Analysis
- max time kernel
150s - max time network
101s - platform
windows11-21h2_x64 - resource
win11-20250502-en - resource tags
arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system - submitted
28/05/2025, 07:06
Behavioral task
behavioral1
Sample
6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe
Resource
win10v2004-20250502-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe
Resource
win11-20250502-en
windows11-21h2-x64
6 signatures
150 seconds
General
- Target 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe
- Size 46KB
- Sample250528-hw655stq12
- SHA256 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492
- MD5 7f46c2ff1e19c5144bbf4cb9424f5e5c
- SHA1 5e1654c03cbf54c6b9b8277fae4209efa0c8e5b5
- SHA512 c37aa652a0e0a73c210b767796ca5b88640b3175c243ef2e723fbb437bf5b5f0a5e490afd90e58360541a25da6eaec6af0706e3775a5b50b2648e772f1cfd23f
- SSDEEP 768:s7BlpppARFbhdLz8ae+rOn8ae+rO2aNQP+UDQvzY2zM3hq:s7ZppApdIIJQP+UDQv9Khq
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Cosmu family
- Detects Cosmu payload 2 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000f00000002ac36-1.dat family_cosmu behavioral2/files/0x00040000000270b6-5.dat family_cosmu - Renames multiple (5287) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\en-GB\tipresx.dll.mui.tmp 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\TURABIAN.XSL.tmp 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-180.png.tmp 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe File created C:\Program Files\7-Zip\Lang\tr.txt.tmp 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msaddsr.dll.mui.tmp 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\ReachFramework.resources.dll.tmp 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Forms.Design.resources.dll.tmp 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ja\UIAutomationClientSideProviders.resources.dll.tmp 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe.tmp 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ORGCINTL.DLL.tmp 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\PresentationUI.resources.dll.tmp 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\PenImc_cor3.dll.tmp 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe File created C:\Program Files\Java\jdk-1.8\jvisualvm.txt.tmp 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ppd.xrm-ms.tmp 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\pl\msipc.dll.mui.tmp 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7EN.DLL.tmp 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe File created C:\Program Files\Microsoft Office\root\rsod\proof.fr-fr.msi.16.fr-fr.tree.dat.tmp 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui.tmp 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe.tmp 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxbgt.dll.tmp 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe File created C:\Program Files\Common Files\System\msadc\msadce.dll.tmp 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe File created C:\Program Files\Google\Chrome\Application\133.0.6943.60\Locales\th.pak.tmp 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-string-l1-1-0.dll.tmp 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\blacklist.tmp 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\sbicuin53_64.dll.tmp 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe File created C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\tipresx.dll.mui.tmp 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe File created C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll.tmp 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\WindowsBase.resources.dll.tmp 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\WindowsBase.resources.dll.tmp 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\cmm\PYCC.pf.tmp 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_pt_BR.properties.tmp 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-ul-phn.xrm-ms.tmp 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe File created C:\Program Files\Microsoft Office\root\rsod\word.x-none.msi.16.x-none.boot.tree.dat.tmp 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunpkcs11.jar.tmp 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-100.png.tmp 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-100.png.tmp 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe File created C:\Program Files\Microsoft Office\root\rsod\osm.x-none.msi.16.x-none.tree.dat.tmp 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationUI.resources.dll.tmp 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationClientSideProviders.resources.dll.tmp 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\dcpr.dll.tmp 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md.tmp 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-ul-oob.xrm-ms.tmp 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLPROXY.DLL.tmp 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml.tmp 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe.tmp 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-pl.xrm-ms.tmp 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-BA\msipc.dll.mui.tmp 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Latn-RS\msipc.dll.mui.tmp 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe File created C:\Program Files\7-Zip\Lang\hy.txt.tmp 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationClient.resources.dll.tmp 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-ppd.xrm-ms.tmp 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-ul-phn.xrm-ms.tmp 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe File created C:\Program Files\Microsoft Office\root\rsod\powerpoint.x-none.msi.16.x-none.tree.dat.tmp 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ja\System.Xaml.resources.dll.tmp 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe File created C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\local_policy.jar.tmp 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe File created C:\Program Files\Microsoft Office\root\rsod\excel.x-none.msi.16.x-none.boot.tree.dat.tmp 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe File created C:\Program Files\7-Zip\Lang\mng2.txt.tmp 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fi-fi.dll.tmp 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.Primitives.dll.tmp 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\TrebuchetMs.xml.tmp 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-pl.xrm-ms.tmp 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE.HXS.tmp 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml.tmp 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe"C:\Users\Admin\AppData\Local\Temp\6817587427d78aca49dcd50d5e7aa72b097dc6a6b15ad66ea6c2350a485bb492.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2192
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1178639776-3244803473-3821071008-1000\desktop.ini.tmp
- Size 46KB
- SHA256 b5260567dcf2651c7105b3188799d457b1cb007a1db4edb55218c868b0ab1d3c
- MD5 3d1b779c2556c62a51ea03d91ed186c1
- SHA1 d68eb955a8a24c61668c7c4d328b8ee7e9b5bc81
- SHA512 16a938ee5662e9000d3abc1f81d4c47f43bdfad0e99d5077de92edb7b9b11ba54f5373d372bf53d111bd93611f031975e6d8b01e98205e89798a951f53882458
- SSDEEP 768:s7BlpppARFbhdLz8ae+rOn8ae+rO2aNQP+UDQvzY2zM3hE:s7ZppApdIIJQP+UDQv9KhE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\f8efe770fb160c3e4e\2010_x86.log.html.tmp
- Size 126KB
- SHA256 85c66798e544e4e40d722cfb6a6cf629a08db4febd8f796e34e16bf1e9c945ca
- MD5 b1bde6a515ddeadf69552e70db8784b0
- SHA1 06e3158be497473e961d2b4c2f62791de6590dd5
- SHA512 a502359b46fda6dcd0904d8d6d9ac0ae14ad868f5afb4cccb188ba7475c4d02ccc03e4108be9f6520b0ce8d705f741660230f9e117c6a4a8011f2e69639ecf09
- SSDEEP 1536:s7ZppApdIIJQP+UDQv9Kh2oN86d+54mVSve:spWp8kv9Kh2oN86d++mVSve
- MD5 SHA1 SHA512 SSDEEP