cosmu | 0c9d085f1741318dce6f2881637d17104a85d3b687cf2523074f82a8ee1b8247

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 22:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe
Size 76KB
Sample261030-18213astb1
SHA256 0c9d085f1741318dce6f2881637d17104a85d3b687cf2523074f82a8ee1b8247
MD5 8f6ddf58c60a6c0d9f216cae8b0f86a5
SHA1 cf7d49e6039b6a38b511f6feb8fa8984b0faff72
SHA512 7afd4c000de6d8a0ef79f84b8749978bbbba66a2ac81f8468f906057af0ea8d24842857cdebdc46a9cf4d2e3adbf52d77ef1ff6a681f3d3db5be444fa270c441
SSDEEP 768:R7BlpppARFbh6qS+pim269O7X7vX9O7X7vAiuyIEd7gNj:R7ZppAp6qFpaMIwYj
TLSH
T11A7373C9795FF789E24A6030D91317BE0EB694176E608ACBB78DF4EC6761AD0F01C426
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery cosmu ransomware worm

Malware Config

Signatures

Family: Cosmu
Cosmu is a Windows worm written in C++.
worm cosmu

Detects Cosmu payload 4 IoCs

Cosmu is a worm written in C++.

resource	yara_rule
behavioral2/memory/2588-0-0x0000000000400000-0x000000000040A000-memory.dmp	family_cosmu
behavioral2/files/0x000f00000001b311-2.dat	family_cosmu
behavioral2/files/0x00030000000003ad-5.dat	family_cosmu
behavioral2/memory/2588-793-0x0000000000400000-0x000000000040A000-memory.dmp	family_cosmu

Detects executables packed with eXPressor 4 IoCs

resource	yara_rule
behavioral2/memory/2588-0-0x0000000000400000-0x000000000040A000-memory.dmp	INDICATOR_EXE_Packed_eXPressor
behavioral2/files/0x000f00000001b311-2.dat	INDICATOR_EXE_Packed_eXPressor
behavioral2/files/0x00030000000003ad-5.dat	INDICATOR_EXE_Packed_eXPressor
behavioral2/memory/2588-793-0x0000000000400000-0x000000000040A000-memory.dmp	INDICATOR_EXE_Packed_eXPressor

Renames multiple (4581) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Internet Explorer\es-ES\ieinstal.exe.mui.tmp	2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\gstreamer-lite.dll.tmp	2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms.tmp	2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz.dll.tmp	2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\am.pak.tmp	2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md.tmp	2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ul-phn.xrm-ms.tmp	2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-console-l1-2-0.dll.tmp	2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.AeroLite.dll.tmp	2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\ReachFramework.resources.dll.tmp	2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\orbd.exe.tmp	2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\sunmscapi.jar.tmp	2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\Welcome.html.tmp	2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Gallery.thmx.tmp	2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-ppd.xrm-ms.tmp	2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Primitives.dll.tmp	2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\prism_d3d.dll.tmp	2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.dll.tmp	2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe
File created	C:\Program Files\Internet Explorer\iexplore.exe.tmp	2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\LICENSE.tmp	2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.AdomdClient.dll.tmp	2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\as80.xsl.tmp	2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe
File created	C:\Program Files\7-Zip\Lang\nb.txt.tmp	2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\libxml2.md.tmp	2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightDemiBold.ttf.tmp	2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ul-phn.xrm-ms.tmp	2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\IFDPINTL.DLL.tmp	2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.ProgressiveProcessing.dll.tmp	2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\Microsoft.Win32.Registry.dll.tmp	2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Runtime.Extensions.dll.tmp	2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\WindowsBase.dll.tmp	2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_ko.properties.tmp	2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ul-phn.xrm-ms.tmp	2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AppvIsvSubsystems64.dll.tmp	2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CONVERT\1033\OLMAILR.FAE.tmp	2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\RESENDL.ICO.tmp	2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-stdio-l1-1-0.dll.tmp	2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.OpenSsl.dll.tmp	2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.AppContext.dll.tmp	2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\Microsoft.VisualBasic.Forms.resources.dll.tmp	2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe.tmp	2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ul-oob.xrm-ms.tmp	2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Grace-ul-oob.xrm-ms.tmp	2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Text.Encoding.Extensions.dll.tmp	2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\[email protected]	2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe.tmp	2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.tmp	2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial-pl.xrm-ms.tmp	2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART1.BDR.tmp	2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe
File created	C:\Program Files\Common Files\System\ado\msadrh15.dll.tmp	2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.InteropServices.dll.tmp	2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.InteropServices.RuntimeInformation.dll.tmp	2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Controls.Ribbon.resources.dll.tmp	2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-string-l1-1-0.dll.tmp	2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-pl.xrm-ms.tmp	2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\XLINTL32.DLL.tmp	2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\tr\PresentationCore.resources.dll.tmp	2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Grace-ul-oob.xrm-ms.tmp	2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-pl.xrm-ms.tmp	2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\bn-IN\tipresx.dll.mui.tmp	2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-30_8f6ddf58c60a6c0d9f216cae8b0f86a5_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-696679853-3915825385-3233721679-1000\desktop.ini.tmp
Size 76KB
SHA256 f0c66ed4972d449c53147af8cb3aa02217ad7ad9238507c20f55a7e3d7a43fe6
MD5 24ffaaf424261f3df6d81c648a96c77c
SHA1 560309159507ecbb55f28c4655728d8a51c89ef0
SHA512 a4dad2ea2eec7c0bb0af05aef3d2e00ebcc9bac4738fefaddfc2a1b7297c146fe5d51033b128e7461f3fa20e8c721d79c240673e364c7c58e01a030b868ba605
SSDEEP 768:R7BlpppARFbh6qS+pim269O7X7vX9O7X7vAiuyIEd7gNu:R7ZppAp6qFpaMIwYu
TLSH
T1F97373C9795FF789E24A6030D91317BE0EB694176E608ACBB78DF4EC6761AD0F01C426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7-zip.chm.tmp

Path C:\Program Files\7-Zip\7-zip.chm.tmp
Size 193KB
SHA256 30d4e6fa9a2abe98bd13e1ff88d92df02421496b79b3f920926ff8cdcc50d8cc
MD5 885a3dce4ce9599470508c46b9ca463c
SHA1 9264a6b84d334b51f5c2c2540d87e5430b2601c6
SHA512 0f2bb345cbe2c93e2bb3d148c4511ff8b831cc2e8ae44644523763e77a371542631ca3d504e98f82d5b477f35731efb59a539bcd810e23a99cb53e433314b36d
SSDEEP 3072:7pWp6qF8vbwxMxdrwdaEMePCUlZVpnwzuGSsOOO2:0H8jwxMxFELMO9wapsOZ2
TLSH
T1531426CA799FF789E60A2134D513577E0EB694172E108ACBBB8EF4DC6761AD4F01C026
MD5 SHA1 SHA512 SSDEEP TLSH