cosmu | cda09203c21c0db51563e721f4cc4cb0f32f9d14e4854407381347db360710a9

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 09:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe
Size 81KB
Sample260729-llff8adm6v
SHA256 cda09203c21c0db51563e721f4cc4cb0f32f9d14e4854407381347db360710a9
MD5 38be3b2f0081a64872923606608951c2
SHA1 8724f94af1a25dd517d15a5f32b54a1791ab5934
SHA512 2693ff5fc433663416cafd2a06f51e27759d5117cbf4b5b5e2e0a766daa0fa888ed5121f306cf16e512135ead47d023c2ee16bc8ae897074a18592721f16f273
SSDEEP 1536:p7ZhA7dAp1++PJHJXA/OsIZfzc3/Q8asUsJOLKlDKEOEr:Te76WQSohsUsUKlDKEOEr
TLSH
T143837C2BCF10E426D11A78359D2B3764DE31AEC87F1BF8FBAEA154E51C627C1B505029
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery cosmu ransomware worm

Malware Config

Signatures

Family: Cosmu
Cosmu is a Windows worm written in C++.
worm cosmu

Detects Cosmu payload 2 IoCs

Cosmu is a worm written in C++.

resource	yara_rule
behavioral2/files/0x0011000000019cbf-1.dat	family_cosmu
behavioral2/files/0x000300000001b1d9-5.dat	family_cosmu

Renames multiple (4080) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ul-oob.xrm-ms.tmp	2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ppd.xrm-ms.tmp	2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml.tmp	2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.ComponentModel.Primitives.dll.tmp	2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationUI.resources.dll.tmp	2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PenImc_cor3.dll.tmp	2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\cs\System.Windows.Forms.resources.dll.tmp	2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp	2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xmlresolver.md.tmp	2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-ppd.xrm-ms.tmp	2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.it-it.dll.tmp	2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Presentation.dll.tmp	2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_100_percent.pak.tmp	2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-ppd.xrm-ms.tmp	2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ul-phn.xrm-ms.tmp	2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebSockets.dll.tmp	2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.Design.resources.dll.tmp	2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\npt.dll.tmp	2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\colorimaging.md.tmp	2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md.tmp	2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ospintl.dll.tmp	2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Resources.Reader.dll.tmp	2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\pkcs11wrapper.md.tmp	2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightItalic.ttf.tmp	2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\net.properties.tmp	2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\lib\classlist.tmp	2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Glossy.eftx.tmp	2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.NonGeneric.dll.tmp	2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.CoreLib.dll.tmp	2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Grace-ppd.xrm-ms.tmp	2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-pl.xrm-ms.tmp	2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ul-oob.xrm-ms.tmp	2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ul-oob.xrm-ms.tmp	2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.Extensions.dll.tmp	2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\w2k_lsa_auth.dll.tmp	2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Trial-ul-oob.xrm-ms.tmp	2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe
File created	C:\Program Files\7-Zip\Lang\ru.txt.tmp	2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ja\System.Windows.Forms.Primitives.resources.dll.tmp	2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\System.Windows.Forms.resources.dll.tmp	2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tabskb.dll.mui.tmp	2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Xaml.resources.dll.tmp	2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationFramework.resources.dll.tmp	2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Configuration.ConfigurationManager.dll.tmp	2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe.tmp	2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java_crw_demo.dll.tmp	2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-pl.xrm-ms.tmp	2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Diagnostics.Tools.dll.tmp	2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationUI.resources.dll.tmp	2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe.tmp	2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml.tmp	2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.dll.tmp	2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.AppContext.dll.tmp	2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaSansDemiBold.ttf.tmp	2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\glib.md.tmp	2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\glass.dll.tmp	2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe
File created	C:\Program Files\7-Zip\Lang\ca.txt.tmp	2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Numerics.dll.tmp	2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-pl.xrm-ms.tmp	2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe.tmp	2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationClientSideProviders.resources.dll.tmp	2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe.tmp	2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md.tmp	2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ul-phn.xrm-ms.tmp	2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_38be3b2f0081a64872923606608951c2_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-189034102-168398478-1159367937-1000\desktop.ini.tmp
Size 81KB
SHA256 f53c16bc722cf093bc6aadd3a929fa991cd76ec07b1615cc9f1fe901fd3aa04b
MD5 d98c959888aa725dc0203ded68c54f63
SHA1 52ee7dec04cb3070ee815b2a7218a78162b3ac36
SHA512 27bba9f725ca3fcfdeed4261afe7197c1bbb9b6fd84db1016619b78613b3a469c3f10473e329b8c6bb6117afa8e3510f9c586cc173a842e22dd25c0845496502
SSDEEP 1536:p7ZhA7dAp1++PJHJXA/OsIZfzc3/Q8asUsJOLKlDKEOEj:Te76WQSohsUsUKlDKEOEj
TLSH
T12A837C2BCF10E426D11A78359D2B3764DE31AEC87F1BF8FBAEA154E91C627C1B505029
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7-zip.dll.tmp

Path C:\Program Files\7-Zip\7-zip.dll.tmp
Size 180KB
SHA256 8d3ba72bbb3bc9721c25ca5bc83a9af689b39396639c78101df9a5d043285996
MD5 bc7868744f4f0e43e54810a3772466f2
SHA1 36f3592d349107fb60b334b24a762fad79bfcd75
SHA512 e2c0bf992c73c7037d60c00889339b61688c8e1e1a45607f14b6c6bf9f8c5c96fd4b38df4a3650c3a081a29e444f1e4fa969c7293ea4d05aff1f576962e89e9f
SSDEEP 3072:Te76WQSohsUsUKlDKEOEp5ZMfTiu66I3UwqSsMBlsWb4A+E:SeWQSohsUsLDVMfTinqncsWp+E
TLSH
T1460429627F69F560CA442239AD1B6E43CF013DCA3F5AEDE67EA115E34C39AC11C470A6
MD5 SHA1 SHA512 SSDEEP TLSH