cosmu | 324482d894f1faff9a0857414e08b5ae65d9552e61f870b3af8d1c1967465b0c

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 02:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe
Size 26KB
Sample260827-cng86ayerf
SHA256 324482d894f1faff9a0857414e08b5ae65d9552e61f870b3af8d1c1967465b0c
MD5 f55a63d942848a73a9f0715b42818904
SHA1 c53ad5ec58500b1e0a32bb400bf67bd6e7be08dd
SHA512 cbe81cc4d01bfcb41d3683f6093a41507e040f2d7facf0c404eb5194727623f5c254cbd6bfca7d0c91c325b4971f0b07f3652c8b4f938a90d2e80a76a3446ff8
SSDEEP 384:TBt7Br5xjL9AgA71Fbhv/r+k7ha34azpsVvUaWq9C7:37BlpppARFbh6qcpim2
TLSH
T141C24B5E8B49C032C38550305D2F787D9CB7443C6E26DB6BAB568D18AAB63D0FC3915A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery cosmu ransomware worm

Malware Config

Signatures

Family: Cosmu
Cosmu is a Windows worm written in C++.
worm cosmu

Detects Cosmu payload 4 IoCs

Cosmu is a worm written in C++.

resource	yara_rule
behavioral2/memory/4456-0-0x0000000000400000-0x0000000000409D5C-memory.dmp	family_cosmu
behavioral2/files/0x002a000000011561-2.dat	family_cosmu
behavioral2/files/0x000300000001b1a0-6.dat	family_cosmu
behavioral2/memory/4456-596-0x0000000000400000-0x0000000000409D5C-memory.dmp	family_cosmu

Detects executables packed with eXPressor 4 IoCs

resource	yara_rule
behavioral2/memory/4456-0-0x0000000000400000-0x0000000000409D5C-memory.dmp	INDICATOR_EXE_Packed_eXPressor
behavioral2/files/0x002a000000011561-2.dat	INDICATOR_EXE_Packed_eXPressor
behavioral2/files/0x000300000001b1a0-6.dat	INDICATOR_EXE_Packed_eXPressor
behavioral2/memory/4456-596-0x0000000000400000-0x0000000000409D5C-memory.dmp	INDICATOR_EXE_Packed_eXPressor

Renames multiple (4866) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ru-ru.dll.tmp	2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Quic.dll.tmp	2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp	2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationCore.resources.dll.tmp	2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ul-phn.xrm-ms.tmp	2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-100.png.tmp	2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe
File created	C:\Program Files\7-Zip\Lang\mk.txt.tmp	2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-convert-l1-1-0.dll.tmp	2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.CompilerServices.Unsafe.dll.tmp	2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack2019_eula.txt.tmp	2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Linq.Parallel.dll.tmp	2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\WindowsBase.dll.tmp	2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\tr\System.Windows.Forms.Design.resources.dll.tmp	2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe.tmp	2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_Subscription-ppd.xrm-ms.tmp	2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ul-oob.xrm-ms.tmp	2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ppd.xrm-ms.tmp	2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-100.png.tmp	2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\WindowsBase.resources.dll.tmp	2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\el\msipc.dll.mui.tmp	2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ObjectModel.dll.tmp	2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Input.Manipulations.resources.dll.tmp	2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.AdHoc.Excel.Client.dll.tmp	2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql90.xsl.tmp	2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.ZipFile.dll.tmp	2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.cpl.tmp	2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-pl.xrm-ms.tmp	2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.OleDbProvider.dll.tmp	2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mset7jp.kic.tmp	2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\PresentationFramework.resources.dll.tmp	2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Trial-pl.xrm-ms.tmp	2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.IO.Compression.FileSystem.dll.tmp	2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationProvider.resources.dll.tmp	2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\pt-PT.pak.tmp	2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ul-phn.xrm-ms.tmp	2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-ppd.xrm-ms.tmp	2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_KMS_Client-ppd.xrm-ms.tmp	2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\msinfo32.exe.mui.tmp	2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.NetworkInformation.dll.tmp	2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.X509Certificates.dll.tmp	2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ul-phn.xrm-ms.tmp	2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe
File created	C:\Program Files\7-Zip\Lang\sa.txt.tmp	2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Sockets.dll.tmp	2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\resources.pak.tmp	2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe.tmp	2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Grace-ppd.xrm-ms.tmp	2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe
File created	C:\Program Files\7-Zip\Lang\ky.txt.tmp	2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\tr\UIAutomationTypes.resources.dll.tmp	2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\policytool.exe.tmp	2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Grace-ul-oob.xrm-ms.tmp	2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Spatial.NetFX35.dll.tmp	2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\mscordaccore_amd64_amd64_8.0.1525.16413.dll.tmp	2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.Primitives.resources.dll.tmp	2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\public_suffix.md.tmp	2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\jsoundds.dll.tmp	2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-pl.xrm-ms.tmp	2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.ComponentModel.dll.tmp	2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Net.Http.Json.dll.tmp	2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Reflection.Primitives.dll.tmp	2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.Xml.dll.tmp	2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-conio-l1-1-0.dll.tmp	2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-pl.xrm-ms.tmp	2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-26_f55a63d942848a73a9f0715b42818904_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-1014449518-1831897916-4205727055-1000\desktop.ini.tmp
Size 26KB
SHA256 884a32e9f3c68ed235b53d9c67b993abc2780926cd96f25d3d129cd15125b936
MD5 260f8092e228abdb1ecfe0540abf55df
SHA1 d3b7d7e202fd545597b3353f1c08b084c03a8d9d
SHA512 20dea3599a3cc3137c0cbf453d77165cb6ac0f33b9271881016e16da5b001eac48c275bcc02f3fbea5fb4029a85180e83f9d9b76ebfeeb584dba6318ba49469b
SSDEEP 384:TBt7Br5xjL9AgA71Fbhv/r+k7ha34azpsVvUaWq9C78:37BlpppARFbh6qcpim2j
TLSH
T114C24B5E8B49C032C38550306D2F787D9DB7443C6E26DBA7AB568D18AAB63D0FC3811A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7-zip.dll.tmp

Path C:\Program Files\7-Zip\7-zip.dll.tmp
Size 125KB
SHA256 f90b7e68dd4732d73e46281fa85452e686a5b7b1fc4030b270f1b9e141285cb1
MD5 0274b7f0abc765b9c619b5181b48884b
SHA1 0e8b7ffb887152dce00ee201e984e1c16683c3de
SHA512 84b1dd38ce57d9e0e9723fa288b05b9b65219b29b18c4fe2b8db4afa8051eae9933682ee7a9b5a71a9611838467ee034e3d97dda1f09fff1a812e582bb8df830
SSDEEP 3072:1pWp6qcR5ZMfTiu66I3UwqSsMBlsWb4A+en:i+hMfTinqncsWp+en
TLSH
T13AC3E5617CAEF6A0CF441239AD6BBE83C305398F3C5ACE4276A515E3913CD950C9B4E6
MD5 SHA1 SHA512 SSDEEP TLSH