Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20250502-en -
resource tags
arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system -
submitted
29/05/2025, 10:02
Behavioral task
behavioral1
Sample
60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe
Resource
win10v2004-20250502-en
General
-
Target
60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe
-
Size
27KB
-
MD5
cbd64e1517bc97367d6a060054438dad
-
SHA1
1e3c439611c0bc0aa82eb91d24b4d2fb98885381
-
SHA256
60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55
-
SHA512
22f628136afe53aa2c2a601cdf9aac809fece970ae0398d8110b56879b46cfe57ee3d4d2ce20ead25215b72610a3296e6b26739102d6306cfe4d08b1246fdc25
-
SSDEEP
768:s7BlpppARFbhdLz8ae+rOn8ae+rOb83656yoNUOIiJfoNUOIiJ2:s7ZppApdIIPMD4Y
Malware Config
Signatures
-
Cosmu family
-
Detects Cosmu payload 2 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral1/files/0x000900000002349a-1.dat family_cosmu behavioral1/files/0x000400000001ee9b-5.dat family_cosmu -
Renames multiple (5275) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ServiceModel.Web.dll.tmp 60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\System.Windows.Input.Manipulations.resources.dll.tmp 60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\WindowsFormsIntegration.resources.dll.tmp 60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe File created C:\Program Files\Google\Chrome\Application\133.0.6943.60\Locales\fa.pak.tmp 60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ppd.xrm-ms.tmp 60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.tmp 60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.es-es.dll.tmp 60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\ReachFramework.resources.dll.tmp 60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\Microsoft.VisualBasic.Forms.resources.dll.tmp 60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md.tmp 60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\Informix.xsl.tmp 60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN121.XML.tmp 60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\ReachFramework.resources.dll.tmp 60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe File created C:\Program Files\Java\jdk-1.8\lib\orb.idl.tmp 60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-pl.xrm-ms.tmp 60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-ul-oob.xrm-ms.tmp 60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe File created C:\Program Files\Microsoft Office\root\Office16\OWSSUPP.DLL.tmp 60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7FR.dub.tmp 60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipshrv.xml.tmp 60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe.tmp 60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe.tmp 60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.cpl.tmp 60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ppd.xrm-ms.tmp 60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encodings.Web.dll.tmp 60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ppd.xrm-ms.tmp 60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\InputPersonalization.exe.mui.tmp 60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Text.Encoding.CodePages.dll.tmp 60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationFramework.resources.dll.tmp 60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ja\UIAutomationClient.resources.dll.tmp 60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\System.Xaml.resources.dll.tmp 60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-ppd.xrm-ms.tmp 60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe File created C:\Program Files\Microsoft Office\root\Office16\CSS7DATA000A.DLL.tmp 60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe File created C:\Program Files\Microsoft Office\root\Office16\ONWordAddin.dll.tmp 60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe File created C:\Program Files\7-Zip\Lang\eu.txt.tmp 60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-MX\tipresx.dll.mui.tmp 60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\msinfo32.exe.mui.tmp 60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Security.Principal.Windows.dll.tmp 60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Xaml.resources.dll.tmp 60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\zip.dll.tmp 60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Grace-ul-oob.xrm-ms.tmp 60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-ul-oob.xrm-ms.tmp 60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.tmp 60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe File created C:\Program Files\Common Files\System\ado\msadomd.dll.tmp 60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe File created C:\Program Files\Common Files\System\msadc\msdfmap.dll.tmp 60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe File created C:\Program Files\Common Files\System\Ole DB\msxactps.dll.tmp 60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordbi.dll.tmp 60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\WindowsBase.resources.dll.tmp 60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\flavormap.properties.tmp 60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-time-l1-1-0.dll.tmp 60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationClientSideProviders.resources.dll.tmp 60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe File created C:\Program Files\Microsoft Office\root\Client\msvcp140.dll.tmp 60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ul-oob.xrm-ms.tmp 60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ul-oob.xrm-ms.tmp 60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ppd.xrm-ms.tmp 60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Office.dll.tmp 60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\as90.xsl.tmp 60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe File created C:\Program Files\Microsoft Office\root\Office16\AugLoop\third-party-notices.txt.tmp 60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe File created C:\Program Files\Common Files\System\msadc\msadco.dll.tmp 60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationClientSideProviders.resources.dll.tmp 60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Resources.Extensions.dll.tmp 60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-ul-oob.xrm-ms.tmp 60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe File created C:\Program Files\Microsoft Office\root\Office16\OFFSYMXL.TTF.tmp 60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL065.XML.tmp 60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\comments.win32.tpn.tmp 60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe"C:\Users\Admin\AppData\Local\Temp\60ff2e2c618390b9b37e8722df41a356096088e6d456f9028d2578d77bcc7b55.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:844
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
27KB
MD53f22a864cd1f73c06b674d6dd749e4a9
SHA1de9e2e25b4841d0e42c5dfcce6d98a19d90c6317
SHA2563c0bb763bdb919989e6d3814239fd92888e69dd2c954751cf7ce1a058ed17bed
SHA5124c734ee48121133ca3f596cfacdf667dce802f9279ae378a5f181c5f259d7c47f2a6effaf5f84a5bc216fed727acc779823fa728f3e8a29d653f58cb14ee3e4a
-
Filesize
113KB
MD57935129a8b98731716e38c6c3d6c5f61
SHA10cd05f5d32a2b87760169d5e5196263f1c8f11de
SHA256b0decab81fa4658ee70e3001275360455032260cd9db14475f7d0decd85ab5d6
SHA512b6f46bcdf4fdb301d6934a46a24213e4560048245cd2e1506399fd92dd5ecbb4d7e58f85b50998c8ae73e5c8c982b2777f7e07c7b453d7dc24a81f4d2ffb294f