cosmu | 3b0ad6e9341ad26dfcb8bf8e5d7e1f131eca46885818c20b8671b4974e6c8fba

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 12:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe
Size 26KB
Sample260823-pvsppagn7x
SHA256 3b0ad6e9341ad26dfcb8bf8e5d7e1f131eca46885818c20b8671b4974e6c8fba
MD5 0ef46062ef56372badb2110eb4dac867
SHA1 7bf5e8215261c8b8631df8ec7e018aac0a6c98c6
SHA512 313bbb03a94258e2f20ade386ffbc22e376b56d97589b71539472cd6958884cc459184e2c63cfcc59fcf213620317da655690b76c527a30e44ce2edf5415660a
SSDEEP 384:TBt7Br5xjL9AgA71Fbhv/r+k7ha3fzpsVvUaWq9C7:37BlpppARFbh6qMpim2
TLSH
T116C24B5E8B49C072C38550305D2F787D9CB7443C6E26DB6BAB56CC18AABA3D0FC3915A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery cosmu ransomware worm

Malware Config

Signatures

Family: Cosmu
Cosmu is a Windows worm written in C++.
worm cosmu

Detects Cosmu payload 4 IoCs

Cosmu is a worm written in C++.

resource	yara_rule
behavioral2/memory/3052-0-0x0000000000400000-0x0000000000409D5C-memory.dmp	family_cosmu
behavioral2/files/0x0009000000011380-2.dat	family_cosmu
behavioral2/files/0x000300000001b1af-6.dat	family_cosmu
behavioral2/memory/3052-558-0x0000000000400000-0x0000000000409D5C-memory.dmp	family_cosmu

Detects executables packed with eXPressor 4 IoCs

resource	yara_rule
behavioral2/memory/3052-0-0x0000000000400000-0x0000000000409D5C-memory.dmp	INDICATOR_EXE_Packed_eXPressor
behavioral2/files/0x0009000000011380-2.dat	INDICATOR_EXE_Packed_eXPressor
behavioral2/files/0x000300000001b1af-6.dat	INDICATOR_EXE_Packed_eXPressor
behavioral2/memory/3052-558-0x0000000000400000-0x0000000000409D5C-memory.dmp	INDICATOR_EXE_Packed_eXPressor

Renames multiple (4406) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Internet Explorer\uk-UA\iexplore.exe.mui.tmp	2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationProvider.resources.dll.tmp	2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.resources.dll.tmp	2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ja\UIAutomationProvider.resources.dll.tmp	2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\glib-lite.dll.tmp	2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libxml2.md.tmp	2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\lib\content-types.properties.tmp	2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\lcms.dll.tmp	2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-ppd.xrm-ms.tmp	2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\XLMACRO.CHM.tmp	2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.tmp	2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\pt-BR.pak.tmp	2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-ppd.xrm-ms.tmp	2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.tmp	2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sk-SK\tipresx.dll.mui.tmp	2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee100.tlb.tmp	2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Claims.dll.tmp	2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\PresentationUI.resources.dll.tmp	2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\ta.pak.tmp	2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe.tmp	2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ul-phn.xrm-ms.tmp	2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\nashorn.jar.tmp	2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win8.mp4.tmp	2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-ppd.xrm-ms.tmp	2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-pl.xrm-ms.tmp	2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_COL.HXC.tmp	2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml.tmp	2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\hi.pak.tmp	2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-xstate-l2-1-0.dll.tmp	2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Windows.Presentation.dll.tmp	2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\tr\ReachFramework.resources.dll.tmp	2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\RepoMan.dll.tmp	2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages.properties.tmp	2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-conio-l1-1-0.dll.tmp	2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\java_crw_demo.dll.tmp	2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-ul-oob.xrm-ms.tmp	2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Grace-ul-oob.xrm-ms.tmp	2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ul-phn.xrm-ms.tmp	2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml.tmp	2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Controls.Ribbon.resources.dll.tmp	2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\WindowsBase.resources.dll.tmp	2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\System.Windows.Controls.Ribbon.resources.dll.tmp	2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI.tmp	2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Author2String.XSL.tmp	2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ar-sa.dll.tmp	2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe
File created	C:\Program Files\Common Files\System\ado\msado28.tlb.tmp	2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Input.Manipulations.dll.tmp	2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\server\jvm.dll.tmp	2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe
File created	C:\Program Files\7-Zip\Lang\fa.txt.tmp	2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ne-NP\tipresx.dll.mui.tmp	2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\PresentationFramework.Aero.dll.tmp	2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_pt_BR.properties.tmp	2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-pl.xrm-ms.tmp	2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\ReachFramework.resources.dll.tmp	2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\include\classfile_constants.h.tmp	2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-pl.xrm-ms.tmp	2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ul-phn.xrm-ms.tmp	2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Input.Manipulations.resources.dll.tmp	2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.Win32.Registry.AccessControl.dll.tmp	2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ppd.xrm-ms.tmp	2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ppd.xrm-ms.tmp	2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-pl.xrm-ms.tmp	2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-pl.xrm-ms.tmp	2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.DataIntegration.FuzzyMatchingCommon.dll.tmp	2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-22_0ef46062ef56372badb2110eb4dac867_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-2246396966-3025826688-3847171515-1000\desktop.ini.tmp
Size 26KB
SHA256 87c6e142185eadb7d99fd808244f2ca329d82aabe2db05534e40277a65cc3ee3
MD5 5be2e9645349062bc39adf996f772e29
SHA1 4f43a5c13457f7513f42d0bec01285d30cfba23f
SHA512 85c1dec7e59d5b8eccd093ca64d7d0990f226843d033629b776f822b66729f7eb7cf03c71d9006c33631fb504a5710f9498b435888de85f5545ca92c0f39e0db
SSDEEP 384:TBt7Br5xjL9AgA71Fbhv/r+k7ha3fzpsVvUaWq9C7c:37BlpppARFbh6qMpim2j
TLSH
T13BC24B5E8B49C032C38550346D2F787D9DB7403C6E26DBA7EB568C18AAB63D0FC3911A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7-zip.dll.tmp

Path C:\Program Files\7-Zip\7-zip.dll.tmp
Size 125KB
SHA256 c78f95086c47c5a1fe7a8420ebb86c41009990ece899afdaeaa159cab39fa2c0
MD5 c0ecadefffbb501f5655bde89f2bd921
SHA1 344fc7b8f1faad8d4ecfdec8b1649eb6340e6e5b
SHA512 773e2a67d1b7cbde4be574a032cb12f04c8a52d32fa11ff84ae770595eb92e0471ec7abef7b944792a32f701d60980a9338a85cc1ed364d21f0be09c1c1c6135
SSDEEP 3072:1pWp6qMV5ZMfTiu66I3UwqSsMBlsWb4A+en:iK9MfTinqncsWp+en
TLSH
T1E9C3E5617CAEF6A0CF441239AD6B7E83C305398F3C5ACE4276A515E3913CD910C9B4E6
MD5 SHA1 SHA512 SSDEEP TLSH