cosmu | 589daf42d30b0cab03fdf2ecd0b3ef805dff6bff6cdec495b8366f0fb70d4097

Analysis

max time kernel
150s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 16:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
Size 54KB
Sample260728-vhn4macr8z
SHA256 589daf42d30b0cab03fdf2ecd0b3ef805dff6bff6cdec495b8366f0fb70d4097
MD5 a89ae77f7f15f2943233e5d055efb995
SHA1 f9f7b12c01f9d26fc2c46e903aea942d23da198e
SHA512 f101a55b6951f1d4d9bf266c3891f28b8682ca84393dce5625ebe495abee262682b13d2d6f5cea9760fee09103b9ef8ea31a8d412cf0bf1d43c89be783d9473d
SSDEEP 768:/7BlpQpARFbhIYJIJDYJIJPfFpsJcFfFpsJcXcMcrtzTzB:/7ZQpApze+eJfFpsJOfFpsJMT23
TLSH
T1D84328CE832CC152E60E3B749E33287874B2420CB497FCEFBE16D852A821AE5551795F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery cosmu ransomware worm

Malware Config

Signatures

Family: Cosmu
Cosmu is a Windows worm written in C++.
worm cosmu

Detects Cosmu payload 4 IoCs

Cosmu is a worm written in C++.

resource	yara_rule
behavioral2/memory/3448-0-0x0000000000400000-0x0000000000408000-memory.dmp	family_cosmu
behavioral2/files/0x000a000000019cb5-2.dat	family_cosmu
behavioral2/files/0x000300000001b1af-6.dat	family_cosmu
behavioral2/memory/3448-553-0x0000000000400000-0x0000000000408000-memory.dmp	family_cosmu

Renames multiple (4361) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_HK.properties.tmp	2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-pl.xrm-ms.tmp	2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationProvider.resources.dll.tmp	2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pl\PresentationCore.resources.dll.tmp	2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-pl.xrm-ms.tmp	2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ul-phn.xrm-ms.tmp	2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tipresx.dll.mui.tmp	2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.ReaderWriter.dll.tmp	2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\charsets.jar.tmp	2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-handle-l1-1-0.dll.tmp	2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_COL.HXC.tmp	2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
File created	C:\Program Files\7-Zip\Lang\yo.txt.tmp	2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationTypes.resources.dll.tmp	2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationCore.dll.tmp	2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-processthreads-l1-1-1.dll.tmp	2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ul.xrm-ms.tmp	2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man.tmp	2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\UIAutomationClientSideProviders.resources.dll.tmp	2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\decora_sse.dll.tmp	2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\US_export_policy.jar.tmp	2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Constantia-Franklin Gothic Book.xml.tmp	2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-pl.xrm-ms.tmp	2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml.tmp	2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.Win32.Registry.dll.tmp	2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.X509Certificates.dll.tmp	2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\bs-Latn-BA\tipresx.dll.mui.tmp	2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Extensions.dll.tmp	2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSO.ACL.tmp	2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.dll.tmp	2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationProvider.resources.dll.tmp	2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Forms.Design.resources.dll.tmp	2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\prism_common.dll.tmp	2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-pl.xrm-ms.tmp	2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-ul-phn.xrm-ms.tmp	2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Formats.Tar.dll.tmp	2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\PresentationUI.resources.dll.tmp	2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.Primitives.resources.dll.tmp	2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.VisualBasic.Forms.dll.tmp	2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-pl.xrm-ms.tmp	2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\ml.pak.tmp	2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Primitives.dll.tmp	2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\clrgc.dll.tmp	2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\icu_web.md.tmp	2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-ul-oob.xrm-ms.tmp	2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ul.xrm-ms.tmp	2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\eu-ES\tipresx.dll.mui.tmp	2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\micaut.dll.tmp	2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.Design.resources.dll.tmp	2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
File created	C:\Program Files\ExpandRevoke.i64.tmp	2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ppd.xrm-ms.tmp	2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ul-phn.xrm-ms.tmp	2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-ul-oob.xrm-ms.tmp	2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ospintl.dll.tmp	2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\WindowsFormsIntegration.resources.dll.tmp	2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\OUTLOOK_COL.HXT.tmp	2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_Grace-ul-oob.xrm-ms.tmp	2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.UnmanagedMemoryStream.dll.tmp	2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\ja.pak.tmp	2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\meta-index.tmp	2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaSansDemiBold.ttf.tmp	2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-pl.xrm-ms.tmp	2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-pl.xrm-ms.tmp	2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_a89ae77f7f15f2943233e5d055efb995_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini.tmp
Size 54KB
SHA256 53c53383cde4250f344fdb8a506976f90779093b84336d38f7dada060784482d
MD5 4c1e9591e272757ca4b83afe21d18d08
SHA1 0ee24c16a537271e8720e698d7d7d7660c791852
SHA512 e23fd40a7a7a5083ba23a0ad80c27bbbcbd27d92fd2de724aa20ef3f01fe7f34f6273bec905face6dfb4fbe0af3bb9f38a10e5d72d03a00e6f1a2943283c1ea9
SSDEEP 768:/7BlpQpARFbhIYJIJDYJIJPfFpsJcFfFpsJcXcMcrtzTz+:/7ZQpApze+eJfFpsJOfFpsJMT20
TLSH
T1D24318CE8328C152E61E3B749E33287874B2420CB497FCEFFE16D852A821AE5551795F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7-zip.dll.tmp

Path C:\Program Files\7-Zip\7-zip.dll.tmp
Size 153KB
SHA256 089989fc809e69e91765dce158a418deaa292d85092ecfb8dbbc8fd6aa9ad456
MD5 bf1ef33924f59eddc20b432a8f0ed6d8
SHA1 819b839b6f86a5535ea3a62c5ea8458e7c315e63
SHA512 02de1fdbfcffa22897f0c025e52e2b2644cd2624b35d23981653f1cf6cd45e67d605e5cb32f0eb5da85d81acf295e5da70be94c8160c677d71bc54c3ff7e21fb
SSDEEP 3072:9QWpze+eJfFpsJOfFpsJm5ZMfTiu66I3UwqSsMBlsWb4A+f:Lpe+eJMfTinqncsWp+f
TLSH
T1B9E3F7907C6EF2A0CF482339AE2B5EB39201398E3C5ACD86B665D5E3913CD950C574E7
MD5 SHA1 SHA512 SSDEEP TLSH