cosmu | e99b9502a8f3fb72fe3d36e0a1eeb1a0dd3801668af14d42172fb81fafcf994e

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 14:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
Size 24KB
Sample261002-ryc5hs1ckd
SHA256 e99b9502a8f3fb72fe3d36e0a1eeb1a0dd3801668af14d42172fb81fafcf994e
MD5 540d37176d9009625dd696c92a01c612
SHA1 4bd5b8bacea0b86e4b930256c373afa5f9b3af00
SHA512 0a9557b2ed80c423541531f666563a4dbcc56a17d2bbbdc39dea780cfdd69aa816b3eeed9268e328b000a98f527730bb1d77c5c7745c9ab5a0805d3525957d1e
SSDEEP 192:NACUADIY0Br5xjL/uAgAQmP1oynLb22vPl2RHH/JFB2JyNomMmV:mBt7Br5xjLWAgA71FbhvPwR/s4N5
TLSH
T1BFB2F92F6A05847AD39A8034052E7438F973A0286731EE5BAB19CD3838776A0DC7964A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery cosmu ransomware worm

Malware Config

Signatures

Family: Cosmu
Cosmu is a Windows worm written in C++.
worm cosmu

Detects Cosmu payload 2 IoCs

Cosmu is a worm written in C++.

resource	yara_rule
behavioral2/files/0x000600000001b864-1.dat	family_cosmu
behavioral2/files/0x00030000000003ad-4.dat	family_cosmu

Renames multiple (4363) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-ul-oob.xrm-ms.tmp	2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-ul.xrm-ms.tmp	2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ul-oob.xrm-ms.tmp	2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.OData.NetFX35.dll.tmp	2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.dll.tmp	2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\VisualElements\SmallLogoBeta.png.tmp	2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial-Times New Roman.xml.tmp	2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Grace-ppd.xrm-ms.tmp	2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-ul-oob.xrm-ms.tmp	2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_F_COL.HXK.tmp	2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\PresentationFramework-SystemDrawing.dll.tmp	2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe.tmp	2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libxml2.md.tmp	2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-pl.xrm-ms.tmp	2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymsl.ttf.tmp	2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
File created	C:\Program Files\7-Zip\Lang\co.txt.tmp	2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.tmp	2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll.tmp	2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\fr\System.Windows.Input.Manipulations.resources.dll.tmp	2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Integration\SPPRedist.msi.tmp	2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Grace-ul-oob.xrm-ms.tmp	2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTest-pl.xrm-ms.tmp	2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Tools.dll.tmp	2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Input.Manipulations.resources.dll.tmp	2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\instrument.dll.tmp	2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.tmp	2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.CSharp.dll.tmp	2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Linq.Queryable.dll.tmp	2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\UIAutomationClient.resources.dll.tmp	2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe.tmp	2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\WindowsBase.resources.dll.tmp	2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pl\System.Windows.Forms.Design.resources.dll.tmp	2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
File created	C:\Program Files\Internet Explorer\iexplore.exe.tmp	2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Grace-ul-oob.xrm-ms.tmp	2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui.tmp	2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui.tmp	2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationCore.resources.dll.tmp	2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jar.exe.tmp	2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\cacerts.tmp	2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\WindowsAccessBridge-64.dll.tmp	2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-ppd.xrm-ms.tmp	2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\InkObj.dll.mui.tmp	2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msdaremr.dll.mui.tmp	2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Threading.dll.tmp	2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\System.Windows.Forms.Design.resources.dll.tmp	2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ul-oob.xrm-ms.tmp	2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Security.dll.tmp	2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\currency.data.tmp	2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Tw Cen MT.xml.tmp	2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PPINTL.DLL.tmp	2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\eula.dll.tmp	2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-ppd.xrm-ms.tmp	2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.resources.dll.tmp	2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-ppd.xrm-ms.tmp	2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.OleDbInterop.dll.tmp	2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationFramework.resources.dll.tmp	2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ja\PresentationUI.resources.dll.tmp	2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_elf.dll.tmp	2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\jcup.md.tmp	2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ul-oob.xrm-ms.tmp	2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.dll.tmp	2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jli.dll.tmp	2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-ppd.xrm-ms.tmp	2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial3-ppd.xrm-ms.tmp	2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_540d37176d9009625dd696c92a01c612_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-696679853-3915825385-3233721679-1000\desktop.ini.tmp
Size 24KB
SHA256 584ee247fa7b88b8555215e32881ac8fa5a1ea8ba5644a38d7473419611e0f47
MD5 26e6f0049974fcdb9f5ff84d2f339664
SHA1 7f5f4488b3bdfc2a1f4fc60d12bfedaec54233f8
SHA512 bd874faecd0654014663299f1d2fd8db11d381485d723abdb68763f170eb9a83230b46ada9a5a896a5d1545c385568a73039209985796a27dbfcbb41c254cf42
SSDEEP 192:NACUADIY0Br5xjL/uAgAQmP1oynLb22vPl2RHH/JFB2JyNomMmB:mBt7Br5xjLWAgA71FbhvPwR/s4NV
TLSH
T136B2092F6A15807BD3998034053F7478F933A0286735FF9BAB19CD3828776A0DC7925A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7-zip.chm.tmp

Path C:\Program Files\7-Zip\7-zip.chm.tmp
Size 141KB
SHA256 45c0564fdaf30871f38c69cc3d7374c46bd5428c4b69c27e6f6937f3e4380dce
MD5 e365806fd835601182cea7976e95df02
SHA1 b487eac076f8547de3dd24e5661d23481ceb68d9
SHA512 6fbb252d3af58e69654ff6d15abd576c6619b5e5a8856f434c16c2e4a9f04ef5443bb7a7e31cb01551c64a873a9d6befb9e81bf2a919daff201f7bd87f01b5d3
SSDEEP 3072:a6Wpk+wxMxdrwdaEMePCUlZVpnwzuGSsOOOa:Yi+wxMxFELMO9wapsOZa
TLSH
T18EE3026B36941426DB5B41381253E43E73B33C491611CF437F9ACA1E26F6BA9B43A31B
MD5 SHA1 SHA512 SSDEEP TLSH