cosmu | 23c6c16cdc76d8fa82524a36359632c5b7a89393e96c9eacd7ab1803d3f26083

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/10/2026, 19:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe
Size 28KB
Sample261029-xqc3fasvbv
SHA256 23c6c16cdc76d8fa82524a36359632c5b7a89393e96c9eacd7ab1803d3f26083
MD5 c5ce094cbaff68bb025fc431b15326e6
SHA1 d1112e0daf93aef6a901b2b02105392e582726f4
SHA512 0a5a752133a94d0c55754a41b13e5b7c86347e50d7c2aa7012f71db0a630ca2273cf4b4288bcbe83e4013a2d2948fa5de6035af84c355f8a9714abe2a344a61d
SSDEEP 384:hBt7Br5xjL9AgA71Fbhv/r+k7ha3DzpsVvUaWq9C71gD27:R7BlpppARFbh6qopim2SgD27
TLSH
T1E1D26C2E8B45D032C38654309D2F7C79CC7381396E25DA6BAB568C087A7B3E1FC7411A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery cosmu ransomware worm

Malware Config

Signatures

Family: Cosmu
Cosmu is a Windows worm written in C++.
worm cosmu

Detects Cosmu payload 4 IoCs

Cosmu is a worm written in C++.

resource	yara_rule
behavioral2/memory/2520-0-0x0000000000400000-0x000000000040A000-memory.dmp	family_cosmu
behavioral2/files/0x0009000000019cb3-2.dat	family_cosmu
behavioral2/files/0x00030000000003ac-5.dat	family_cosmu
behavioral2/memory/2520-790-0x0000000000400000-0x000000000040A000-memory.dmp	family_cosmu

Detects executables packed with eXPressor 4 IoCs

resource	yara_rule
behavioral2/memory/2520-0-0x0000000000400000-0x000000000040A000-memory.dmp	INDICATOR_EXE_Packed_eXPressor
behavioral2/files/0x0009000000019cb3-2.dat	INDICATOR_EXE_Packed_eXPressor
behavioral2/files/0x00030000000003ac-5.dat	INDICATOR_EXE_Packed_eXPressor
behavioral2/memory/2520-790-0x0000000000400000-0x000000000040A000-memory.dmp	INDICATOR_EXE_Packed_eXPressor

Renames multiple (4566) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml.tmp	2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.Lightweight.dll.tmp	2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.dll.tmp	2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\jfr.dll.tmp	2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\prism_sw.dll.tmp	2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ul.xrm-ms.tmp	2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll.manifest.tmp	2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\WindowsBase.resources.dll.tmp	2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\tr\ReachFramework.resources.dll.tmp	2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-pl.xrm-ms.tmp	2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ppd.xrm-ms.tmp	2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.Serialization.dll.tmp	2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\WindowsFormsIntegration.resources.dll.tmp	2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ul-phn.xrm-ms.tmp	2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_Subscription-ppd.xrm-ms.tmp	2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Grace-ul-oob.xrm-ms.tmp	2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ul-phn.xrm-ms.tmp	2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProDemoR_BypassTrial180-ppd.xrm-ms.tmp	2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ul-oob.xrm-ms.tmp	2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-ppd.xrm-ms.tmp	2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe
File created	C:\Program Files\7-Zip\Lang\lt.txt.tmp	2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.OpenSsl.dll.tmp	2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationUI.resources.dll.tmp	2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-pl.xrm-ms.tmp	2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Windows.Forms.dll.tmp	2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\PrivacySandboxAttestationsPreloaded\manifest.json.tmp	2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\keytool.exe.tmp	2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\java.policy.tmp	2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Grace-ppd.xrm-ms.tmp	2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe
File created	C:\Program Files\dotnet\host\fxr\8.0.15\hostfxr.dll.tmp	2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Yellow.xml.tmp	2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ul-oob.xrm-ms.tmp	2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationProvider.resources.dll.tmp	2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\tr\WindowsFormsIntegration.resources.dll.tmp	2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe.tmp	2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-convert-l1-1-0.dll.tmp	2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ppd.xrm-ms.tmp	2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Primitives.dll.tmp	2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\ktab.exe.tmp	2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-ul-oob.xrm-ms.tmp	2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Core.NetFX35.dll.tmp	2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui.tmp	2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\cs.pak.tmp	2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-ppd.xrm-ms.tmp	2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-ul-oob.xrm-ms.tmp	2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Resources.Writer.dll.tmp	2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Threading.Tasks.Dataflow.dll.tmp	2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe.tmp	2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\lcms.md.tmp	2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Grace-ppd.xrm-ms.tmp	2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16EnterpriseVL_Bypass30-ul-oob.xrm-ms.tmp	2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-ul-oob.xrm-ms.tmp	2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe
File created	C:\Program Files\7-Zip\7-zip.chm.tmp	2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processthreads-l1-1-1.dll.tmp	2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\fr\WindowsBase.resources.dll.tmp	2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue Green.xml.tmp	2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ConsumerSub_Bypass30-ppd.xrm-ms.tmp	2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.Native.dll.tmp	2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\cs\System.Windows.Forms.resources.dll.tmp	2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jhat.exe.tmp	2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-28_c5ce094cbaff68bb025fc431b15326e6_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-53044966-3830981193-2402648431-1000\desktop.ini.tmp
Size 28KB
SHA256 99a3b6753d9ca1e99c9fcfb065997eca3a8313ad0588194bc4d92de6ab5ff91e
MD5 002d2d7e03b2fa176e930eb3c7e47583
SHA1 ab53c1ef7994f535d3f6aaed4933b54abfbd6f64
SHA512 cf292b4ce1ae3f17954c9785928f7096854addaaf166d9a681ad77acde77eaaa2042caf450c29842e64bb9d7451e4b6f4a1923e91084bfcf9f0773b459622218
SSDEEP 384:hBt7Br5xjL9AgA71Fbhv/r+k7ha3DzpsVvUaWq9C71gD2X:R7BlpppARFbh6qopim2SgD2X
TLSH
T1E2D25B2E8B45D032C38654309D2F7C79C87780796E25DB6BE7568C186ABB3E1FC7412A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7-zip.chm.tmp

Path C:\Program Files\7-Zip\7-zip.chm.tmp
Size 145KB
SHA256 eb72c4f721c741a1278d5db4b4276ade6ffdbaaeb4f1746b802e44460dd111d5
MD5 547d3b7a8e9ae126062d8d7a27faf42c
SHA1 dd2365a6819d320d28c35a57d5a6135c0c1b2dde
SHA512 553768995933a82039980f6868e8eeab97059ff032d84b1e3a0bd68d93d431e44df8f8174726a3f4734ff6023d8dd9f546475a984bfb18bed16f58354c858fd7
SSDEEP 3072:7pWp6qogwxMxdrwdaEMePCUlZVpnwzuGSsOOO6:0qgwxMxFELMO9wapsOZ6
TLSH
T1FBE3016A27846421C75741386217B83E77B3286A1D05CB427F9BCE0E66F73D9F43922B
MD5 SHA1 SHA512 SSDEEP TLSH