cosmu | ec53c4ec029f76638d3f0e51d7c168db022b95deec43f6ea03a03e9f6604194c

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/11/2026, 14:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
Size 42KB
Sample261105-rt67ssxt4r
SHA256 ec53c4ec029f76638d3f0e51d7c168db022b95deec43f6ea03a03e9f6604194c
MD5 bdc9a25031e3ff96b12446132c752a1a
SHA1 fff5b87d026be054e782fb8976edb3f844538a21
SHA512 22d8d53f644e23cc42c8e72e9b7bbad74ae9f5aaacf2d9b9042d9ece9846ece6f75d89855afcf8abfbf8d52c128649fb34e2d2d1775ab6e016f2b1dfa3e60dd2
SSDEEP 768:R7BlpppARFbh6qS+pim22/5Jmwd0V6/gwrclJDZJD+Ys9Gs:R7ZppAp6qFpf5Jmwd0V6nglJDZJD+YVs
TLSH
T189138D0E1617E023E2554130A97B6578947BA03A7F19EF6BEB06BD2EB8616D0D83C05B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery cosmu ransomware worm

Malware Config

Signatures

Family: Cosmu
Cosmu is a Windows worm written in C++.
worm cosmu

Detects Cosmu payload 4 IoCs

Cosmu is a worm written in C++.

resource	yara_rule
behavioral1/memory/4740-0-0x0000000000400000-0x000000000040A000-memory.dmp	family_cosmu
behavioral1/files/0x001200000001e549-2.dat	family_cosmu
behavioral1/files/0x000400000001e656-5.dat	family_cosmu
behavioral1/memory/4740-798-0x0000000000400000-0x000000000040A000-memory.dmp	family_cosmu

Custom signature

Detects executables packed with eXPressor 4 IoCs

resource	yara_rule
behavioral1/memory/4740-0-0x0000000000400000-0x000000000040A000-memory.dmp	INDICATOR_EXE_Packed_eXPressor
behavioral1/files/0x001200000001e549-2.dat	INDICATOR_EXE_Packed_eXPressor
behavioral1/files/0x000400000001e656-5.dat	INDICATOR_EXE_Packed_eXPressor
behavioral1/memory/4740-798-0x0000000000400000-0x000000000040A000-memory.dmp	INDICATOR_EXE_Packed_eXPressor

Renames multiple (5126) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\ShapeCollector.exe.mui.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\default_apps\external_extensions.json.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ul-phn.xrm-ms.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-ppd.xrm-ms.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-ppd.xrm-ms.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfr\default.jfc.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\YAHOO.COM.XML.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\PresentationFramework-SystemData.dll.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Grace-ul-oob.xrm-ms.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Author2String.XSL.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32.dll.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.X509Certificates.dll.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Core.dll.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Input.Manipulations.resources.dll.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-pl.xrm-ms.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_COL.HXC.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\tracedefinition130.xml.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemXmlLinq.dll.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\libffi.md.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ul-phn.xrm-ms.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Common Files\System\uk-UA\wab32res.dll.mui.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationProvider.resources.dll.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ppd.xrm-ms.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-180.png.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Console.dll.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\dom.md.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-ul-oob.xrm-ms.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-pl.xrm-ms.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\shaded.dotx.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\WindowsFormsIntegration.resources.dll.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-ppd.xrm-ms.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-140.png.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.Primitives.resources.dll.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\UIAutomationClientSideProviders.resources.dll.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\FormatWait.tif.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-ul-oob.xrm-ms.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-pl.xrm-ms.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\PresentationFramework.resources.dll.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-processthreads-l1-1-1.dll.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT.HXS.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN103.XML.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\Microsoft.VisualBasic.Core.dll.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\EntityPicker.dll.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\7-Zip\Lang\pa-in.txt.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsptg.xml.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-debug-l1-1-0.dll.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\OutlookMeetingReqReadNaiveBayesCommandRanker.txt.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MLCFG32.CPL.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Forms.resources.dll.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationClient.resources.dll.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-ul-oob.xrm-ms.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\NOTE.CFG.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\OpenSSL64.DllA\openssl64.dlla.manifest.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Primitives.dll.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Xml.XmlDocument.dll.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-895009113-1202185046-1686627690-1000\desktop.ini.tmp
Size 42KB
SHA256 14268cad45259492f80022bd07a3c116fbd8e596068e8f4b934590ca32442592
MD5 2252e38aaa204876d1ec39c43d44232d
SHA1 da9cb6b39c397aac77bdcb09d6890fd21771b716
SHA512 c4013f254f7dc77329e5ffbf87b3c67a56a7fa3a4dca6ac8d98fd7579d38f1bdab24d62977cf68ef7403d94f48a7510ab4a3407ca200b5b7ba83851acad5a73c
SSDEEP 768:R7BlpppARFbh6qS+pim22/5Jmwd0V6/gwrclJDZJD+Ys9Gp:R7ZppAp6qFpf5Jmwd0V6nglJDZJD+YVp
TLSH
T111138E0E1617E023E2544130A97B7578947BA0397F19EFA7EF16BD2EB8612D0D83C06B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7-zip.chm.tmp

Path C:\Program Files\7-Zip\7-zip.chm.tmp
Size 159KB
SHA256 69d254e1f6262bed4f9552d59f88eb202f0d9e17d7698795cdf8d9a397bd490a
MD5 d4297e574f8c1a61060b6df77efc279c
SHA1 2147812fac8409582061d3fc03ecb9a87418d0a6
SHA512 79c607aa105519f8e887483aa1b8c2fbd56f3e2498acf79c9717a7aa4772f2c6df01ed79cc0c4d4730d63e340fc4b84eb7bdbc7fe6660272ba583951480f9ee2
SSDEEP 3072:7pWp6qFx/0ongPiwxMxdrwdaEMePCUlZVpnwzuGSsOOOK:0HxJMiwxMxFELMO9wapsOZK
TLSH
T1DDF3025A2696A022D616023072A3A43E7373685A3E05CF52FF4AFA0F75B17D4B43C12B
MD5 SHA1 SHA512 SSDEEP TLSH