cosmu | 63005d92ccc5775bbc8d29c33e59f8eb392b62fdde2fb724df00e31bd5a62440

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 18:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe
Size 92KB
Sample260816-wlj5hstepd
SHA256 63005d92ccc5775bbc8d29c33e59f8eb392b62fdde2fb724df00e31bd5a62440
MD5 56388c1cb906af6fa41a5a27935ee500
SHA1 01d6a4a551df5df6854b9f8df216e13da71617da
SHA512 ccf8931f081c8699230ae6d3c3354c12f396a33b3a1deb1b7788d33ab79eb69308133feb407e6f9fef5dc17b1131791b63aca05f661b712ffd658d1804a99306
SSDEEP 1536:R7Z3pAp6qGpJ4YiMxDvmIcKmyG8b5JidMumda3XmU+EM9UJPPpQy9+gvr9A2/nyn:73Wp6qGE+AyG8eF3XmEM9UJPPpQy9+gE
TLSH
T1BA93B69F3DC49792D824043EA053D0602DD3DE60FD4CCAF6B69AAAE8CDD68751A2435F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery cosmu ransomware worm

Malware Config

Signatures

Family: Cosmu
Cosmu is a Windows worm written in C++.
worm cosmu

Detects Cosmu payload 4 IoCs

Cosmu is a worm written in C++.

resource	yara_rule
behavioral2/memory/3188-0-0x0000000000400000-0x000000000040A000-memory.dmp	family_cosmu
behavioral2/files/0x000f00000001b664-2.dat	family_cosmu
behavioral2/files/0x000300000001b1af-6.dat	family_cosmu
behavioral2/memory/3188-526-0x0000000000400000-0x000000000040A000-memory.dmp	family_cosmu

Detects executables packed with eXPressor 4 IoCs

resource	yara_rule
behavioral2/memory/3188-0-0x0000000000400000-0x000000000040A000-memory.dmp	INDICATOR_EXE_Packed_eXPressor
behavioral2/files/0x000f00000001b664-2.dat	INDICATOR_EXE_Packed_eXPressor
behavioral2/files/0x000300000001b1af-6.dat	INDICATOR_EXE_Packed_eXPressor
behavioral2/memory/3188-526-0x0000000000400000-0x000000000040A000-memory.dmp	INDICATOR_EXE_Packed_eXPressor

Renames multiple (4220) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\blacklist.tmp	2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-util-l1-1-0.dll.tmp	2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-ppd.xrm-ms.tmp	2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-ul-oob.xrm-ms.tmp	2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_F_COL.HXK.tmp	2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Diagnostics.PerformanceCounter.dll.tmp	2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\fxplugins.dll.tmp	2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\lib\cmm\GRAY.pf.tmp	2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-ul-oob.xrm-ms.tmp	2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ul-oob.xrm-ms.tmp	2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SOCIALCONNECTORRES.DLL.tmp	2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Resources.Reader.dll.tmp	2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\UIAutomationClient.resources.dll.tmp	2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\w2k_lsa_auth.dll.tmp	2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-root.xrm-ms.tmp	2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-ppd.xrm-ms.tmp	2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ul-oob.xrm-ms.tmp	2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Requests.dll.tmp	2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\coreclr.dll.tmp	2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationProvider.resources.dll.tmp	2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\PresentationUI.resources.dll.tmp	2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.tmp	2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-ppd.xrm-ms.tmp	2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Controls.Ribbon.resources.dll.tmp	2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe
File created	C:\Program Files\Common Files\System\msadc\msaddsr.dll.tmp	2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.AppContext.dll.tmp	2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Net.Http.Json.dll.tmp	2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationTypes.resources.dll.tmp	2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Aero2.dll.tmp	2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\wpfgfx_cor3.dll.tmp	2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\nl.pak.tmp	2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Document.XmlSerializers.dll.tmp	2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe
File created	C:\Program Files\7-Zip\7zFM.exe.tmp	2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationClient.resources.dll.tmp	2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\vcruntime140_1.dll.tmp	2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_CN.properties.tmp	2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTrial-ppd.xrm-ms.tmp	2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ExcelNaiveBayesCommandRanker.txt.tmp	2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Forms.Primitives.resources.dll.tmp	2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-string-l1-1-0.dll.tmp	2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md.tmp	2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-pl.xrm-ms.tmp	2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Trial-ppd.xrm-ms.tmp	2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe.tmp	2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe.tmp	2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-pl.xrm-ms.tmp	2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ro-ro.dll.tmp	2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Principal.Windows.dll.tmp	2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\[email protected]	2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\lib\jvm.hprof.txt.tmp	2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-ul-oob.xrm-ms.tmp	2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.tmp	2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\Microsoft.Ink.Intelligence.TextInput.Skill.dll.tmp	2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp	2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\ReachFramework.resources.dll.tmp	2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\jpeg_fx.md.tmp	2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Grace-ul-oob.xrm-ms.tmp	2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-pl.xrm-ms.tmp	2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationFramework.resources.dll.tmp	2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui.tmp	2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\lb-LU\tipresx.dll.mui.tmp	2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_56388c1cb906af6fa41a5a27935ee500_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3188

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini.tmp
Size 92KB
SHA256 2d59b3da2b6b9cb5f0646828ee4bee0e2f63a64e7050701e78340a283e6cef11
MD5 7d9ef4151da00db2db74614e9750e9f9
SHA1 6e399d3bb91c3e2e593ea69b53449d1b00abfbcc
SHA512 51f8ff6cb628c850b49a7cabff90fb7ca5a78b29513ab1cb73ae5e68f6d5986344780a749cbb988e61facc178eb29bd7d7f4f43672cf5e8b9c4915c70de144c7
SSDEEP 1536:R7Z3pAp6qGpJ4YiMxDvmIcKmyG8b5JidMumda3XmU+EM9UJPPpQy9+gvr9A2/nym:73Wp6qGE+AyG8eF3XmEM9UJPPpQy9+gV
TLSH
T14493B65F3DC49792D824043EA053D0602DD3DE60FD4CCAB6F69AAAE8CDD68751A2436F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7-zip.dll.tmp

Path C:\Program Files\7-Zip\7-zip.dll.tmp
Size 191KB
SHA256 dc56b73913869d932e6abbbef8a127cc2f69551f0bcda90d578cc1aadb6e55e0
MD5 e8d3942598c663cd931d6eca9adf6287
SHA1 582ed2034e38e4e8c414a043225c209f0c50100e
SHA512 c1ad072e283a7552d4146701a7ff31e09f02bc76be9e5f81114c6950174f71bb7239a3c4ac00648481d82e3d96860b77be61819e4fb523299fb4afecc3dab6d3
SSDEEP 3072:73Wp6qGE+AyG8eF3XmEM9UJPPpQy9+gTr5ZMfTiu66I3UwqSsMBlsWb4A+w:6ME+AyG8eF3WEM9UJHpH9+g/MfTinqnw
TLSH
T142143B5A3CCDF3A1CD10013DA857D94296C3EE4A7C4CCEA2B6A655E6C9ADC600C573AF
MD5 SHA1 SHA512 SSDEEP TLSH