cosmu | 836086be55ee72b804f39f13587aeef6f7cf7e33e733b973f82076ed83cffa27

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 06:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe
Size 308KB
Sample260831-hm25tsfa75
SHA256 836086be55ee72b804f39f13587aeef6f7cf7e33e733b973f82076ed83cffa27
MD5 acf4dfffbcae39348b97797ab908b302
SHA1 6f7172677f536bf4f24f51624e3a6955fad0e5b5
SHA512 63959c4239cd244f65480ff5f4834e2bfb8ab8b439cbc7609960355091d02182ac02c71ee26c07fd8904c4799a21f7289ab55488151c442be281a2b6081cd5a1
SSDEEP 6144:0HxJMbIz43aFEB5gV2suoYFVxRzXq73hsq/mMyRCxZLHJihl:GPkI4aFEDgV25TVxRTm3hhF6CrLMhl
TLSH
T1B1649E550D6BF192CFC31D71B0BB7F210839A123EE5D89A78AE031456DE6F04B1EA25B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery cosmu ransomware worm

Malware Config

Signatures

Family: Cosmu
Cosmu is a Windows worm written in C++.
worm cosmu

Detects Cosmu payload 4 IoCs

Cosmu is a worm written in C++.

resource	yara_rule
behavioral2/memory/4544-0-0x0000000000400000-0x000000000040A000-memory.dmp	family_cosmu
behavioral2/files/0x000b00000001b1a4-2.dat	family_cosmu
behavioral2/files/0x000300000001b1a7-6.dat	family_cosmu
behavioral2/memory/4544-428-0x0000000000400000-0x000000000040A000-memory.dmp	family_cosmu

Detects executables packed with eXPressor 4 IoCs

resource	yara_rule
behavioral2/memory/4544-0-0x0000000000400000-0x000000000040A000-memory.dmp	INDICATOR_EXE_Packed_eXPressor
behavioral2/files/0x000b00000001b1a4-2.dat	INDICATOR_EXE_Packed_eXPressor
behavioral2/files/0x000300000001b1a7-6.dat	INDICATOR_EXE_Packed_eXPressor
behavioral2/memory/4544-428-0x0000000000400000-0x000000000040A000-memory.dmp	INDICATOR_EXE_Packed_eXPressor

Renames multiple (3059) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebSockets.Client.dll.tmp	2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Debug.dll.tmp	2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\lib\amd64\jvm.cfg.tmp	2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\javaws.policy.tmp	2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Client\C2R64.dll.tmp	2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-pl.xrm-ms.tmp	2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml.tmp	2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\ReachFramework.resources.dll.tmp	2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Diagnostics.PerformanceCounter.dll.tmp	2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\System.Windows.Input.Manipulations.resources.dll.tmp	2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Candara.xml.tmp	2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ppd.xrm-ms.tmp	2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe
File created	C:\Program Files\7-Zip\Lang\da.txt.tmp	2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\Microsoft.Win32.Registry.AccessControl.dll.tmp	2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pl\System.Windows.Forms.resources.dll.tmp	2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Primitives.dll.tmp	2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Xml.ReaderWriter.dll.tmp	2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.Design.resources.dll.tmp	2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\WindowsBase.resources.dll.tmp	2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-runtime-l1-1-0.dll.tmp	2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\javacpl.cpl.tmp	2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-ppd.xrm-ms.tmp	2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui.tmp	2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.dll.tmp	2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\PresentationFramework.resources.dll.tmp	2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationClientSideProviders.dll.tmp	2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Xaml.resources.dll.tmp	2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationUI.resources.dll.tmp	2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-private-l1-1-0.dll.tmp	2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\icu.md.tmp	2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe
File created	C:\Program Files\7-Zip\Lang\mng2.txt.tmp	2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\ReachFramework.resources.dll.tmp	2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\gstreamer-lite.dll.tmp	2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.tmp	2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.tmp	2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml.tmp	2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Numerics.dll.tmp	2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\PresentationFramework.Royale.dll.tmp	2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\UIAutomationProvider.resources.dll.tmp	2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Windows.Controls.Ribbon.dll.tmp	2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-time-l1-1-0.dll.tmp	2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jfr.dll.tmp	2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe
File created	C:\Program Files\7-Zip\Lang\sa.txt.tmp	2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l1-1-0.dll.tmp	2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Debug.dll.tmp	2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\hr.pak.tmp	2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp	2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md.tmp	2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml.tmp	2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-pl.xrm-ms.tmp	2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui.tmp	2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Ping.dll.tmp	2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Runtime.Extensions.dll.tmp	2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jsse.jar.tmp	2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\fxplugins.dll.tmp	2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Formatters.dll.tmp	2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\giflib.md.tmp	2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-ppd.xrm-ms.tmp	2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui.tmp	2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Dynamic.Runtime.dll.tmp	2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Tracing.dll.tmp	2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationClient.resources.dll.tmp	2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe
File created	C:\Program Files\Internet Explorer\it-IT\ieinstal.exe.mui.tmp	2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-30_acf4dfffbcae39348b97797ab908b302_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-1079202589-886135813-2527035092-1000\desktop.ini.tmp
Size 308KB
SHA256 46d4960ba5f07b059fdafa7968de103959f08a3b959086db1e914dd1e238eb06
MD5 ede9112b01a5dab00fc0bacf9132d5de
SHA1 23fc2b9c848b22935a8506692f5d6e4edf45b750
SHA512 ba8b45b4d3a91838753f16119dc458d3a2b93dadf1ef5134b587cb479aa192d2066aa61cf6fd9b07fb3b21c70fe0f00cdbbd0fcbb103fad231882c53d70d6088
SSDEEP 6144:0HxJMbIz43aFEB5gV2suoYFVxRzXq73hsq/mMyRCxZLHJiha:GPkI4aFEDgV25TVxRTm3hhF6CrLMha
TLSH
T14B649E550D6BF192CFC31D71B0BB7F210839A123EE5D89A78AE031456DE6F04B1EA25B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7-zip.dll.tmp

Path C:\Program Files\7-Zip\7-zip.dll.tmp
Size 407KB
SHA256 e0fb6eda5b32717c5bac0b11ca44749ae1e9fcfc548318a140489d7132ccb1c0
MD5 9a99246c5f8e93daa46fc37ec7112b4f
SHA1 f44a90bd3f9d4fb1a5249764a4339f1e13773fad
SHA512 accad1321bcd57ca6f12c9416ae845dbe27866c8b7b1a6294f905e648732e8709df32d8bb9b6c207fdddd896ba644b9b3fdd14d5a4e77c1dcba3c10a14ba4892
SSDEEP 12288:GPkI4aFEDgV25TVxRTm3hhF6CrLMhpMfunbsW8b:G94aFEDgI5hihF6cLYpMfSgWA
TLSH
T199948C501CAEF291CFC31A75B46B7F438224B16BBD4DCD62A6F031925D79E0428EB1A7
MD5 SHA1 SHA512 SSDEEP TLSH