cosmu | 229819e9beae0c800a1893c77fe2430da80be623d2041f50568de32d5dcdd9d3

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 22:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
Size 66KB
Sample260728-2eppbaar6x
SHA256 229819e9beae0c800a1893c77fe2430da80be623d2041f50568de32d5dcdd9d3
MD5 968bb59cf1286ccb861a23425c227a23
SHA1 d9158c0c65b69b937cec9c5bce1f8bb39447fcc5
SHA512 f2166f23324d4492d9710901ed7a32488e560c26e6355174dd66469418cd1e6a685f8be5c56d8e69ffa2aaded982c818f25a09b6ddea000870779663b05be356
SSDEEP 768:/7BlpQpARFbhWGLF/MF/LEXBwzEXBw6C/40C/F82:/7ZQpApP2KCg0Cr
TLSH
T1F463090B4A14C85FF33AA3B69C6A3075410674CD6B9EAFF2AD15CDC90C28D7346A791E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery cosmu ransomware worm

Malware Config

Signatures

Family: Cosmu
Cosmu is a Windows worm written in C++.
worm cosmu

Detects Cosmu payload 4 IoCs

Cosmu is a worm written in C++.

resource	yara_rule
behavioral2/memory/2456-0-0x0000000000400000-0x0000000000408000-memory.dmp	family_cosmu
behavioral2/files/0x000900000001138e-2.dat	family_cosmu
behavioral2/files/0x000300000001b1a7-7.dat	family_cosmu
behavioral2/memory/2456-525-0x0000000000400000-0x0000000000408000-memory.dmp	family_cosmu

Renames multiple (4274) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tipresx.dll.mui.tmp	2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\PresentationFramework.resources.dll.tmp	2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\WindowsFormsIntegration.resources.dll.tmp	2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\IwaKeyDistribution\manifest.json.tmp	2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SOCIALCONNECTORRES.DLL.tmp	2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui.tmp	2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Pipes.dll.tmp	2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.DispatchProxy.dll.tmp	2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Controls.Ribbon.resources.dll.tmp	2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\include\jni.h.tmp	2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ul.xrm-ms.tmp	2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-pl.xrm-ms.tmp	2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui.tmp	2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-string-l1-1-0.dll.tmp	2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\tr\System.Windows.Controls.Ribbon.resources.dll.tmp	2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\CIEXYZ.pf.tmp	2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Input.Manipulations.resources.dll.tmp	2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\PresentationCore.resources.dll.tmp	2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\lib\cmm\PYCC.pf.tmp	2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_CopyNoDrop32x32.gif.tmp	2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Trial-pl.xrm-ms.tmp	2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-ppd.xrm-ms.tmp	2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationClient.resources.dll.tmp	2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-pl.xrm-ms.tmp	2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-pl.xrm-ms.tmp	2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui.tmp	2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TabTip.exe.mui.tmp	2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\zipfs.jar.tmp	2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue II.xml.tmp	2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-ul-oob.xrm-ms.tmp	2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Forms.Design.resources.dll.tmp	2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\Microsoft.WindowsDesktop.App.runtimeconfig.json.tmp	2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
File created	C:\Program Files\Internet Explorer\IEShims.dll.tmp	2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Transactions.Local.dll.tmp	2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe.tmp	2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\lcms.dll.tmp	2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MAPISHELLR.DLL.tmp	2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\OUTFORM.DAT.tmp	2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\Classic.dotx.tmp	2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml.tmp	2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\PresentationCore.resources.dll.tmp	2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
File created	C:\Program Files\7-Zip\Lang\sl.txt.tmp	2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll.tmp	2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\Microsoft.VisualBasic.Forms.resources.dll.tmp	2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\PresentationUI.resources.dll.tmp	2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\tr\System.Windows.Input.Manipulations.resources.dll.tmp	2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jsound.dll.tmp	2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Drawing.Design.dll.tmp	2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
File created	C:\Program Files\Common Files\System\msadc\msadco.dll.tmp	2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Xaml.resources.dll.tmp	2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_PrepidBypass-ul-oob.xrm-ms.tmp	2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ul-oob.xrm-ms.tmp	2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCOMMON.DLL.tmp	2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Smokey Glass.eftx.tmp	2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Drawing.Primitives.dll.tmp	2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man.tmp	2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.Design.resources.dll.tmp	2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\dom.md.tmp	2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\LICENSE.tmp	2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\PresentationUI.resources.dll.tmp	2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationFramework.resources.dll.tmp	2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.tmp	2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ul-phn.xrm-ms.tmp	2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\ReachFramework.resources.dll.tmp	2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_968bb59cf1286ccb861a23425c227a23_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-1079202589-886135813-2527035092-1000\desktop.ini.tmp
Size 66KB
SHA256 77ab723f8090a702a0640993a3cf539fd635e412905e6ed91ac536807663a0cd
MD5 dc511920ee5e99315aa9f8d085efe5d7
SHA1 db32ddf459673feb9591e5db9693e645f5d93392
SHA512 6ea5e739d42eccb0bfe33c9b154ea9b68b44b777ead34e0385c257af7dfa1365e4614995de9592ab21616914158076427cab373be4f310218c3ef706c5e0d990
SSDEEP 768:/7BlpQpARFbhWGLF/MF/LEXBwzEXBw6C/40C/F8H:/7ZQpApP2KCg0Cu
TLSH
T10263180B4A14C85FF33AA3B69C6A3075410674CD6B9EAFF2AD15DDC90C28D7306A791E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7-zip.dll.exe

Path C:\Program Files\7-Zip\7-zip.dll.exe
Size 165KB
SHA256 90fa6280e01a918d9d5496bb5948529ce6240b08dcade569f009c029212e6145
MD5 e941b87fbf11e7d57a8885857507cd6a
SHA1 79f4fd36eef922329781bc0d2a066525a62fc1c9
SHA512 374b4c61ba11b6a0e58707ba6c163d65853c3b9152e1c53631257583e1fb827f70014fdeb8ae1eeed09ab1d8cc230851944fd5c34ccd099bd6d964b7c2cbaa48
SSDEEP 3072:9QWpP2B5ZMfTiu66I3UwqSsMBlsWb4A+Y:LB2xMfTinqncsWp+Y
TLSH
T1D7F316116C6EF665CB141379AD5B2DB38201388E3D4ECEB2BA65D5E3443CDB20C974E6
MD5 SHA1 SHA512 SSDEEP TLSH