip\Lang\sq.txt.tmp	2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\VisualElements\LogoBeta.png.tmp	2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ul-oob.xrm-ms.tmp	2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ul-phn.xrm-ms.tmp	2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINSHELL.DLL.tmp	2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.AdHoc.Excel.Client.dll.tmp	2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe
File created	C:\Program Files\7-Zip\Lang\tt.txt.tmp	2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-24_707936424a3b8ca4a7bd0670a1028c12_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini.tmp
Size 54KB
SHA256 ae0a46233f7ff0b21b115a5f8a54ea18371026b438cb40560fbb9b0dea0303c6
MD5 1609b575d209c3d922b6fbadd12b1886
SHA1 2596e8093ebf37eab4cff7652f7a43f561c6b12f
SHA512 4a1f6ddc35937659482e9e8eac7909d86d879bd4ee4bf0fe8fb01b758d219ec603f1ccff135267200400b2b1e7ab10e1aebc542c56186d670d66c249fd44e828
SSDEEP 1536:z7ZhA7FSFgC2N2ON2xKbx9ex98cNVcNwXCEoxQqG:Re7F6P2N2ON229G9bXT
TLSH
T181439E7DBB22B862D13D56303DAB74FCCE263E40FFF4B6C6DB3A24860566B614044668
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7-zip.dll.tmp

Path C:\Program Files\7-Zip\7-zip.dll.tmp
Size 153KB
SHA256 01cd4943a0ebfa853caf791251d6548ca673240ae4a542a4426ade52597cb746
MD5 bf883bfe4c14f55bd90429cd974af2e7
SHA1 d0cc3182e6d4f21fcc2404ef2096171fd18e4e00
SHA512 1084fc4745fa9936842290c0ba3ee07045b569e60490bf26b5b3d6193efaae4babd29f133a18b818e4f146c45dace9837d277664dab1ae8388d43811cfcdf801
SSDEEP 3072:Re7F6P2N2ON229G9bX25ZMfTiu66I3UwqSsMBlsWb4A+X:0FjsXAMfTinqncsWp+X
TLSH
T14EE317607CAEF6A0CB0813396D5B7E8FC305398A3D99CE82B67515E3413DE950C9B4E6
MD5 SHA1 SHA512 SSDEEP TLSH