Analysis
- max time kernel
149s - max time network
104s - platform
windows11-21h2_x64 - resource
win11-20250508-en - resource tags
arch:x64arch:x86image:win11-20250508-enlocale:en-usos:windows11-21h2-x64system - submitted
28/05/2025, 09:35
Behavioral task
behavioral1
Sample
9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe
Resource
win10v2004-20250502-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe
Resource
win11-20250508-en
windows11-21h2-x64
6 signatures
150 seconds
General
- Target 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe
- Size 80KB
- Sample250528-lkrsvsvpy5
- SHA256 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b
- MD5 c8a48813cd1e92269717c81ffaa6503c
- SHA1 3039656377f422acedadb2f6bac55ac3521cd52c
- SHA512 dd0d13ca530155b0daf180bf29889e5390c13b9f9b6fced51d9c5ef31b128a8227a8ac9eb0931dae6f4060ece61d59168a5c8860bf1a4ed69d1239aa5afe6987
- SSDEEP 1536:s7ZppApdII1GCoM4oMYoitDHqKWovoPUvkB0RvONCR4Kn9cX7TqYJ1VCq:spWpvX4XpitrxWovoPUvkxCR4KnsL1Cq
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Cosmu family
- Detects Cosmu payload 2 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000b00000002abbe-1.dat family_cosmu behavioral2/files/0x00040000000270e8-5.dat family_cosmu - Renames multiple (5195) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\ShapeCollector.exe.mui.tmp 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l2-1-0.dll.tmp 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.dll.tmp 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.Win32.SystemEvents.dll.tmp 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe File created C:\Program Files\Java\jre-1.8\lib\hijrah-config-umalqura.properties.tmp 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Grace-ul-oob.xrm-ms.tmp 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-ul-oob.xrm-ms.tmp 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ppd.xrm-ms.tmp 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ReachFramework.dll.tmp 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremDemoR_BypassTrial365-ppd.xrm-ms.tmp 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_Grace-ul-oob.xrm-ms.tmp 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-140.png.tmp 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml.tmp 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.dll.tmp 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\awt.dll.tmp 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-ppd.xrm-ms.tmp 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\SUCTION.WAV.tmp 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msix.dll.tmp 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe File created C:\Program Files\7-Zip\Lang\sw.txt.tmp 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hi-in.dll.tmp 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.tmp 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe.tmp 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\jpeg_fx.md.tmp 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe File created C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10_RTL.mp4.tmp 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WWINTL.DLL.tmp 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationClient.resources.dll.tmp 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ul-oob.xrm-ms.tmp 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL108.XML.tmp 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-checkmark.png.tmp 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Xaml.resources.dll.tmp 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe File created C:\Program Files\Microsoft Office\root\Office16\CHAKRACORE.DLL.tmp 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-cn.dll.tmp 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.X509Certificates.dll.tmp 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationTypes.resources.dll.tmp 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\System.Windows.Forms.Primitives.resources.dll.tmp 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe File created C:\Program Files\Google\Chrome\Application\133.0.6943.60\PrivacySandboxAttestationsPreloaded\manifest.json.tmp 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe File created C:\Program Files\Java\jdk-1.8\include\win32\jni_md.h.tmp 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\dom.md.tmp 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ul-oob.xrm-ms.tmp 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.IO.Compression.Native.dll.tmp 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Cryptography.ProtectedData.dll.tmp 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-ul-oob.xrm-ms.tmp 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ul-oob.xrm-ms.tmp 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\System.Spatial.NetFX35.dll.tmp 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll.tmp 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l1-2-0.dll.tmp 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe File created C:\Program Files\Microsoft Office\root\Office16\3082\MSO.ACL.tmp 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe File created C:\Program Files\Common Files\microsoft shared\ink\lv-LV\tipresx.dll.mui.tmp 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\WindowsFormsIntegration.resources.dll.tmp 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe File created C:\Program Files\Google\Chrome\Application\133.0.6943.60\Locales\ml.pak.tmp 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jfr.dll.tmp 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Aspect.xml.tmp 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe File created C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\SOLVER32.DLL.tmp 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL087.XML.tmp 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaSansRegular.ttf.tmp 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ppd.xrm-ms.tmp 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-pl.xrm-ms.tmp 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessBasic2019_eula.txt.tmp 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-ppd.xrm-ms.tmp 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe File created C:\Program Files\Common Files\microsoft shared\ink\IpsPlugin.dll.tmp 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\System.Xaml.resources.dll.tmp 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\public_suffix.md.tmp 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\sound.properties.tmp 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe"C:\Users\Admin\AppData\Local\Temp\9423d937568e97c2b09d2e6583f96aab44d647887acefd04b8beb228160f797b.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5096
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3687046934-3833731302-526866946-1000\desktop.ini.tmp
- Size 80KB
- SHA256 5d714347096ab6fda27687c48abdf7f17cf94121a998485fb07e7a5ab5752893
- MD5 7dc1f09c828a2b39cd430868d8f5bd3f
- SHA1 16cbd6829b364268b5036289a2c9c72bcef414b1
- SHA512 efa14168b599bab976cefe6dea3109862a4373da2925da5de8d94f94d6fd8fc5e471386f92fd5f34ca5bb3f74758e2e98a0deee4253113447d07986157479c27
- SSDEEP 1536:s7ZppApdII1GCoM4oMYoitDHqKWovoPUvkB0RvONCR4Kn9cX7TqYJ1VCQ:spWpvX4XpitrxWovoPUvkxCR4KnsL1CQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\b9147e4cea9b95b6635d\2010_x86.log.html.tmp
- Size 160KB
- SHA256 5f371883c04963090371c0a264047eb17a8ab290426679669d1f8091efa13c87
- MD5 37eadda171f2d5269e05d25864765087
- SHA1 a338659277a87495026680c4eac206967e6a346c
- SHA512 11efd6c36b434c8559f697ec99dc4bc81ce2ddbfc31f5c88001b0d7845e9b9947d2b1ee1dc2c07852817c7918555a2bf5325054db9887783a150018fd3acf76d
- SSDEEP 3072:spWpvX4XpitrxWovoPUvkxCR4KnsL1CLoJ7MK1mGu1ame:N9Iwt1WyoPwkxCR4ic1CwQIxl
- MD5 SHA1 SHA512 SSDEEP