Analysis
- max time kernel
150s - max time network
103s - platform
windows11-21h2_x64 - resource
win11-20250502-en - resource tags
arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system - submitted
22/05/2025, 14:10
Behavioral task
behavioral1
Sample
74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe
Resource
win10v2004-20250502-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe
Resource
win11-20250502-en
windows11-21h2-x64
6 signatures
150 seconds
General
- Target 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe
- Size 23KB
- Sample250522-rgpf8avqs7
- SHA256 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e
- MD5 52b8025bf0822f8f6e94d10f047a7950
- SHA1 1d7d33d4621c593a44be0cd217f7842cd7ddfa35
- SHA512 16e36c469c214e6f6d0778e89769894f6413c304683a1dafa76494b4dc187de3389d5f731f203fb71733bf1b948f42c13d40ca7b5912defdb05db0c3cbb0aca9
- SSDEEP 384:gBt7Br5xjL9AgA71FbhvP/KWLsqmFae+rOAqmFae+rOIjQ0I0G:s7BlpppARFbhdLz8ae+rOn8ae+rOgl9G
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Cosmu family
- Detects Cosmu payload 2 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x002400000002ada4-1.dat family_cosmu behavioral2/files/0x00040000000270d9-5.dat family_cosmu - Renames multiple (5357) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ACEODBC.DLL.tmp 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Controls.Ribbon.resources.dll.tmp 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Windows.Input.Manipulations.dll.tmp 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe File created C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\System.ValueTuple.dll.tmp 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\th\msipc.dll.mui.tmp 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\SQLENGINEMESSAGES.XML.tmp 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ul-phn.xrm-ms.tmp 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.ReaderWriter.dll.tmp 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.IO.FileSystem.AccessControl.dll.tmp 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.resources.dll.tmp 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe.tmp 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\LASER.WAV.tmp 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\it\msipc.dll.mui.tmp 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationClient.resources.dll.tmp 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\PresentationFramework.resources.dll.tmp 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-sysinfo-l1-1-0.dll.tmp 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ppd.xrm-ms.tmp 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ppd.xrm-ms.tmp 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe File created C:\Program Files\Microsoft Office\root\Office16\OART.DLL.tmp 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL058.XML.tmp 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN109.XML.tmp 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe File created C:\Program Files\Google\Chrome\Application\133.0.6943.60\Locales\zh-TW.pak.tmp 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-pl.xrm-ms.tmp 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-ul-oob.xrm-ms.tmp 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\ContemporaryPhotoAlbum.potx.tmp 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ACETXT.DLL.tmp 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InputPersonalization.exe.mui.tmp 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XDocument.dll.tmp 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\PresentationUI.resources.dll.tmp 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Primitives.dll.tmp 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Forms.Primitives.resources.dll.tmp 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe File created C:\Program Files\Microsoft Office\root\Client\C2R64.dll.tmp 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Green.xml.tmp 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Grace-ul-oob.xrm-ms.tmp 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwnumbered.dotx.tmp 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe File created C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.WINWORD.16.1033.hxn.tmp 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Forms.Design.resources.dll.tmp 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Ion.thmx.tmp 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml.tmp 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerView.PowerView.x-none.msi.16.x-none.xml.tmp 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-ul-oob.xrm-ms.tmp 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe File created C:\Program Files\7-Zip\Lang\ar.txt.tmp 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-runtime-l1-1-0.dll.tmp 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-pl.xrm-ms.tmp 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-pl.xrm-ms.tmp 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\msipc.dll.tmp 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Help\hxds.dll.tmp 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ul.xrm-ms.tmp 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\NewCommentRTL.White.png.tmp 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\sdxs.xml.tmp 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe File created C:\Program Files\7-Zip\Lang\fy.txt.tmp 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-console-l1-2-0.dll.tmp 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ul-oob.xrm-ms.tmp 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL081.XML.tmp 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe File created C:\Program Files\7-Zip\Lang\fur.txt.tmp 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.Win32.Registry.AccessControl.dll.tmp 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\System.Windows.Controls.Ribbon.resources.dll.tmp 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe File created C:\Program Files\Google\Chrome\Application\133.0.6943.60\Locales\nb.pak.tmp 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe File created C:\Program Files\Java\jre-1.8\bin\instrument.dll.tmp 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Violet II.xml.tmp 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-pl.xrm-ms.tmp 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe"C:\Users\Admin\AppData\Local\Temp\74de7450e1120243aa25870a1a16750fc534b28916a30a1fd19dbdb0a905f56e.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5756
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-330179853-1108322181-418488014-1000\desktop.ini.tmp
- Size 23KB
- SHA256 6d0cbdb6718a1951530492ca1cee9c00dc276f60b1088b7f10f816a3e2aad9bf
- MD5 c8ea7ddfffdfa81861f9c0c0923e5ffe
- SHA1 5f0210fd5bcb8d48b465def21aa6318893aafeee
- SHA512 de237d428a3944ba30e7c19cc1f7b991cc24870d528f4e2051da0acea635f0ccd557079dbdcc2281b419f7973abc1f908e6f107ccf3fad66a97b3c9456e5491b
- SSDEEP 384:gBt7Br5xjL9AgA71FbhvP/KWLsqmFae+rOAqmFae+rOIjQ0I0B:s7BlpppARFbhdLz8ae+rOn8ae+rOgl9B
- MD5 SHA1 SHA512 SSDEEP
- Path C:\b5678467481f56688dc2ce816954\2010_x86.log.html.tmp
- Size 104KB
- SHA256 654210f097278a5b2fc6e56f9c2d3b259b997e584d0f762815f6d7354ff6cf5c
- MD5 f7044510eb05543b6149a35ed35b4b11
- SHA1 e8148af496f8cfb1cd804f0cace4a9d8c557c12e
- SHA512 38b067d11d9f6bd8c8dc6a81dd4a5302f35c25afe3430d46527d39a28415c0928b23f63e69b12085f89be3889fa029ac48a2e8198cbb984264ec13becaa0523d
- SSDEEP 768:s7BlpppARFbhdLz8ae+rOn8ae+rOgl9tVyw7oLAlqVf5oPti/T1E:s7ZppApdIIo9XoslqVf5oPti/a
- MD5 SHA1 SHA512 SSDEEP