cosmu | d8f08174b6f2c5eca746c3b0c66926056051ae88c53c4ceb6daf7b19c943968c

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 19:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe
Size 101KB
Sample260728-ylteasbe76
SHA256 d8f08174b6f2c5eca746c3b0c66926056051ae88c53c4ceb6daf7b19c943968c
MD5 d9459cf9c33aa5263bb3b2551a9613ea
SHA1 21eb8084491c8ab03f8ae216ca2df76fa08baf60
SHA512 323cddd3019f472c843cc5237d7daacc0b7147eb6eb90f0b754124a62d9ecfd23c934bf95323647f020a7f70ea3acfb0bf855b4e5fc36afc0cb7b261e2e8544a
SSDEEP 3072:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFslEhLfyBI:PqFF2Ie+eF1S/tUS/t4Jl
TLSH
T1D3A3D47A699CE8E7E3B726305D1BF99D80697C0B7FB1B83D3963589A1903FB1480414B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery cosmu ransomware worm

Malware Config

Signatures

Family: Cosmu
Cosmu is a Windows worm written in C++.
worm cosmu

Detects Cosmu payload 2 IoCs

Cosmu is a worm written in C++.

resource	yara_rule
behavioral2/files/0x000a000000011390-1.dat	family_cosmu
behavioral2/files/0x0005000000016b3f-5.dat	family_cosmu

Renames multiple (4065) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationProvider.resources.dll.tmp	2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-handle-l1-1-0.dll.tmp	2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Gothic.xml.tmp	2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ul-phn.xrm-ms.tmp	2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-ul-oob.xrm-ms.tmp	2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui.tmp	2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Grace-ul-oob.xrm-ms.tmp	2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSO.ACL.tmp	2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui.tmp	2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.Design.resources.dll.tmp	2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-synch-l1-1-0.dll.tmp	2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Grace-ppd.xrm-ms.tmp	2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms.tmp	2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ru-ru.dll.tmp	2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.EventBasedAsync.dll.tmp	2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationProvider.resources.dll.tmp	2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\libpng.md.tmp	2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-pl.xrm-ms.tmp	2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml.tmp	2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_de.properties.tmp	2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProDemoR_BypassTrial180-ppd.xrm-ms.tmp	2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-pl.xrm-ms.tmp	2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.ThreadPool.dll.tmp	2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\j2pcsc.dll.tmp	2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\server\classes.jsa.tmp	2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ul-oob.xrm-ms.tmp	2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\Microsoft.WindowsDesktop.App.deps.json.tmp	2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\VisualElements\SmallLogo.png.tmp	2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Primitives.dll.tmp	2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt.tmp	2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll.tmp	2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp	2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-pl.xrm-ms.tmp	2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-pl.xrm-ms.tmp	2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Windows.Forms.Design.Editors.dll.tmp	2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationProvider.resources.dll.tmp	2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-ppd.xrm-ms.tmp	2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_Subscription-ul-oob.xrm-ms.tmp	2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.tmp	2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Diagnostics.EventLog.dll.tmp	2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\icu_web.md.tmp	2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe.tmp	2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-pl.xrm-ms.tmp	2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ppd.xrm-ms.tmp	2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\ucrtbase.dll.tmp	2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\mr.pak.tmp	2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCalls.h.tmp	2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\jcup.md.tmp	2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms.tmp	2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_COL.HXC.tmp	2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui.tmp	2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp	2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-ul-phn.xrm-ms.tmp	2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTrial-ul-oob.xrm-ms.tmp	2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll.tmp	2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.resources.dll.tmp	2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\ms.pak.tmp	2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-private-l1-1-0.dll.tmp	2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.X509Certificates.dll.tmp	2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll.tmp	2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\cy-GB\tipresx.dll.mui.tmp	2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.dll.tmp	2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_d9459cf9c33aa5263bb3b2551a9613ea_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-1738198120-2966725515-3980530802-1000\desktop.ini.tmp
Size 101KB
SHA256 b041dcd839b9022ac21a17a89f3ae58a0b8e560009d696cfb9aa14aa7057fb94
MD5 9e56da3363e07df79767d25a20f60624
SHA1 e8c7381be920698af00f29e3957804ab8c74d3e8
SHA512 374ea800ea05dc6b940eff336a47bedb285814ea4c7598b3a0c82a5d7a8744c73335014992a5ce37e9c4bc78e01d353aadb5557ce9def0d5dadc35397dc9d07c
SSDEEP 3072:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFslEhLfyBX:PqFF2Ie+eF1S/tUS/t4JK
TLSH
T153A3D47A699CE8E7E3B726305D1BF59D806A7C0B7FB1B83D3963589A1903FB1480414B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7-zip.dll.tmp

Path C:\Program Files\7-Zip\7-zip.dll.tmp
Size 200KB
SHA256 2c6a3cf69a7f66f35f5fb9eac602a3b2d6fbdf1fff674714dcb33e8ab82b9a9a
MD5 f5d7d23f81f558f3c1c1b8a1dbbdb708
SHA1 9c3b4a4f29a8b9d86f588c84f6137096f2b9f7bb
SHA512 00e38063b726b00ceedd0af5bf11dbe5a70399a4602699f67550c25accad8679a3e685cc134b640091a4fd6f883f1659f7493c45f6c45c6f8c6eeea2773c68a3
SSDEEP 6144:PqFF2Ie+eF1S/tUS/t4JwMfTinqncsWp+c:iFF2yMfunbsW8c
TLSH
T1AB1407617CADF5E2CBA522346D1BBD8FC2053C4B3EA9EC79356214E7452AEB10C4709B
MD5 SHA1 SHA512 SSDEEP TLSH