Analysis
- max time kernel
150s - max time network
104s - platform
windows11-21h2_x64 - resource
win11-20250502-en - resource tags
arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system - submitted
22/05/2025, 18:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe
Resource
win10v2004-20250502-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe
Resource
win11-20250502-en
windows11-21h2-x64
6 signatures
150 seconds
General
- Target f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe
- Size 39KB
- Sample250522-wtpd7sxnt7
- SHA256 f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af
- MD5 84489549bc6064756aa68fd25281cd3a
- SHA1 199278b9cde3d9fa23d0cd7cf137cb03307431a6
- SHA512 dc3860a74177218b35b92ed7807a03318a25834c2b519798ccf549c9eea6a5f80a4badc9c1f726baadaae0cfd91b5f89ebba431dd6445a4d1b0dd1947c5c4d69
- SSDEEP 768:uZ4FLz8ae+rOn8ae+rOfXoyy7xXhy7xXP:uGIIry9Xhy9XP
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Cosmu family
- Detects Cosmu payload 1 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/memory/248-1095-0x0000000000400000-0x0000000000407000-memory.dmp family_cosmu - Renames multiple (5174) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-pl.xrm-ms.tmp f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-pl.xrm-ms.tmp f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\wxpr.dll.tmp f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-80.png.tmp f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\ClassicPhotoAlbum.potx.tmp f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.AccessControl.dll.tmp f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Contracts.dll.tmp f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-debug-l1-1-0.dll.tmp f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml.tmp f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\MSO.ACL.tmp f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\pl\msipc.dll.mui.tmp f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL001.XML.tmp f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe File created C:\Program Files\Google\Chrome\Application\133.0.6943.60\Locales\hi.pak.tmp f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Grace-ul-oob.xrm-ms.tmp f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL077.XML.tmp f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationClient.dll.tmp f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe.tmp f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-pl.xrm-ms.tmp f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-pl.xrm-ms.tmp f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\msotdintl.dll.tmp f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml.tmp f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ja\System.Xaml.resources.dll.tmp f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\gstreamer-lite.dll.tmp f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md.tmp f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-140.png.tmp f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipshrv.xml.tmp f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Timer.dll.tmp f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationCore.dll.tmp f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pl\UIAutomationClient.resources.dll.tmp f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe File created C:\Program Files\Java\jre-1.8\COPYRIGHT.tmp f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md.tmp f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md.tmp f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\TrebuchetMs.xml.tmp f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\Microsoft.VisualBasic.Forms.resources.dll.tmp f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe File created C:\Program Files\Java\jre-1.8\bin\hprof.dll.tmp f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-conio-l1-1-0.dll.tmp f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-ul-oob.xrm-ms.tmp f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-ul-oob.xrm-ms.tmp f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-pl.xrm-ms.tmp f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Excel.dll.tmp f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-100.png.tmp f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui.tmp f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-math-l1-1-0.dll.tmp f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Xaml.resources.dll.tmp f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\WindowsBase.resources.dll.tmp f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaTypewriterBold.ttf.tmp f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-pl.xrm-ms.tmp f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.ProviderShared.dll.tmp f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Diagnostics.TextWriterTraceListener.dll.tmp f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationClientSideProviders.resources.dll.tmp f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms.tmp f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-180.png.tmp f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL054.XML.tmp f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe File created C:\Program Files\7-Zip\Lang\eu.txt.tmp f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\msspell7.dll.tmp f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemDrawing.dll.tmp f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe.tmp f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-ppd.xrm-ms.tmp f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-180.png.tmp f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe File created C:\Program Files\7-Zip\Lang\nn.txt.tmp f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.CoreLib.dll.tmp f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe File created C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCalls.c.tmp f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe"C:\Users\Admin\AppData\Local\Temp\f669b5bfdcf41d8a5f8883df183f0c56d2d58582a0228df0bb785455360035af.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:248
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-779059454-4269757009-3780780039-1000\desktop.ini.tmp
- Size 39KB
- SHA256 acdc9667207e8fc3a3c962260b69516b349ab3a5f53d4b179f94ab41394cce6e
- MD5 1ae87102c5999f66be6a15dfe03ce9f3
- SHA1 1d5b1dc9687e68ac4e7acfc36ae36a66278da399
- SHA512 dd207790612a67b654d28912cc081c64a87542e89299fa0bcbe2918c1c12ee0e7f18545d55ebfc1b208b224d7ee02924ff372aea03349cb3570cac515ee17772
- SSDEEP 768:uZ4FLz8ae+rOn8ae+rOfXoyy7xXhy7xXM:uGIIry9Xhy9XM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\e62b36dd3cccbd0b2c8aefa1fa8db0\2010_x86.log.html.tmp
- Size 121KB
- SHA256 60b3c9c940982cba6c7c14c6cdfb653b57c5202e46bb3ba64d6773d9de69d839
- MD5 bb64ac3e2d32bea68d4590fdf88b79dd
- SHA1 4bac8c6c0870e2f10ce73a0e717ec724ac4a7c8a
- SHA512 53ffdf84b90bc5e59ed2e5ca2bc28e52f95715de34fde55e9f4384a249472505502b3536f8213c285f43a9b3793348a8e4be545493b8957561f2a52a1aae3527
- SSDEEP 768:uZ4FLz8ae+rOn8ae+rOfXoyy7xXhy7xXHVyw7orgtKNPRY/NylzF6:uGIIry9Xhy9XtoMtKNPRY/Nylk
- MD5 SHA1 SHA512 SSDEEP