Analysis
- max time kernel
150s - max time network
103s - platform
windows11-21h2_x64 - resource
win11-20250502-en - resource tags
arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system - submitted
22/05/2025, 11:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe
Resource
win10v2004-20250502-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe
Resource
win11-20250502-en
windows11-21h2-x64
6 signatures
150 seconds
General
- Target 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe
- Size 64KB
- Sample250522-n239bssrv2
- SHA256 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1
- MD5 229eae67960cd616467c0ea455c86926
- SHA1 cdf2e438cbd1a458b227057c14b10f12b77c55f5
- SHA512 3ad8f9943658484d6f92200dbce819b462044b2bbe91d3b8f0e772695e91e94dbfb18f6d24315a88cbb1ffb5d8ea51c784213098639d705b8b528aed1e72bc91
- SSDEEP 768:uZ4FLz8ae+rOn8ae+rOZFJUDJUN/jzlsiPicBreOzpkOHXkIdW+bQziGTYI2NkKz:uGIIXJUDJUzreQvowZ
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Cosmu family
- Detects Cosmu payload 1 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/memory/5752-1113-0x0000000000400000-0x0000000000407000-memory.dmp family_cosmu - Renames multiple (5242) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\1033\EXPTOOWS.DLL.tmp 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEIMP.DLL.tmp 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe File created C:\Program Files\Microsoft Office\root\rsod\powerview.x-none.msi.16.x-none.tree.dat.tmp 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe.tmp 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\cmm\GRAY.pf.tmp 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe File created C:\Program Files\Java\jdk-1.8\lib\jvm.lib.tmp 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\BOOKOSI.TTF.tmp 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.resources.dll.tmp 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\WindowsFormsIntegration.resources.dll.tmp 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationClientSideProviders.dll.tmp 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ja\System.Windows.Forms.Design.resources.dll.tmp 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe File created C:\Program Files\Java\jre-1.8\bin\server\Xusage.txt.tmp 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-ppd.xrm-ms.tmp 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ul-phn.xrm-ms.tmp 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-pl.xrm-ms.tmp 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.DiagnosticSource.dll.tmp 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\mesa3d.md.tmp 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui.tmp 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Parallel.dll.tmp 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Security.AccessControl.dll.tmp 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Forms.Primitives.resources.dll.tmp 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHLEX.DAT.tmp 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat.tmp 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.ZipFile.dll.tmp 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encoding.dll.tmp 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe File created C:\Program Files\Google\Chrome\Application\133.0.6943.60\chrome_elf.dll.tmp 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-synch-l1-2-0.dll.tmp 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe File created C:\Program Files\Microsoft Office\root\Office16\ONRES.DLL.tmp 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Formats.Asn1.dll.tmp 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.Design.resources.dll.tmp 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe.tmp 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe File created C:\Program Files\Java\jdk-1.8\include\jvmti.h.tmp 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ul-oob.xrm-ms.tmp 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-80.png.tmp 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Xaml.resources.dll.tmp 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\MSQRY32.CHM.tmp 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe File created C:\Program Files\Google\Chrome\Application\133.0.6943.60\Locales\af.pak.tmp 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightItalic.ttf.tmp 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Top Shadow.eftx.tmp 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-ul-oob.xrm-ms.tmp 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe File created C:\Program Files\Microsoft Office\root\Office16\AppvIsvSubsystems64.dll.tmp 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\netstandard.dll.tmp 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libffi.md.tmp 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe.tmp 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Buffers.dll.tmp 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Input.Manipulations.resources.dll.tmp 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ppd.xrm-ms.tmp 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Parallel.dll.tmp 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll.tmp 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_company.png.tmp 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\ApothecaryLetter.dotx.tmp 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe File created C:\Program Files\7-Zip\Lang\eo.txt.tmp 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.tmp 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\WindowsBase.resources.dll.tmp 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Security.Cryptography.ProtectedData.dll.tmp 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe.tmp 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.PPT.tmp 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-180.png.tmp 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\ANTQUAB.TTF.tmp 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui.tmp 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe.tmp 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-ppd.xrm-ms.tmp 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe"C:\Users\Admin\AppData\Local\Temp\002acac0f38fae88c05e5c28e792b9d4e0511624d337cb62dde69de9563c8fc1.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5752
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1283078542-320785498-2248628612-1000\desktop.ini.tmp
- Size 64KB
- SHA256 8faf58c746cda7d5098ef78470812b12206ba685bad2741ce27d1ba3147bff5e
- MD5 aeee3c522607464dee40839d7db59370
- SHA1 fb063803368f16c838e4d9efd47f78184dc7aaec
- SHA512 38873b9f40251c3727dbba8121c2d1d992d53d668a4bc6280d5be7032092ea92d15dc6a3b520fd6d77bad92d9b4de1592b064ae4193fe446a6657eea8bd65089
- SSDEEP 768:uZ4FLz8ae+rOn8ae+rOZFJUDJUN/jzlsiPicBreOzpkOHXkIdW+bQziGTYI2NkK8:uGIIXJUDJUzreQvowu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\caf455ed4ae411b0ba0aa2\2010_x64.log.html.tmp
- Size 150KB
- SHA256 8c3450885e374d620bfeabfcae307c8dd3c994622bc563cc263a8ea725b88350
- MD5 edc718b52e35eba3e994e66bf3acfc82
- SHA1 1f09703f5053a939e54677e17eaa1e5734dd6ec6
- SHA512 b9df79b236798a5c355a75a2c2337cabb09f65ac53375f08697d875505ae88f03462e1fb69fd76beb6ad44357039d7de4db01dbc0251b2365246ef81ec7f62ab
- SSDEEP 768:uZ4FLz8ae+rOn8ae+rOZFJUDJUN/jzlsiPicBreOzpkOHXkIdW+bQziGTYI2NkKi:uGIIXJUDJUzreQvowNoPiWtghZE94cou
- MD5 SHA1 SHA512 SSDEEP