Analysis
-
max time kernel
150s -
max time network
100s -
platform
windows11-21h2_x64 -
resource
win11-20250502-en -
resource tags
arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system -
submitted
29/05/2025, 10:03
Static task
static1
Behavioral task
behavioral1
Sample
6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral2
Sample
6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe
Resource
win11-20250502-en
General
-
Target
6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe
-
Size
32KB
-
MD5
007eb12f5a1130fe347452f7b4def493
-
SHA1
54c3e64f02d562761e5c6acda69d05b422b60f0e
-
SHA256
6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875
-
SHA512
606629d1e5eb699eb82ac2f6fc920d7611d5573c6e9365278d53d685a8d60aaee913030e14f6a48a8a0552a8bc26603d6a63dcf3fa8e419a3b72005601caf61c
-
SSDEEP
768:uZ4FLz8ae+rOn8ae+rO+4500n1kJ00n1kc:uGII+49101V
Malware Config
Signatures
-
Cosmu family
-
Detects Cosmu payload 1 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/memory/5248-1215-0x0000000000400000-0x0000000000407000-memory.dmp family_cosmu -
Renames multiple (5356) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\TextConversionModule.dll.tmp 6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\PresentationCore.resources.dll.tmp 6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\UIAutomationTypes.resources.dll.tmp 6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ppd.xrm-ms.tmp 6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe File created C:\Program Files\Microsoft Office\root\rsod\office.x-none.msi.16.x-none.tree.dat.tmp 6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe File created C:\Program Files\Microsoft Office\root\rsod\office32mui.msi.16.en-us.boot.tree.dat.tmp 6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\DESIGNER.ONE.tmp 6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-crt-string-l1-1-0.dll.tmp 6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\MS.PNG.tmp 6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscorlib.dll.tmp 6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe.tmp 6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe File created C:\Program Files\Microsoft Office\root\Client\AppvIsvSubsystems64.dll.tmp 6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial3-pl.xrm-ms.tmp 6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-ppd.xrm-ms.tmp 6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe File created C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.GRAPH.16.1033.hxn.tmp 6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\offreg.dll.tmp 6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe File created C:\Program Files\Common Files\System\ado\msadrh15.dll.tmp 6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Configuration.dll.tmp 6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.Design.resources.dll.tmp 6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe File created C:\Program Files\Microsoft Office\root\Office16\vcruntime140.dll.tmp 6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe File created C:\Program Files\Common Files\System\ado\msader15.dll.tmp 6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Diagnostics.Tools.dll.tmp 6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe File created C:\Program Files\Java\jdk-1.8\lib\packager.jar.tmp 6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp 6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ul-oob.xrm-ms.tmp 6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_F_COL.HXK.tmp 6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Concurrent.dll.tmp 6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\WindowsFormsIntegration.resources.dll.tmp 6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp 6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-pl.xrm-ms.tmp 6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.ReportingServices.DataExtensions.dll.tmp 6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe File created C:\Program Files\Microsoft Office\root\Office16\WordCombinedFloatieModel.bin.tmp 6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml.tmp 6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe File created C:\Program Files\Common Files\microsoft shared\ink\sk-SK\tipresx.dll.mui.tmp 6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\PresentationFramework.dll.tmp 6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-pl.xrm-ms.tmp 6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub_eula.txt.tmp 6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_K_COL.HXK.tmp 6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe File created C:\Program Files\Microsoft Office\root\Office16\CSS7DATA0009.DLL.tmp 6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-140.png.tmp 6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe File created C:\Program Files\AssertSync.M2V.tmp 6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.Design.resources.dll.tmp 6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-ul-oob.xrm-ms.tmp 6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-ul-oob.xrm-ms.tmp 6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-ul-oob.xrm-ms.tmp 6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe File created C:\Program Files\Microsoft Office\root\Office16\ONBttnPPT.dll.tmp 6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe File created C:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui.tmp 6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Controls.Ribbon.resources.dll.tmp 6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\dom.md.tmp 6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe File created C:\Program Files\Java\jre-1.8\bin\jp2ssv.dll.tmp 6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Trial-ul-oob.xrm-ms.tmp 6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-ppd.xrm-ms.tmp 6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.DataWarehouse.Interfaces.DLL.tmp 6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-100.png.tmp 6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll.tmp 6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-utility-l1-1-0.dll.tmp 6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019DemoR_BypassTrial180-ppd.xrm-ms.tmp 6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\GRINTL32.DLL.tmp 6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\sqmapi.dll.tmp 6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe File created C:\Program Files\Microsoft Office\root\Office16\csi.dll.tmp 6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Formats.Asn1.dll.tmp 6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Drawing.Primitives.dll.tmp 6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\WindowsFormsIntegration.resources.dll.tmp 6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp 6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe"C:\Users\Admin\AppData\Local\Temp\6ec27ecc5b8e841cf3b244cbc1502da80f00f62f345ea4f450a0648aaf627875.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5248
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32KB
MD59edb7b55889bcb87634133136dda12bc
SHA1ccffceefc1f902216ce199b3ec963efb8c666ce6
SHA25610f9bcc7d393f20f58b87265f195ff4e9d3d67e83e6c65a2dc6d0672b456e5d3
SHA5121dac5cfaafc6877be8e9cea1a7f09eea240ba8d6d5e75540f8b9aff5ecfe4c7e6466ebbe79835398c99a2ee072de54a90b24ea5aabd2380284dc35f83f841a63
-
Filesize
117KB
MD5bb5edc415890069cf64d115e990aa1ee
SHA101d81d6a425817a106081e82842cfe2215221ef7
SHA256552c54dc84984a101178558aec24302e40ca23b441b76e9018a07701e24b130f
SHA512fa86fce81fd92a0137d57d4060d7cbfcf73b149bd60abb1b4574aafc154b2289f7f7137d18eeb85a6ae6dc0317eca3c0f572cc098332a4484c3b368409a8962e