Analysis
- max time kernel
150s - max time network
104s - platform
windows11-21h2_x64 - resource
win11-20250502-en - resource tags
arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system - submitted
22/05/2025, 11:54
Behavioral task
behavioral1
Sample
fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe
Resource
win10v2004-20250502-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe
Resource
win11-20250502-en
windows11-21h2-x64
6 signatures
150 seconds
General
- Target fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe
- Size 21KB
- Sample250522-n22eqssrt6
- SHA256 fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913
- MD5 74e8c4041ac50551b66d007977ed04d5
- SHA1 917cd3a61f0fb7c96a56f3fc9c78b38191f761e3
- SHA512 c2aa4556bfb873d2b8259adf9188c9aeb01f8d46ef0578e7eb06ac6521d10228d85975a730208ae8af2fca56c5ef9c9d096fd81119144fbf1012ea29d8b83903
- SSDEEP 384:gBt7Br5xjL9AgA71FbhvP/KWLsqmFae+rOAqmFae+rOmoHHOtiJfoHHOtiJ5nIM:s7BlpppARFbhdLz8ae+rOn8ae+rOmoHc
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Cosmu family
- Detects Cosmu payload 2 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000c000000029f9d-1.dat family_cosmu behavioral2/files/0x00040000000270da-5.dat family_cosmu - Renames multiple (5356) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\vcruntime140_1.dll.tmp fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Grace-ppd.xrm-ms.tmp fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml.tmp fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Dynamic.Runtime.dll.tmp fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\tr\WindowsBase.resources.dll.tmp fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\prism_sw.dll.tmp fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-pl.xrm-ms.tmp fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProDemoR_BypassTrial180-ul-oob.xrm-ms.tmp fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ul-phn.xrm-ms.tmp fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Exchange.WebServices.dll.tmp fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Formats.Asn1.dll.tmp fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Riblet.eftx.tmp fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.fr-fr.xml.tmp fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-pl.xrm-ms.tmp fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_company.png.tmp fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-180.png.tmp fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe File created C:\Program Files\Microsoft Office\root\rsod\powerpointmui.msi.16.en-us.tree.dat.tmp fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.tmp fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\j2pcsc.dll.tmp fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Smokey Glass.eftx.tmp fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml.tmp fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-pl.xrm-ms.tmp fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ul-phn.xrm-ms.tmp fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ul-oob.xrm-ms.tmp fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ul-phn.xrm-ms.tmp fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ul-oob.xrm-ms.tmp fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe File created C:\Program Files\Common Files\System\fr-FR\wab32res.dll.mui.tmp fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe File created C:\Program Files\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui.tmp fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Sockets.dll.tmp fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe File created C:\Program Files\Microsoft Office\root\Office16\CHAKRACORE.DLL.tmp fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Diagnostics.Tracing.dll.tmp fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\WindowsBase.resources.dll.tmp fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\cs\System.Windows.Input.Manipulations.resources.dll.tmp fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\wpfgfx_cor3.dll.tmp fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.tmp fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ConsumerSub_Bypass30-ppd.xrm-ms.tmp fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\GR8GALRY.GRA.tmp fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\WindowsFormsIntegration.resources.dll.tmp fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationClient.resources.dll.tmp fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalDemoR_BypassTrial180-ul-oob.xrm-ms.tmp fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\VVIEWRES.DLL.tmp fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\GostName.XSL.tmp fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe File created C:\Program Files\Microsoft Office\root\rsod\osmmui.msi.16.en-us.boot.tree.dat.tmp fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-crt-time-l1-1-0.dll.tmp fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Debug.dll.tmp fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Console.dll.tmp fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaSansDemiBold.ttf.tmp fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ppd.xrm-ms.tmp fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-ul-oob.xrm-ms.tmp fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml.tmp fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Json.dll.tmp fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-pl.xrm-ms.tmp fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ul-phn.xrm-ms.tmp fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_profile.png.tmp fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe File created C:\Program Files\7-Zip\Lang\he.txt.tmp fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nl-nl.dll.tmp fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Controls.Ribbon.resources.dll.tmp fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Xaml.resources.dll.tmp fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\ecc.md.tmp fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription3-pl.xrm-ms.tmp fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe"C:\Users\Admin\AppData\Local\Temp\fe7886852f2e030e43b3dc8ec993ce18199cc94f6367b3b9fff54d151a433913.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1560
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3588213599-686740421-4058676312-1000\desktop.ini.tmp
- Size 21KB
- SHA256 3a64193974ce0b35e25976592e9cff2b7a0d71df48c392710d61cec4eeb4aa23
- MD5 00166a7d63cf2fda35d2f5ce6326cf5e
- SHA1 924bc3fac9fe83c7def4689dbc2ed6bbbcbba7b5
- SHA512 bd0847eea9791f575866a5f65d2a94aa01c0ade444a4323839242dc35203c0497efb030622e9cae4a1be0fd6a749957034b6e1443eaac2097b2d998cb68c8ddd
- SSDEEP 384:gBt7Br5xjL9AgA71FbhvP/KWLsqmFae+rOAqmFae+rOmoHHOtiJfoHHOtiJ5nIY:s7BlpppARFbhdLz8ae+rOn8ae+rOmoHI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ef2ee615ae93a516ddfc423cbf0f901a\2010_x86.log.html.tmp
- Size 102KB
- SHA256 16860c71ea3fe0c7683ca2035a1e980019911818257295a18aa4fffcb66971ed
- MD5 78cd7c64686cefdd590d3dc32090521e
- SHA1 38c65b453737e6feee782473d02541d77720cd7e
- SHA512 6438c1b54a73a8d493651d322924e09628459a385ad39cadfad97797298d85b38d135cdc2633e71567af981ee1f4639171e57b1bede84048a72b9c55db04dccb
- SSDEEP 768:s7BlpppARFbhdLz8ae+rOn8ae+rOmoHHOtiJfoHHOtiJFIBVyw7oLHqSFgJ4oVqb:s7ZppApdIIBEWobqSFgJ4oVqVB
- MD5 SHA1 SHA512 SSDEEP