cosmu | 62fc8974c06e14c7c0a6d28032a915229f5d55bcb90499440ad05291e40dc47b

Analysis

max time kernel
150s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 22:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe
Size 297KB
Sample261024-2mk14axvey
SHA256 62fc8974c06e14c7c0a6d28032a915229f5d55bcb90499440ad05291e40dc47b
MD5 06d780de4e6ced7b76ed9d8684c5c9a8
SHA1 40e0008a1e0bcc70ae84678dbd1cdbd83e98b329
SHA512 e8320fe40767bc0c052c12bd1c838115290a2bc3d5d31b55c0f4586516aec2fbd0109e5934dd21e39f83cd7ca8eadc04adf5a8d89c9747d845db1474b80e1182
SSDEEP 6144:MFjmoXRYaLQTcHX1LPr9xqppppkS1A3eDOp:ejpRJR3xTjSy3eyp
TLSH
T1F1548D709332FA69E456933540BABA98AE7B1E48B699F3E5413CBC3D1C702C0DA5D235
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery cosmu ransomware worm

Malware Config

Signatures

Family: Cosmu
Cosmu is a Windows worm written in C++.
worm cosmu

Detects Cosmu payload 4 IoCs

Cosmu is a worm written in C++.

resource	yara_rule
behavioral2/memory/2600-0-0x0000000000400000-0x0000000000408000-memory.dmp	family_cosmu
behavioral2/files/0x000d000000019cb7-2.dat	family_cosmu
behavioral2/files/0x00030000000003b1-5.dat	family_cosmu
behavioral2/memory/2600-630-0x0000000000400000-0x0000000000408000-memory.dmp	family_cosmu

Renames multiple (2958) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll.tmp	2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll.tmp	2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE.tmp	2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Json.dll.tmp	2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Reflection.dll.tmp	2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Text.Encoding.dll.tmp	2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\PrivacySandboxAttestationsPreloaded\privacy-sandbox-attestations.dat.tmp	2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Organic.thmx.tmp	2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\coreclr.dll.tmp	2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Extensions.dll.tmp	2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationClient.resources.dll.tmp	2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.Primitives.resources.dll.tmp	2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp	2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\j2pkcs11.dll.tmp	2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe.tmp	2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Grunge Texture.eftx.tmp	2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll.tmp	2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lt-lt.dll.tmp	2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml.tmp	2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\lib\sound.properties.tmp	2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.tmp	2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-pl.xrm-ms.tmp	2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms.tmp	2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.Win32.Primitives.dll.tmp	2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Threading.Tasks.Dataflow.dll.tmp	2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\ReachFramework.resources.dll.tmp	2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp	2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win7.wmv.tmp	2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-pl.xrm-ms.tmp	2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.tmp	2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.IO.Compression.Brotli.dll.tmp	2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\ar.pak.tmp	2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ne-NP\tipresx.dll.mui.tmp	2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Globalization.Calendars.dll.tmp	2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\System.Windows.Forms.resources.dll.tmp	2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\npt.dll.tmp	2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\ecc.md.tmp	2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\cursors.properties.tmp	2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe
File created	C:\Program Files\7-Zip\Lang\bn.txt.tmp	2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui.tmp	2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ja\System.Windows.Forms.resources.dll.tmp	2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\sspi_bridge.dll.tmp	2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-sysinfo-l1-1-0.dll.tmp	2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue.xml.tmp	2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe
File created	C:\Program Files\7-Zip\Lang\ja.txt.tmp	2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe
File created	C:\Program Files\7-Zip\Lang\uz.txt.tmp	2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ServiceModel.Web.dll.tmp	2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.ResourceManager.dll.tmp	2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationClientSideProviders.resources.dll.tmp	2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ul-phn.xrm-ms.tmp	2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ko-kr.dll.tmp	2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui.tmp	2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationClient.resources.dll.tmp	2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\wpfgfx_cor3.dll.tmp	2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\UIAutomationTypes.resources.dll.tmp	2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\libGLESv2.dll.tmp	2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\GRAY.pf.tmp	2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe
File created	C:\Program Files\7-Zip\Lang\va.txt.tmp	2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml.tmp	2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sr-Cyrl-RS\tipresx.dll.mui.tmp	2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-process-l1-1-0.dll.tmp	2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\asm.md.tmp	2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-file-l1-2-0.dll.tmp	2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui.tmp	2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_06d780de4e6ced7b76ed9d8684c5c9a8_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-461973139-3212354679-1508698038-1000\desktop.ini.tmp
Size 297KB
SHA256 bed882de2cfbdfc31db98700be4890e361b936cb4bfd2180c7788f7a9b5c820e
MD5 01d486bc8bc72409c8ee550a95b535ff
SHA1 f1ea39fc4f16e28a3633ed633adddebebdbd2a58
SHA512 12dc758a677919bcd89d7f370f95139fb5984858e729aa3dc1d8dfb8226674dbf2ac697b515daf037c82feb7a62e023f4ab6c24ed0e104035f5bd43ad25ec10e
SSDEEP 6144:MFjmoXRYaLQTcHX1LPr9xqppppkS1A3eDO9:ejpRJR3xTjSy3ey9
TLSH
T186548D709332FA69E456933540BABA98AE7B1E48B699F3E5413CBC3D1C703C0DA5D235
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7-zip.chm.tmp

Path C:\Program Files\7-Zip\7-zip.chm.tmp
Size 414KB
SHA256 c68bbb4e6a7413bb03680750eea77746edf4285b8e804e2c196f0b2a1bfd7790
MD5 1b5d4fa3ce550a87ec8c83e33c693e08
SHA1 77786c94001f004498cf53f29d8e9ec97eeb08d4
SHA512 db587d9dd62533e9dda14077673fd48fc36ed95c890c6432a7f3ede2b86f857866e5d8f6ac7305daf05d0d706d5aa5ef0d06eb44f695469fa17816295d6e2640
SSDEEP 6144:MFjmoXRYaLQTcHX1LPr9xqppppkS1A3eDOnwxMxFELMO9wapsOZm:ejpRJR3xTjSy3eynEqSGN
TLSH
T12494BE709332FA19E456933540BAB99DAE7B1E48B699F3E1453CBC3D1C703C0EA5D226
MD5 SHA1 SHA512 SSDEEP TLSH