cosmu | 777c0a5971a5254038a44b422dbb3bc8c85fee7413b3204fcc2899c1c35b33d4

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 00:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe
Size 116KB
Sample260729-arydfazgrf
SHA256 777c0a5971a5254038a44b422dbb3bc8c85fee7413b3204fcc2899c1c35b33d4
MD5 bf266373214af7ea4eee89539eec4548
SHA1 a711f10965d8bb74805bb0ba5053e75c48427f24
SHA512 cc5556651e5f3d952bb5a7ce7fac7812fce56d6ad23116947b2c116530d7b68e8e5586f2c27e6841ee302b7cde61474a01c0505ff266607b80a17a389b59f972
SSDEEP 3072:6e7WpHIyRF9ESWu0SWuDmhSauvEKxVTLJtxoVz8FUDrYYaCusjdEKxVTLJtxoVzE:RqlIyFESWu0SWuGSw
TLSH
T100C38C2B8762F0A7E7960670402B797C9C6D5C347B36FDD7C6C2B8EE38B18A1555A00B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery cosmu ransomware worm

Malware Config

Signatures

Family: Cosmu
Cosmu is a Windows worm written in C++.
worm cosmu

Detects Cosmu payload 2 IoCs

Cosmu is a worm written in C++.

resource	yara_rule
behavioral2/files/0x000d00000001c5a1-1.dat	family_cosmu
behavioral2/files/0x000400000001b1b2-5.dat	family_cosmu

Renames multiple (3587) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll.tmp	2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\jfxrt.jar.tmp	2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Xml.Linq.dll.tmp	2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Diagnostics.EventLog.Messages.dll.tmp	2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\zipfs.jar.tmp	2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy.jar.tmp	2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-processthreads-l1-1-1.dll.tmp	2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Office 2007 - 2010.xml.tmp	2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms.tmp	2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Console.dll.tmp	2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Reflection.eftx.tmp	2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Word.Word.x-none.msi.16.x-none.xml.tmp	2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Grace-ppd.xrm-ms.tmp	2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms.tmp	2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Reflection.Primitives.dll.tmp	2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\fr\PresentationCore.resources.dll.tmp	2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe.tmp	2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md.tmp	2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ul-oob.xrm-ms.tmp	2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\j2gss.dll.tmp	2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\pkcs11wrapper.md.tmp	2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-ppd.xrm-ms.tmp	2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ul-oob.xrm-ms.tmp	2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-pl.xrm-ms.tmp	2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe
File created	C:\Program Files\Common Files\System\ado\msador15.dll.tmp	2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\gstreamer.md.tmp	2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\decora_sse.dll.tmp	2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md.tmp	2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe
File created	C:\Program Files\7-Zip\Lang\el.txt.tmp	2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Encoding.dll.tmp	2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Data.Common.dll.tmp	2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.IO.Compression.ZipFile.dll.tmp	2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\jsound.dll.tmp	2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml.tmp	2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-pl.xrm-ms.tmp	2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\WindowsBase.dll.tmp	2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Windows.dll.tmp	2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp	2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\javafx_font.dll.tmp	2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe.tmp	2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-ppd.xrm-ms.tmp	2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-pl.xrm-ms.tmp	2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.tmp	2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Collections.Immutable.dll.tmp	2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationNative_cor3.dll.tmp	2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\tr\WindowsFormsIntegration.resources.dll.tmp	2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\WindowsAccessBridge-64.dll.tmp	2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-pl.xrm-ms.tmp	2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-ul-oob.xrm-ms.tmp	2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ga-IE\tipresx.dll.mui.tmp	2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-console-l1-2-0.dll.tmp	2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.DiaSymReader.Native.amd64.dll.tmp	2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.MemoryMappedFiles.dll.tmp	2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\tr\System.Windows.Input.Manipulations.resources.dll.tmp	2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\hi.pak.tmp	2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.Primitives.dll.tmp	2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Orange Red.xml.tmp	2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-ul-oob.xrm-ms.tmp	2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial-pl.xrm-ms.tmp	2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOInstallerUI.dll.tmp	2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\ro.pak.tmp	2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_bf266373214af7ea4eee89539eec4548_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-2115213192-531537726-3295841909-1000\desktop.ini.tmp
Size 117KB
SHA256 e0468adda16e17ef25ad13573e0e748d5ac8673934930cc6d7b40881d08565e2
MD5 f94ca31dce1f646863268913b9889b39
SHA1 a6123f1cc73c4ca49e5fbbe854241e14f994cef7
SHA512 03b004d250fbe7802030448bd359c6081b8039831371f6ffd9f43918e12a9c0c2c865bebf49a679612916800c6c4d2f7638651edd468bf0e5ae07a37ebc99b83
SSDEEP 3072:6e7WpHIyRF9ESWu0SWuDmhSauvEKxVTLJtxoVz8FUDrYYaCusjdEKxVTLJtxoVz2:RqlIyFESWu0SWuGSa
TLSH
T199C38C2B8762F0A7E7960670402B797C9C6D5C347B36FDD7C6C2B8EE38B18A1555A00B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7-zip.dll.tmp

Path C:\Program Files\7-Zip\7-zip.dll.tmp
Size 215KB
SHA256 b97077dfbafa57f174afaffc142b7df9607bd31c3d1761eba0d612494ee7a8a8
MD5 a9658ad3b3f034635ac67507a62d3a94
SHA1 fa47f00af9e9ed613b0adcc17fd116900b833636
SHA512 7d1ce7fc1403e1cc0d2704433fb7f82c6207a552325929c0268acb664c7f71d8058df982d26676a10c95579f7703bbeb9d1e328c09e3b34c58005a0b3231f2cc
SSDEEP 3072:6e7WpHIyRF9ESWu0SWuDmhSauvEKxVTLJtxoVz8FUDrYYaCusjdEKxVTLJtxoVzm:RqlIyFESWu0SWuGSyMfTinqncsWp+u
TLSH
T1E7246C227DAEF1A1CF440379692B7E57CE093C5A3D2ADDC2A6E274E76438C910C5B097
MD5 SHA1 SHA512 SSDEEP TLSH