cosmu | f27680b1f6b94acbe524a118901df6426ae804eadcbaa5b897d94140ff2748ac

Analysis

max time kernel
150s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/10/2026, 08:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe
Size 25KB
Sample261020-jxtf4sa19k
SHA256 f27680b1f6b94acbe524a118901df6426ae804eadcbaa5b897d94140ff2748ac
MD5 33e6031be7b8d59f2fef9e21661c70b3
SHA1 0a56efa6e9e6c964a57cfc393bf0ff6e054c8b13
SHA512 13ce1e9a4cc4bf8459be03cc9590de2d39df64f8849cb623a2d1dd964fdffbc2c54a4c4521a7dbd8a10fc4425205d1ec2ca1c5fbf38167bdec7960838a46937e
SSDEEP 384:hBt7Br5xjL9AgA71Fbhv/r+k7ha3s2zpsVvUaWq9C7X:R7BlpppARFbh6qcpim24
TLSH
T1F8C24B5E8B49C072C38550305C2F687D9DB7443C6E26DB6BAB56CD18AABA3D0FC3815A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery cosmu ransomware worm

Malware Config

Signatures

Family: Cosmu
Cosmu is a Windows worm written in C++.
worm cosmu

Detects Cosmu payload 4 IoCs

Cosmu is a worm written in C++.

resource	yara_rule
behavioral1/memory/4972-0-0x0000000000400000-0x000000000040A000-memory.dmp	family_cosmu
behavioral1/files/0x001c000000024384-2.dat	family_cosmu
behavioral1/files/0x000200000001e672-5.dat	family_cosmu
behavioral1/memory/4972-803-0x0000000000400000-0x000000000040A000-memory.dmp	family_cosmu

Detects executables packed with eXPressor 4 IoCs

resource	yara_rule
behavioral1/memory/4972-0-0x0000000000400000-0x000000000040A000-memory.dmp	INDICATOR_EXE_Packed_eXPressor
behavioral1/files/0x001c000000024384-2.dat	INDICATOR_EXE_Packed_eXPressor
behavioral1/files/0x000200000001e672-5.dat	INDICATOR_EXE_Packed_eXPressor
behavioral1/memory/4972-803-0x0000000000400000-0x000000000040A000-memory.dmp	INDICATOR_EXE_Packed_eXPressor

Renames multiple (5214) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ul-oob.xrm-ms.tmp	2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\OpenSSL64.DllA\ssleay32.dll.tmp	2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsrom.xml.tmp	2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui.tmp	2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.dll.tmp	2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Client\mfc140u.dll.tmp	2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\SMSL.ICO.tmp	2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\et-EE\tipresx.dll.mui.tmp	2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Input.Manipulations.resources.dll.tmp	2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-ul-oob.xrm-ms.tmp	2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msaddsr.dll.mui.tmp	2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.X509Certificates.dll.tmp	2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Security.Cryptography.Encoding.dll.tmp	2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Web.HttpUtility.dll.tmp	2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\mesa3d.md.tmp	2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-pl.xrm-ms.tmp	2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-ppd.xrm-ms.tmp	2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ul-oob.xrm-ms.tmp	2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\libcrypto-1_1-x64.dll.tmp	2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe
File created	C:\Program Files\7-Zip\Lang\ca.txt.tmp	2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\PresentationUI.resources.dll.tmp	2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\WindowsFormsIntegration.resources.dll.tmp	2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\PresentationFramework.dll.tmp	2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ul.xrm-ms.tmp	2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG.HXS.tmp	2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Formats.Asn1.dll.tmp	2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.TypeExtensions.dll.tmp	2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\PrivacySandboxAttestationsPreloaded\manifest.json.tmp	2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Grace-ul-oob.xrm-ms.tmp	2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT.HXS.tmp	2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationClientSideProviders.resources.dll.tmp	2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.XLS.tmp	2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\RCLRPT.CFG.tmp	2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pl\WindowsBase.resources.dll.tmp	2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ul.xrm-ms.tmp	2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CONVERT\OLAPPT.FAE.tmp	2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationProvider.resources.dll.tmp	2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\OUTLWVW.DLL.tmp	2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\msipc.dll.tmp	2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\mshwLatin.dll.mui.tmp	2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\sunmscapi.jar.tmp	2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ppd.xrm-ms.tmp	2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ViewOnly_ZeroGrace-ppd.xrm-ms.tmp	2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-180.png.tmp	2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSPPT.OLB.tmp	2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7ES.dub.tmp	2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-pl.xrm-ms.tmp	2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-pl.xrm-ms.tmp	2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe
File created	C:\Program Files\Common Files\System\msadc\msaddsr.dll.tmp	2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunjce_provider.jar.tmp	2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\EXITEML.ICO.tmp	2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\lpc.win32.bundle.tmp	2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONBttnIE.dll.tmp	2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN109.XML.tmp	2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Security.Cryptography.X509Certificates.dll.tmp	2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp	2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\cs.pak.tmp	2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\GostName.XSL.tmp	2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CONVERT\DELIMWIN.FAE.tmp	2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-140.png.tmp	2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ipcsecproc.dll.tmp	2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\Microsoft.VisualBasic.Forms.resources.dll.tmp	2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-20_33e6031be7b8d59f2fef9e21661c70b3_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-1846164713-4096795028-774071693-1000\desktop.ini.tmp
Size 25KB
SHA256 01a5e8396f257b8fc83b56f219c740a5c266ff8e1bb38f0d5308d5a7279f919e
MD5 838a0b183b1f964bfa718fec0cf2be34
SHA1 0500638a780ea0afa4919dcdd5ff26ef6c1d2cf5
SHA512 c4e0c2c167f6cd4edfa9247edd7c5328ed26d54c33cde315cd9bfa40bd474bd74003ff2e62c1b873eacf6cf96bb6fb274b90b14c8b2d21537824911d193f6795
SSDEEP 384:hBt7Br5xjL9AgA71Fbhv/r+k7ha3s2zpsVvUaWq9C7b:R7BlpppARFbh6qcpim2E
TLSH
T13EC24C1E8B49C072C38550305C2F68799DB7403C6E26DB6BAB56CD18AAB63D1FC3415A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7-zip.chm.tmp

Path C:\Program Files\7-Zip\7-zip.chm.tmp
Size 142KB
SHA256 716fc3bcfbc4e3e56caaef4328a91aa5c0516b32c4cc2c410ee6cbcad54e68fe
MD5 b2377b6998e792b5f23f42939b60a0cb
SHA1 12b1ac0c6f535d2d9ea38517767618fcb24d22bc
SHA512 5a5394afd38f924030564af73e3c18acda2e616e3ae7c54d7043887292654d0c73f1046ffdf407b14d76b3c89ce6d69a76a5fee9f2929f5ce0b55779c4084b22
SSDEEP 3072:7pWp6qcswxMxdrwdaEMePCUlZVpnwzuGSsOOO3:0SswxMxFELMO9wapsOZ3
TLSH
T1C2E3026A6B845422C74601382153E83E77B32C681D15CB527F8BCE0E6AF67D9F43922B
MD5 SHA1 SHA512 SSDEEP TLSH