cosmu | 6a60d0883292dbb027e56f86177c9333a35e33072cbf76ec6bf38da87f054338

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/10/2026, 09:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe
Size 76KB
Sample261031-k68stsat91
SHA256 6a60d0883292dbb027e56f86177c9333a35e33072cbf76ec6bf38da87f054338
MD5 0795e637384b84f7646af43438564aa9
SHA1 30f7a5ce39fd9e60eb69120391391c03e1033492
SHA512 2a1c350aaf7967366e2901ecaa03f2060e74363bae1921a697bdf8d40b8f71d364f65b13c4588ad5c3a0316d8a22367865cc2056fa085592c29a82a8ca3a934b
SSDEEP 768:R7BlpppARFbh6qS+pim269O7X7vX9O7X7vAiuyIEd7gN8:R7ZppAp6qFpaMIwY8
TLSH
T1647373C9795FF789E24A6030D91317BE0EB694176E608ACBB78DF4EC6761AD0F01C426
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery cosmu ransomware worm

Malware Config

Signatures

Family: Cosmu
Cosmu is a Windows worm written in C++.
worm cosmu

Detects Cosmu payload 4 IoCs

Cosmu is a worm written in C++.

resource	yara_rule
behavioral2/memory/1360-0-0x0000000000400000-0x000000000040A000-memory.dmp	family_cosmu
behavioral2/files/0x000700000001b6dd-2.dat	family_cosmu
behavioral2/files/0x00030000000003b1-5.dat	family_cosmu
behavioral2/memory/1360-830-0x0000000000400000-0x000000000040A000-memory.dmp	family_cosmu

Detects executables packed with eXPressor 4 IoCs

resource	yara_rule
behavioral2/memory/1360-0-0x0000000000400000-0x000000000040A000-memory.dmp	INDICATOR_EXE_Packed_eXPressor
behavioral2/files/0x000700000001b6dd-2.dat	INDICATOR_EXE_Packed_eXPressor
behavioral2/files/0x00030000000003b1-5.dat	INDICATOR_EXE_Packed_eXPressor
behavioral2/memory/1360-830-0x0000000000400000-0x000000000040A000-memory.dmp	INDICATOR_EXE_Packed_eXPressor

Renames multiple (4725) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.Annotations.dll.tmp	2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Drawing.Design.dll.tmp	2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ViewOnly_ZeroGrace-ul-oob.xrm-ms.tmp	2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Grace-ul-oob.xrm-ms.tmp	2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_WHATSNEW.XML.tmp	2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe
File created	C:\Program Files\7-Zip\Lang\yo.txt.tmp	2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Net.WebSockets.Client.dll.tmp	2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\PresentationUI.resources.dll.tmp	2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\WindowsFormsIntegration.resources.dll.tmp	2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\blacklist.tmp	2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe
File created	C:\Program Files\7-Zip\Lang\kaa.txt.tmp	2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui.tmp	2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-locale-l1-1-0.dll.tmp	2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Net.Ping.dll.tmp	2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-localization-l1-2-0.dll.tmp	2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationClient.resources.dll.tmp	2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\WindowsBase.resources.dll.tmp	2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\System.Windows.Forms.Design.resources.dll.tmp	2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunec.jar.tmp	2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-ul-oob.xrm-ms.tmp	2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui.tmp	2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\ReachFramework.resources.dll.tmp	2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\fr\System.Xaml.resources.dll.tmp	2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javafx_iio.dll.tmp	2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\sawindbg.dll.tmp	2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-console-l1-1-0.dll.tmp	2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\PresentationFramework.resources.dll.tmp	2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationFramework.resources.dll.tmp	2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.CompilerServices.Unsafe.dll.tmp	2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-heap-l1-1-0.dll.tmp	2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-pl.xrm-ms.tmp	2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Expressions.dll.tmp	2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationClient.resources.dll.tmp	2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Cryptography.ProtectedData.dll.tmp	2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH.HXS.tmp	2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Security.Cryptography.dll.tmp	2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-ul-oob.xrm-ms.tmp	2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-ppd.xrm-ms.tmp	2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jhat.exe.tmp	2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Ion Boardroom.thmx.tmp	2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ServiceModel.Web.dll.tmp	2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\PresentationUI.resources.dll.tmp	2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe.tmp	2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ppd.xrm-ms.tmp	2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CONVERT\OLADD.FAE.tmp	2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\bs-Latn-BA\tipresx.dll.mui.tmp	2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32.dll.tmp	2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\sunec.dll.tmp	2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PPINTL.DLL.tmp	2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\IPM.CFG.tmp	2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EntityPickerIntl.dll.tmp	2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-string-l1-1-0.dll.tmp	2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.ProtectedData.dll.tmp	2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-ppd.xrm-ms.tmp	2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OutlookLogoSmall.contrast-black_scale-100.png.tmp	2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui.tmp	2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.IsolatedStorage.dll.tmp	2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART14.BDR.tmp	2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\Microsoft.Win32.Registry.dll.tmp	2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\mesa3d.md.tmp	2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe.tmp	2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri Light-Constantia.xml.tmp	2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-30_0795e637384b84f7646af43438564aa9_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-461973139-3212354679-1508698038-1000\desktop.ini.tmp
Size 76KB
SHA256 d14cead5b4a5f09e6e86988add2ca239ac3ec45eb0b1dab21c00a145f6558e61
MD5 a335cc317412b34c2d0232698b08f8ad
SHA1 efb9b7b86bd26d6e2c41c1cf46a167577f5b189b
SHA512 9065b318b483a0edc510255283f57d71835a69146c22b76bac15c6817c81f89c397d743abb3a54c87f49327adb7ce51d234d336db733bf47c448682c83bfc869
SSDEEP 768:R7BlpppARFbh6qS+pim269O7X7vX9O7X7vAiuyIEd7gND:R7ZppAp6qFpaMIwYD
TLSH
T1B67384C9795FF789E24A6030D91317BE0EB694176E6086CBB78DF4EC6761AD0F41C026
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7-zip.chm.tmp

Path C:\Program Files\7-Zip\7-zip.chm.tmp
Size 193KB
SHA256 4300c103ee498f5e9a8bcaf822147b3a7854ce292e81a105011f66d459b77c21
MD5 e76a4eb58399aa029b4fbf28e536673a
SHA1 a5edec97dac835fbbd7f3dfc1adc813551a4dcaf
SHA512 4f63823bd1f66223a2ab0a87c3240e705e6dfd63845f971d0c611f5d102b8dfb06107f6535fcf8a70fa59af8efe89fe153e5e73d70a1cbffd921700a20c1ed61
SSDEEP 3072:7pWp6qF8v5wxMxdrwdaEMePCUlZVpnwzuGSsOOOW:0H8BwxMxFELMO9wapsOZW
TLSH
T1BD1426C979AFF789E60A2134D513577E0EB694172E108ACBBB8EF4DC6761AD4F01C026
MD5 SHA1 SHA512 SSDEEP TLSH