cosmu | ec53c4ec029f76638d3f0e51d7c168db022b95deec43f6ea03a03e9f6604194c

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/11/2026, 14:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
Size 42KB
Sample261105-rt67ssxt4r
SHA256 ec53c4ec029f76638d3f0e51d7c168db022b95deec43f6ea03a03e9f6604194c
MD5 bdc9a25031e3ff96b12446132c752a1a
SHA1 fff5b87d026be054e782fb8976edb3f844538a21
SHA512 22d8d53f644e23cc42c8e72e9b7bbad74ae9f5aaacf2d9b9042d9ece9846ece6f75d89855afcf8abfbf8d52c128649fb34e2d2d1775ab6e016f2b1dfa3e60dd2
SSDEEP 768:R7BlpppARFbh6qS+pim22/5Jmwd0V6/gwrclJDZJD+Ys9Gs:R7ZppAp6qFpf5Jmwd0V6nglJDZJD+YVs
TLSH
T189138D0E1617E023E2554130A97B6578947BA03A7F19EF6BEB06BD2EB8616D0D83C05B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery cosmu ransomware worm

Malware Config

Signatures

Family: Cosmu
Cosmu is a Windows worm written in C++.
worm cosmu

Detects Cosmu payload 4 IoCs

Cosmu is a worm written in C++.

resource	yara_rule
behavioral2/memory/4688-0-0x0000000000400000-0x000000000040A000-memory.dmp	family_cosmu
behavioral2/files/0x000d00000001b302-2.dat	family_cosmu
behavioral2/files/0x00030000000003b3-5.dat	family_cosmu
behavioral2/memory/4688-599-0x0000000000400000-0x000000000040A000-memory.dmp	family_cosmu

Custom signature

Detects executables packed with eXPressor 4 IoCs

resource	yara_rule
behavioral2/memory/4688-0-0x0000000000400000-0x000000000040A000-memory.dmp	INDICATOR_EXE_Packed_eXPressor
behavioral2/files/0x000d00000001b302-2.dat	INDICATOR_EXE_Packed_eXPressor
behavioral2/files/0x00030000000003b3-5.dat	INDICATOR_EXE_Packed_eXPressor
behavioral2/memory/4688-599-0x0000000000400000-0x000000000040A000-memory.dmp	INDICATOR_EXE_Packed_eXPressor

Renames multiple (2312) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\el.txt.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcor.dll.mui.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\dotnet\host\fxr\6.0.27\hostfxr.dll.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Overlapped.dll.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\ReachFramework.resources.dll.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Xaml.resources.dll.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ja\System.Windows.Input.Manipulations.resources.dll.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\System.Xaml.resources.dll.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.dll.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Reflection.Emit.ILGeneration.dll.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Input.Manipulations.resources.dll.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\ReachFramework.resources.dll.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pl\ReachFramework.resources.dll.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\ar.pak.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\icu.md.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.AppContext.dll.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.ILGeneration.dll.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\WindowsFormsIntegration.resources.dll.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\lib\ir.idl.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\7-Zip\Lang\uk.txt.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\7-Zip\Lang\id.txt.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Thread.dll.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pl\System.Windows.Input.Manipulations.resources.dll.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javac.exe.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.vi-vn.dll.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\Microsoft.CSharp.dll.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Input.Manipulations.resources.dll.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Printing.dll.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\lib\ct.sym.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Common Files\System\uk-UA\wab32res.dll.mui.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\ReachFramework.resources.dll.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationClientSideProviders.resources.dll.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\PrivacySandboxAttestationsPreloaded\privacy-sandbox-attestations.dat.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\v8_context_snapshot.bin.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.tr-tr.dll.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\qps-ploc\tipresx.dll.mui.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Buffers.dll.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.Watcher.dll.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\deployJava1.dll.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\UIAutomationClient.resources.dll.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jsound.dll.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.TraceSource.dll.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.Calendars.dll.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Console.dll.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.IO.FileSystem.AccessControl.dll.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationClient.dll.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\vcruntime140_cor3.dll.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.HttpListener.dll.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Forms.Primitives.resources.dll.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCalls.c.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Forms.Primitives.resources.dll.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\sunec.dll.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\asm.md.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui.tmp	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-04_bdc9a25031e3ff96b12446132c752a1a_elex_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-4154726816-2055034831-2297277433-1000\desktop.ini.tmp
Size 42KB
SHA256 8bc2dcf9a8e334d9a93bbe53440e3919ca0348e3e28d5568e1fe334bb96afd5c
MD5 c9e126e2efa8bf9c79ded28ac536bab7
SHA1 b3ce027890ce26210a8f1c7d91eb62d4f4d38da7
SHA512 a2bb0328f139ce12c56398fd97936699f403ac0774add42e130056e8ea4cca8ca7929c782b8e56f4e0440c0847bcf9f322e547f89a3aa0179c86d1c2572dd44f
SSDEEP 768:R7BlpppARFbh6qS+pim22/5Jmwd0V6/gwrclJDZJD+Ys9G7:R7ZppAp6qFpf5Jmwd0V6nglJDZJD+YV7
TLSH
T189138E0E1617E023E2544130A97B7578947BA0397F19EF67EB16BD2EB8612D0983C06B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7-zip.chm.tmp

Path C:\Program Files\7-Zip\7-zip.chm.tmp
Size 159KB
SHA256 0a876e05c2f427a10e6b00ed018619336bc3f1bf8906634cd0920e858bdbac93
MD5 df1e2d75b59cca403a1904956890de4a
SHA1 98e47c86491333a0589914f233afdcf62e2068f0
SHA512 d76f9b5f394f43db6b4f223d6da8a4735b11c941306db99e20ef48f590fb85417a3af03abd2df7dfdb419d2e2af0273015e22e9dedd86b37df4a6d3de623e4b9
SSDEEP 3072:7pWp6qFx/0ongP5wxMxdrwdaEMePCUlZVpnwzuGSsOOOK:0HxJM5wxMxFELMO9wapsOZK
TLSH
T1FFF3025A2696A012D616423062A3A43E7373685A3F05CF52FF4BFA0F75B17D4B43C12B
MD5 SHA1 SHA512 SSDEEP TLSH