cosmu | fdd72c2bdacf8abc55b8e723171c2ca65f260d8fa5460e113874c862487f518a

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 22:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe
Size 46KB
Sample260728-2qtgmsyalg
SHA256 fdd72c2bdacf8abc55b8e723171c2ca65f260d8fa5460e113874c862487f518a
MD5 700cbd9ed8b960dda61bd9e7d2cca9fa
SHA1 fcf9cf662728f79e3fac5a1c70659cadbe2b6d5e
SHA512 8b5ea9756d41c9b174bd4cc0a01aa0e299bc7b41f2be2fb0338ed78815672cfbb99a486804b200392a9586c89f2262fad02a5d320531a2bf0e0dfd850f611c00
SSDEEP 768:W7Blp2sspARFbh5YSfff9n1oXKCqzEIn1oXKCqzE7:W7Z2sspAp5YSfff2
TLSH
T19823C73E6B0370F2EB854174311E3AFEAC13AC60A275A9B15398CD9A1735FB4D4A435E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery cosmu ransomware worm

Malware Config

Signatures

Family: Cosmu
Cosmu is a Windows worm written in C++.
worm cosmu

Detects Cosmu payload 2 IoCs

Cosmu is a worm written in C++.

resource	yara_rule
behavioral2/files/0x000d00000001b87d-1.dat	family_cosmu
behavioral2/files/0x000400000001b1cd-5.dat	family_cosmu

Renames multiple (4368) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemCore.dll.tmp	2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ja\System.Windows.Forms.Design.resources.dll.tmp	2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\xmlresolver.md.tmp	2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\instrument.dll.tmp	2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.Serialization.dll.tmp	2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\WindowsBase.resources.dll.tmp	2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\sv.pak.tmp	2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ppd.xrm-ms.tmp	2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe
File created	C:\Program Files\7-Zip\Lang\id.txt.tmp	2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Windows.Input.Manipulations.dll.tmp	2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\ta.pak.tmp	2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\gstreamer.md.tmp	2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Grace-ppd.xrm-ms.tmp	2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationUI.resources.dll.tmp	2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\DirectWriteForwarder.dll.tmp	2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Forms.resources.dll.tmp	2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\VisualElements\SmallLogoBeta.png.tmp	2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\System.Windows.Forms.Design.resources.dll.tmp	2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe
File created	C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.tmp	2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui.tmp	2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.DataAnnotations.dll.tmp	2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Principal.Windows.dll.tmp	2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\msquic.dll.tmp	2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jawt.dll.tmp	2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\lib\hijrah-config-umalqura.properties.tmp	2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Design.dll.tmp	2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\webkit.md.tmp	2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-localization-l1-2-0.dll.tmp	2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ul-oob.xrm-ms.tmp	2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ul-phn.xrm-ms.tmp	2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-pl.xrm-ms.tmp	2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.Edm.NetFX35.dll.tmp	2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Text.Encoding.Extensions.dll.tmp	2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\ReachFramework.resources.dll.tmp	2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Windows.Forms.Primitives.dll.tmp	2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\unpack.dll.tmp	2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Http.Json.dll.tmp	2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\lib\content-types.properties.tmp	2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Controls.Ribbon.resources.dll.tmp	2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\colorimaging.md.tmp	2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Grace-ppd.xrm-ms.tmp	2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationTypes.resources.dll.tmp	2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp	2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue Green.xml.tmp	2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ppd.xrm-ms.tmp	2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ul-oob.xrm-ms.tmp	2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\Invite or Link.one.tmp	2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\System.Windows.Input.Manipulations.resources.dll.tmp	2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe
File created	C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp	2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcor.dll.mui.tmp	2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe
File created	C:\Program Files\Common Files\System\msadc\msdaremr.dll.tmp	2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\jaccess.jar.tmp	2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red.xml.tmp	2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ul-phn.xrm-ms.tmp	2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ppd.xrm-ms.tmp	2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ul.xrm-ms.tmp	2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe.tmp	2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Algorithms.dll.tmp	2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.EventBasedAsync.dll.tmp	2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Input.Manipulations.resources.dll.tmp	2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.tmp	2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ppd.xrm-ms.tmp	2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\PresentationCore.resources.dll.tmp	2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\System.Windows.Forms.Design.resources.dll.tmp	2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_700cbd9ed8b960dda61bd9e7d2cca9fa_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini.tmp
Size 46KB
SHA256 586509f0af7bfb7c35d962c9544b64fc510dab55c770b9637b9b7b6eee0f1e83
MD5 f41dd5531816de7bc2e172735a5e56f9
SHA1 15033ec46dc4ad0c826b1f58e486f997a88c93c3
SHA512 d52d82d7a6998619316ada8c49334ecd9ddf43cb8fe0cfdf860281e036b9a86a4a2a68c034c67c977374a66cdca95167ee4ded796bdd07863fb2ad5b515049a3
SSDEEP 768:W7Blp2sspARFbh5YSfff9n1oXKCqzEIn1oXKCqzEW:W7Z2sspAp5YSfffX
TLSH
T15D23C83E6B0370F2E7850174311E3AFEAC13AC60A275A9B25398DD9A1635FB4D4A435E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7-zip.dll.tmp

Path C:\Program Files\7-Zip\7-zip.dll.tmp
Size 145KB
SHA256 1a1ede5ce9ee78c68678ae7278efec8aa5067b5ab19c1953a1b68a46f03c0a22
MD5 596e14438d09ef8fd24a344b35695575
SHA1 3a4a93d603d86774ff72d09d668e6e58850d5488
SHA512 bdee480554b816ca6c5ece652737c24c2ebc9374b2d99fef4f7fad5995087d9e5911ac434dc0e81ff46e6c3b469f95c4d0f7519773eaf78f4eb8cf301cd59750
SSDEEP 3072:62ssWp85ZMfTiu66I3UwqSsMBlsWb4A+e:MVgMfTinqncsWp+e
TLSH
T186E3F6207C6EF6A0CF441338691B6E87DE023D8A3C5ACD7272A555E3523CEB40C9B5E6
MD5 SHA1 SHA512 SSDEEP TLSH