cosmu | 09be6f33001451c3db9d0c18bfc0e79cb3cb61bfcaeb3668e3e6093c3a63da24

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 00:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe
Size 65KB
Sample260729-an3trada59
SHA256 09be6f33001451c3db9d0c18bfc0e79cb3cb61bfcaeb3668e3e6093c3a63da24
MD5 cb790f9073a502b8342515c8423fb928
SHA1 bc7fffbf16ab89d82cfd4fc4a1fcdd7d5be45bfc
SHA512 36cead02cf43f47b59d70861eaab2a5b4cd9eff07886b54f6addda6376947889b051c83ae900c453b6e282894562c12f6934f09c0061e31905262ed16c89d80e
SSDEEP 768:/7BlpQpARFbhWGLF/MF/LEXBwzEXBwvqJFqJp7b:/7ZQpApP2I+V
TLSH
T14363F70A8A54885FF73AA7B68D6A30BE514214CD6F1EBFF2BD09CEC91C28D33451641E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery cosmu ransomware worm

Malware Config

Signatures

Family: Cosmu
Cosmu is a Windows worm written in C++.
worm cosmu

Detects Cosmu payload 4 IoCs

Cosmu is a worm written in C++.

resource	yara_rule
behavioral2/memory/5000-0-0x0000000000400000-0x0000000000408000-memory.dmp	family_cosmu
behavioral2/files/0x000800000001b884-2.dat	family_cosmu
behavioral2/files/0x000400000001b1ed-6.dat	family_cosmu
behavioral2/memory/5000-549-0x0000000000400000-0x0000000000408000-memory.dmp	family_cosmu

Renames multiple (4189) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.resources.dll.tmp	2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe.tmp	2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-processthreads-l1-1-1.dll.tmp	2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\c2rpridslicensefiles_auto.xml.tmp	2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_Grace-ppd.xrm-ms.tmp	2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-ppd.xrm-ms.tmp	2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\lib\flavormap.properties.tmp	2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe
File created	C:\Program Files\Internet Explorer\hmmapi.dll.tmp	2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-utility-l1-1-0.dll.tmp	2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_Grace-ul-oob.xrm-ms.tmp	2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\fontmanager.dll.tmp	2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\w2k_lsa_auth.dll.tmp	2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\dom.md.tmp	2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\lib\fontconfig.properties.src.tmp	2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-pl.xrm-ms.tmp	2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ul-oob.xrm-ms.tmp	2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Grace-ppd.xrm-ms.tmp	2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ul-oob.xrm-ms.tmp	2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-pl.xrm-ms.tmp	2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Trial-ul-oob.xrm-ms.tmp	2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.ResourceManager.dll.tmp	2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Threading.Overlapped.dll.tmp	2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-pl.xrm-ms.tmp	2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ul-oob.xrm-ms.tmp	2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsyml.ttf.tmp	2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\d3dcompiler_47.dll.tmp	2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red Orange.xml.tmp	2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\System.Windows.Forms.Design.resources.dll.tmp	2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l2-1-0.dll.tmp	2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-ul-oob.xrm-ms.tmp	2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ppd.xrm-ms.tmp	2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.VisualBasic.dll.tmp	2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe.tmp	2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-ppd.xrm-ms.tmp	2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ul-phn.xrm-ms.tmp	2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemXml.dll.tmp	2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\msvcp140.dll.tmp	2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-math-l1-1-0.dll.tmp	2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\jaas_nt.dll.tmp	2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-pl.xrm-ms.tmp	2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ppd.xrm-ms.tmp	2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\pt-PT.pak.tmp	2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\th.pak.tmp	2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Excel.Extensions.dll.tmp	2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe
File created	C:\Program Files\7-Zip\Lang\sw.txt.tmp	2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Net.WebProxy.dll.tmp	2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTest-pl.xrm-ms.tmp	2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\PresentationFramework.resources.dll.tmp	2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fa-IR\tipresx.dll.mui.tmp	2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Buffers.dll.tmp	2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Runtime.InteropServices.JavaScript.dll.tmp	2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\WindowsFormsIntegration.resources.dll.tmp	2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\tr\System.Windows.Forms.Primitives.resources.dll.tmp	2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\deploy.dll.tmp	2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2ssv.dll.tmp	2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jpeg.md.tmp	2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\micaut.dll.tmp	2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationClientSideProviders.resources.dll.tmp	2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\unpack200.exe.tmp	2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-ul-phn.xrm-ms.tmp	2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ul-phn.xrm-ms.tmp	2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\STSLISTI.DLL.tmp	2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.ProtectedData.dll.tmp	2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_cb790f9073a502b8342515c8423fb928_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-552508041-2681165170-3229858294-1000\desktop.ini.tmp
Size 65KB
SHA256 6e692e36a0b12c2a794689f18f6daafb49d723e55491ed2f8b904af915224c2f
MD5 460712207a58fcaed3d130b6621c6f13
SHA1 2aa9ca10e0a4b0ee7a8eb4b8f810f3c58d1269e4
SHA512 1c99b93a53bc599ffe3c16f67fc2420c3bd704084cb277f098b68c8e6fb8e52f80a19fd0e109fc800724a6edc6fb0d3cf3b29b67a6914c4b2dd90cf00bc05809
SSDEEP 768:/7BlpQpARFbhWGLF/MF/LEXBwzEXBwvqJFqJp7r:/7ZQpApP2I+x
TLSH
T1B963080E8A54885FF73AA7B68D6A30BE514214CD6B1EBFF2BD19CEC91C28D33451641E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7-zip.dll.tmp

Path C:\Program Files\7-Zip\7-zip.dll.tmp
Size 164KB
SHA256 7865c418fa958331d92841c9bd0792d9b212c37ce98dd359d3c04aff250c8dd1
MD5 a436cdfc9dd21ed64b3a9185f41c20ff
SHA1 9c7921b5153bc7aba8f1d4c2336738c218806aa8
SHA512 e32ada65bda75a4874f7f419821bc4d4abedab61a6145545626b960f2257067b66ffdecc161b7399e9ff1432939a1e23a71ac2e8d2d6c74ac14e1bbdc6f7cb42
SSDEEP 3072:9QWpP215ZMfTiu66I3UwqSsMBlsWb4A+E:LB2dMfTinqncsWp+E
TLSH
T140F317116CAEF6A5CB142379AD5B6DB78201388E3D0ECEB27A65D9E3443CD720C174E6
MD5 SHA1 SHA512 SSDEEP TLSH