Overview

overview

10

Static

static

10

2026-10-06...ry.exe

windows10-2004-x64

10

2026-10-06...ry.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    07/10/2026, 16:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-06_fabb10b0ae894c4a1d14730f870d271f_coinminer_elex_wannacry.exe
  • Size 3.2MB
  • Sample261007-ve263sbz2x
  • SHA256 745387f2dca97bcc9e37828a132edf01a76ee06bfa912bfce1e6ed0d53c47d6f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
discoveryexecutioncosmupersistenceprivilege_escalationransomwareupxworm

Malware Config

Signatures

  • Family: Cosmu

    Cosmu is a Windows worm written in C++.

    wormcosmu
  • Detects Cosmu payload 6 IoCs

    Cosmu is a worm written in C++.

  • Renames multiple (1610) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • UPX dump on OEP (original entry point) 53 IoCs
  • Creates a file in the Startup directory 1 TTPs 3 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 4 IoCs
  • Drops file in System32 directory 3 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • UPX packed file 53 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 3 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 35 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-06_fabb10b0ae894c4a1d14730f870d271f_coinminer_elex_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-06_fabb10b0ae894c4a1d14730f870d271f_coinminer_elex_wannacry.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3528
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\2026-10-06_fabb10b0ae894c4a1d14730f870d271f_coinminer_elex_wannacry.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
      2⤵
      • Creates a file in the Startup directory
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      PID:4388
    • C:\Users\Admin\AppData\Local\Temp\2026-10-06_fabb10b0ae894c4a1d14730f870d271f_coinminer_elex_wannacry.exe
      C:\Users\Admin\AppData\Local\Temp\2026-10-06_fabb10b0ae894c4a1d14730f870d271f_coinminer_elex_wannacry.exe
      2⤵
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2184
      • C:\Windows\SysWOW64\Zombie.exe
        "C:\Windows\system32\Zombie.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3372
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Windows\SysWOW64\Zombie.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
          4⤵
          • Creates a file in the Startup directory
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          PID:3404
        • C:\Windows\SysWOW64\Zombie.exe
          C:\Windows\SysWOW64\Zombie.exe
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          PID:1364
      • C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe
        "_desktop.ini.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4516
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
          4⤵
          • Creates a file in the Startup directory
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          PID:1184
        • C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe
          C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          PID:2196

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        desktop.ini.tmp
        • Path C:\$Recycle.Bin\S-1-5-21-524788801-3318743092-4051225893-1000\desktop.ini.tmp
        • Size 1.6MB
        • SHA256 3c1e3bf5d7400a8d36ac6b7299f4b8f954178b07071dfdc5667ff2d615b1ac6e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7-zip.chm.tmp
        • Path C:\Program Files\7-Zip\7-zip.chm.tmp
        • Size 1.7MB
        • SHA256 2e0956d4b0c833ae3e01286c081f8276141f28b69e337e201d1d0da346934e7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7-zip.dll.tmp
        • Path C:\Program Files\7-Zip\7-zip.dll.tmp
        • Size 1.7MB
        • SHA256 46ea762f8f17fc21d11c1e27d0b9393ec5c4455f158ba2caa33b0b8bac240884
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7-zip32.dll.tmp
        • Path C:\Program Files\7-Zip\7-zip32.dll.tmp
        • Size 1.6MB
        • SHA256 6943d2c0f9d67343b7186d845bd38e2808e19d8d56c1300f5ec0468310a40136
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7z.dll.tmp
        • Path C:\Program Files\7-Zip\7z.dll.tmp
        • Size 3.4MB
        • SHA256 fe43dd37dbc65d407f6f5953a9ab59291fb192d4ee4101297c8b5eedf915e4bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7z.exe.tmp
        • Path C:\Program Files\7-Zip\7z.exe.tmp
        • Size 2.1MB
        • SHA256 9daf2284c54a38337a3cb18faf6c5645ab6f610e1165297fb161b2912f6f7670
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7z.sfx.tmp
        • Path C:\Program Files\7-Zip\7z.sfx.tmp
        • Size 1.8MB
        • SHA256 3c9a0efe69e8309c6fcd742d8397e3227d26763c23b6e8e4500e8cf7691d4c0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zCon.sfx.tmp
        • Path C:\Program Files\7-Zip\7zCon.sfx.tmp
        • Size 1.8MB
        • SHA256 2aa0b8862b62ee196103a5898abe5b6b61dc95564b5315094161fa19b4eaeb48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe.tmp
        • Path C:\Program Files\7-Zip\7zFM.exe.tmp
        • Size 2.5MB
        • SHA256 df2137372cfa558a34dbcdc75e5143b184b863030c2e220f9974dfbcf4cc23ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe.tmp
        • Path C:\Program Files\7-Zip\7zG.exe.tmp
        • Size 2.3MB
        • SHA256 c19556375649d7f4bd51f9ad8860a353213fe18ea6ebb6fe61e40cc367cef06d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        History.txt.tmp
        • Path C:\Program Files\7-Zip\History.txt.tmp
        • Size 1.6MB
        • SHA256 8dcc184aad317b2877a5ed56841de776de5231897eebb3e9d64bbc5a50889fa2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        af.txt.tmp
        • Path C:\Program Files\7-Zip\Lang\af.txt.tmp
        • Size 1.6MB
        • SHA256 d95747e46823d8cfb721754362f42b530e2158eb0a07e2fd307241a1965606bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        an.txt.tmp
        • Path C:\Program Files\7-Zip\Lang\an.txt.tmp
        • Size 1.6MB
        • SHA256 3518ec1d03f8dfba5ce48b1b4e316391766cedc1e51d8348fe18a96209f6fdea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ar.txt.tmp
        • Path C:\Program Files\7-Zip\Lang\ar.txt.tmp
        • Size 1.6MB
        • SHA256 b7048a580802b0a8810677c06e38ed89dcdb2145c4c3d0e3fcc55265bab3a1f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ast.txt.tmp
        • Path C:\Program Files\7-Zip\Lang\ast.txt.tmp
        • Size 1.6MB
        • SHA256 ab2d5f85c97907022459bcff9286725c97cba5ea0797f4dcfdffa7960cec3b90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ba.txt.tmp
        • Path C:\Program Files\7-Zip\Lang\ba.txt.tmp
        • Size 1.6MB
        • SHA256 c84aa1ab907e91fb5e223b51899765c7ed75dde73c025d948942954210a71771
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        be.txt.tmp
        • Path C:\Program Files\7-Zip\Lang\be.txt.tmp
        • Size 1.6MB
        • SHA256 fb3f78ffee21751c755c6f49ae7c7304d99f20b39663130d5e4ceb3e18f29fb8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ca.txt.tmp
        • Path C:\Program Files\7-Zip\Lang\ca.txt.tmp
        • Size 1.6MB
        • SHA256 fc4342a7bd20f4504d0957e9b73073b385f8c3d0592413e494be31bc9f388bba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        co.txt.tmp
        • Path C:\Program Files\7-Zip\Lang\co.txt.tmp
        • Size 1.6MB
        • SHA256 166a475c67393c4b695e4a5b8b82f632e052cbe761ab575eae7304562098eabb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cs.txt.tmp
        • Path C:\Program Files\7-Zip\Lang\cs.txt.tmp
        • Size 1.6MB
        • SHA256 68f6578a84f70e2a0570cfe7a3ef900c881d224adf5c7bb37270bfeb01d53d42
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cy.txt.tmp
        • Path C:\Program Files\7-Zip\Lang\cy.txt.tmp
        • Size 1.6MB
        • SHA256 4797ccf8760d3adc9e68f95e7c5b5b44d5bcd679ea59a5eaa28e72492fb7b66c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        da.txt.tmp
        • Path C:\Program Files\7-Zip\Lang\da.txt.tmp
        • Size 1.6MB
        • SHA256 baf6395183743dec915d879329dde21f1103ba558b3a027472170e8569d5b067
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        el.txt.tmp
        • Path C:\Program Files\7-Zip\Lang\el.txt.tmp
        • Size 1.6MB
        • SHA256 811b5880ba9faa3f47e18bb8f3f22e5baeaab3345e8b7ffc6c182364b3ed83b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        eo.txt.tmp
        • Path C:\Program Files\7-Zip\Lang\eo.txt.tmp
        • Size 1.6MB
        • SHA256 9e6919995c033ff851992a72180353598ae2f862f63d81678ba252db935399a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        et.txt.tmp
        • Path C:\Program Files\7-Zip\Lang\et.txt.tmp
        • Size 1.6MB
        • SHA256 d40804073c0b5d0ca2271fb86a0df3d9168d007ff996ce0bbaf447422c9d4d16
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fa.txt.tmp
        • Path C:\Program Files\7-Zip\Lang\fa.txt.tmp
        • Size 1.6MB
        • SHA256 cced7beeeb4f03590ab0e5e612f5f11931e459b4069d049d1d11f99a496de650
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fi.txt.tmp
        • Path C:\Program Files\7-Zip\Lang\fi.txt.tmp
        • Size 1.6MB
        • SHA256 92fcc5df928ed14613f444197e16c91d8ce60a6414a3304b5e69463b70e37d22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fr.txt.tmp
        • Path C:\Program Files\7-Zip\Lang\fr.txt.tmp
        • Size 1.6MB
        • SHA256 ee8f073486bd57be9f07c8f5246278490f5618f22882539174f66e16cfb7d723
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fur.txt.tmp
        • Path C:\Program Files\7-Zip\Lang\fur.txt.tmp
        • Size 1.6MB
        • SHA256 cabad294e0e2c51132841f5873a1afd046045671da6a3ff2fec09135ea6fb2c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fy.txt.tmp
        • Path C:\Program Files\7-Zip\Lang\fy.txt.tmp
        • Size 1.6MB
        • SHA256 b2c650c95436455b22cc96bab1cbf2b8b81079fd86480a564d59dc713136503a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ga.txt.tmp
        • Path C:\Program Files\7-Zip\Lang\ga.txt.tmp
        • Size 1.6MB
        • SHA256 43acb866f6bb0d79fe490a78e9f98e31f3db60298521ba78999c705fcd6e1bd7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        gl.txt.tmp
        • Path C:\Program Files\7-Zip\Lang\gl.txt.tmp
        • Size 1.6MB
        • SHA256 bcdacb3c5b9e228f247babeb964cee677557ca356eefb46bc59b34535f225d6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        hy.txt.tmp
        • Path C:\Program Files\7-Zip\Lang\hy.txt.tmp
        • Size 1.6MB
        • SHA256 d9119eb50af3b695a8a7d104585e710ce18fcb34d91cb48b9bf6dd0e2689fb64
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        id.txt.tmp
        • Path C:\Program Files\7-Zip\Lang\id.txt.tmp
        • Size 1.6MB
        • SHA256 1c0a42a9ef3400f3e3a6010dfe26551db99c8f88b486bc0b3807987967e25c41
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        io.txt.tmp
        • Path C:\Program Files\7-Zip\Lang\io.txt.tmp
        • Size 1.6MB
        • SHA256 e2c9727b5d83e4ae75c711a83d77876557e1da7cd0ec47a03a07fd7f63cdcb7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        is.txt.tmp
        • Path C:\Program Files\7-Zip\Lang\is.txt.tmp
        • Size 1.6MB
        • SHA256 ba413be84b63cf45643286262b1a5782a7b3649eb5473dd2163c07ea8d0a4178
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kaa.txt.tmp
        • Path C:\Program Files\7-Zip\Lang\kaa.txt.tmp
        • Size 1.6MB
        • SHA256 6a8fb8f3384806f3cb4678e5d6f7a88020ed0551e03ccf285867435e25523fe5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ko.txt.tmp
        • Path C:\Program Files\7-Zip\Lang\ko.txt.tmp
        • Size 1.6MB
        • SHA256 cb3ac78b3ea50fdc4621b07a87d37b86f89039f7bfd730837d76c272451cf4aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ku-ckb.txt.tmp
        • Path C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp
        • Size 1.6MB
        • SHA256 309d9f88f0ad8d0242429bb60ae76c8b7869809efb13ed7e66125b514164043a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ku.txt.tmp
        • Path C:\Program Files\7-Zip\Lang\ku.txt.tmp
        • Size 1.6MB
        • SHA256 aae2208920ebfbb161477109780d06977fa490a8350839f58d3ded2a4c0fd76e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ky.txt.tmp
        • Path C:\Program Files\7-Zip\Lang\ky.txt.tmp
        • Size 1.6MB
        • SHA256 2077ad94cffa772ffa9d0f66f19876c93a5a4a2b93e8121cca2c0aee50a7c7f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        lij.txt.tmp
        • Path C:\Program Files\7-Zip\Lang\lij.txt.tmp
        • Size 1.6MB
        • SHA256 a2ffefb543afe8c1a19c0dab0928b1f95579655407abfaf0dc44f14be4fa6bfa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        lt.txt.tmp
        • Path C:\Program Files\7-Zip\Lang\lt.txt.tmp
        • Size 1.6MB
        • SHA256 2f0858ca279a5dda9e5f673d700170a7a41516ae5b11fa9b1e86e40cf11fa2ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        lv.txt.tmp
        • Path C:\Program Files\7-Zip\Lang\lv.txt.tmp
        • Size 1.1MB
        • SHA256 ebde04772bfe5c7d6b9454533091fce881a31a73b66a8e37ec799db809152f0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        lv.txt.tmp
        • Path C:\Program Files\7-Zip\Lang\lv.txt.tmp
        • Size 1.6MB
        • SHA256 441106a54a03e1dc9183675af3dc9297e92f7da1af104a46a225aaa151d397f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mk.txt.tmp
        • Path C:\Program Files\7-Zip\Lang\mk.txt.tmp
        • Size 1.6MB
        • SHA256 b88541620a22e71041c1ef994210142eae5c41c4efc814cd51759f9c9b40f9f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        descript.ion.tmp
        • Path C:\Program Files\7-Zip\descript.ion.tmp
        • Size 1.6MB
        • SHA256 64cc9fe564d715fdebc2fc70d2f1a80398c4a72f273586f31315efb72d071676
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _desktop.ini.exe
        • Path C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe
        • Size 1.6MB
        • SHA256 122f025945448718926611cb4f8788facc548923a3fd23a22bf7d16dfbf53f96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        x.vbs
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs
        • Size 93B
        • SHA256 2bf5c217eec430aa87a88f22878859e41675499a1f9bf00be1d6125587c3df9e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Zombie.exe
        • Path C:\Windows\SysWOW64\Zombie.exe
        • Size 1.6MB
        • SHA256 3c115624f2fa31253b3f9b9bd4896ea661f21a72748e74eea3e5e897b147430e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1364-275-0x0000000000400000-0x0000000000478000-memory.dmp
        Download

        memory/2184-3-0x0000000000400000-0x0000000000658000-memory.dmp
        Download

        memory/2184-35-0x0000000000400000-0x0000000000658000-memory.dmp
        Download

        memory/2184-6-0x0000000000400000-0x000000000040C000-memory.dmp
        Download

        memory/2184-5-0x0000000000400000-0x0000000000658000-memory.dmp
        Download

        memory/2184-4-0x0000000000400000-0x0000000000658000-memory.dmp
        Download

        memory/3372-15-0x0000000000400000-0x000000000046E000-memory.dmp
        Download

        memory/3528-0-0x0000000000400000-0x000000000046E000-memory.dmp
        Download

        memory/3528-7-0x0000000000400000-0x000000000046E000-memory.dmp
        Download

        memory/3528-1-0x000000000040C000-0x000000000040D000-memory.dmp
        Download

        memory/4516-19-0x0000000000400000-0x000000000046E000-memory.dmp
        Download