cosmu | 1860b20fad7a1dc55e97fb7311a0006ee8a55c9fa35f45ae50f4e704e194d8c7

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 22:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
Size 60KB
Sample260728-2t5dbabl81
SHA256 1860b20fad7a1dc55e97fb7311a0006ee8a55c9fa35f45ae50f4e704e194d8c7
MD5 6412cbd05a514973c9b1d4ed7d5fc4e4
SHA1 1a1f9c7f21236b04b558ca774e65e35c8c4043b0
SHA512 1c3e72ba85a0c6cfb545a916663bb7f947686a5b10f59d41a0d632028e601eb625e09321165b25685a13a923ec66a1078ea1b37bd97a40baec984c7957e61de3
SSDEEP 768:/7BlpQpARFbhIYJIJDYJIJPfFpsJcFfFpsJcC+3mC+3meDAfABJ6fABJwEXBu:/7ZQpApze+eJfFpsJOfFpsJ5DG
TLSH
T1D3535C4B9725C153E26D7A34AE2638B8BCD1409D612EFCEFFA16CD836D118B1670BD09
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery cosmu ransomware worm

Malware Config

Signatures

Family: Cosmu
Cosmu is a Windows worm written in C++.
worm cosmu

Detects Cosmu payload 4 IoCs

Cosmu is a worm written in C++.

resource	yara_rule
behavioral2/memory/1248-0-0x0000000000400000-0x0000000000408000-memory.dmp	family_cosmu
behavioral2/files/0x000b00000001b315-2.dat	family_cosmu
behavioral2/files/0x000600000001b1c8-6.dat	family_cosmu
behavioral2/memory/1248-557-0x0000000000400000-0x0000000000408000-memory.dmp	family_cosmu

Renames multiple (4299) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-ppd.xrm-ms.tmp	2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicstylish.dotx.tmp	2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.tmp	2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-ul-oob.xrm-ms.tmp	2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Grace-ul-oob.xrm-ms.tmp	2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll.tmp	2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCHART.DLL.tmp	2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.UnmanagedMemoryStream.dll.tmp	2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\kn.pak.tmp	2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\unpack.dll.tmp	2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ul-phn.xrm-ms.tmp	2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-util-l1-1-0.dll.tmp	2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ppd.xrm-ms.tmp	2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_F_COL.HXK.tmp	2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Console.dll.tmp	2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Aero.dll.tmp	2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ppd.xrm-ms.tmp	2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Drawing.Primitives.dll.tmp	2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.tmp	2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipTsf.dll.mui.tmp	2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Web.dll.tmp	2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\TrebuchetMs.xml.tmp	2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ppd.xrm-ms.tmp	2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe.tmp	2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\cryptix.md.tmp	2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcer.dll.mui.tmp	2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\ecc.md.tmp	2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\java_crw_demo.dll.tmp	2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml.tmp	2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.Primitives.resources.dll.tmp	2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.resources.dll.tmp	2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ppd.xrm-ms.tmp	2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\msotdintl.dll.tmp	2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_WHATSNEW.XML.tmp	2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp	2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jsse.jar.tmp	2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\jsdt.dll.tmp	2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe.tmp	2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ul-phn.xrm-ms.tmp	2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
File created	C:\Program Files\7-Zip\Lang\br.txt.tmp	2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msaddsr.dll.mui.tmp	2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\WindowsFormsIntegration.resources.dll.tmp	2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\localedata.jar.tmp	2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ppd.xrm-ms.tmp	2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.ProgressiveProcessing.dll.tmp	2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\fr\System.Xaml.resources.dll.tmp	2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp	2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\zh-CN.pak.tmp	2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-pl.xrm-ms.tmp	2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
File created	C:\Program Files\7-Zip\Lang\nb.txt.tmp	2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.Extensions.dll.tmp	2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Input.Manipulations.resources.dll.tmp	2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\en-GB.pak.tmp	2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-math-l1-1-0.dll.tmp	2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp	2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Forms.Design.resources.dll.tmp	2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\PresentationUI.resources.dll.tmp	2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\WindowsBase.resources.dll.tmp	2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\Microsoft.Win32.Registry.AccessControl.dll.tmp	2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\hr.pak.tmp	2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql70.xsl.tmp	2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\gd-GB\tipresx.dll.mui.tmp	2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_6412cbd05a514973c9b1d4ed7d5fc4e4_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini.tmp
Size 60KB
SHA256 53cde87b7023765f31cf7e2f5084c853be5f293c61dc0d19d51eda9d3ab7a88d
MD5 a31e02242087e3b82b984f02eec1cc26
SHA1 cc2bf1d17c8f140b020cd41c77a631da34dd5ae6
SHA512 03014007c40857b16b2131ece73b7dbaa67d68c00213472d4ca142f25d7cc70973e2f7f4b63383a614ddbb6cfc8341b1f61c2e3e1ef4837cdc66e91bc3663586
SSDEEP 768:/7BlpQpARFbhIYJIJDYJIJPfFpsJcFfFpsJcC+3mC+3meDAfABJ6fABJwEXBG:/7ZQpApze+eJfFpsJOfFpsJ5D+
TLSH
T184535D4B9725C053E26D7A34AE2738B8BCD1409D612EFCEFFA16CDC36D118B1660B919
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7-zip.dll.tmp

Path C:\Program Files\7-Zip\7-zip.dll.tmp
Size 159KB
SHA256 14c86ac6cc0ee3ebafe963beb547a6f6f2edbfc5fa619a6dae90df919f73c142
MD5 f0530d37ead2f8756426cf58d65da312
SHA1 c6300f526af9041c04e8f10379dde7941bbee593
SHA512 134eb6bd588d90b27c192121bd6bd972a7f6ef9325d9b3debab2fc6f16ad9f3404151d5f13677146bca40e1047272ec6d8f3626172a905579ac57fa054837db5
SSDEEP 3072:9QWpze+eJfFpsJOfFpsJ5DS5ZMfTiu66I3UwqSsMBlsWb4A+b:Lpe+ewDUMfTinqncsWp+b
TLSH
T1B6F317517D6EF2A0CB482339AE2B7EB3D201358F3C5ACD86B665C5E39138D910C5B4E6
MD5 SHA1 SHA512 SSDEEP TLSH