Analysis
-
max time kernel
149s -
max time network
102s -
platform
windows11-21h2_x64 -
resource
win11-20250508-en -
resource tags
arch:x64arch:x86image:win11-20250508-enlocale:en-usos:windows11-21h2-x64system -
submitted
05/06/2025, 08:15
Behavioral task
behavioral1
Sample
035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral2
Sample
035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe
Resource
win11-20250508-en
General
-
Target
035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe
-
Size
22KB
-
MD5
4d072e3966ff1328f1e37b0358f85476
-
SHA1
1b8b11bb47169cb3ac0db99ee982c1d013624cf0
-
SHA256
035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d
-
SHA512
cdb0ef28de61a8a50de206a0a874c1e533423b302dc1e0e0da6d697678a971da9e28392fc0c93001f7e718ee591b28b0b1b835e8238261344d9e662cda623e9a
-
SSDEEP
384:gBt7Br5xjL9AgA71FbhvP/KWLsqmFae+rOAqmFae+rOiOZ2OZoaqyklYWynDyklM:s7BlpppARFbhdLz8ae+rOn8ae+rOka5i
Malware Config
Signatures
-
Cosmu family
-
Detects Cosmu payload 2 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000f00000002abbf-1.dat family_cosmu behavioral2/files/0x00040000000270e8-5.dat family_cosmu -
Renames multiple (5357) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ul-phn.xrm-ms.tmp 035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019DemoR_BypassTrial180-ppd.xrm-ms.tmp 035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\XLSLICER.DLL.tmp 035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Specialized.dll.tmp 035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.Primitives.resources.dll.tmp 035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Forms.resources.dll.tmp 035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\xalan.md.tmp 035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Grace-ppd.xrm-ms.tmp 035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_PrepidBypass-ppd.xrm-ms.tmp 035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Json.dll.tmp 035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Collections.Immutable.dll.tmp 035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Private.Xml.dll.tmp 035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\WindowsFormsIntegration.resources.dll.tmp 035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe File created C:\Program Files\Google\Chrome\Application\133.0.6943.60\chrome.exe.sig.tmp 035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-pl.xrm-ms.tmp 035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.Common.FrontEnd.dll.tmp 035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe File created C:\Program Files\Microsoft Office\root\Office16\csi.dll.tmp 035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.ThreadPool.dll.tmp 035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\System.Windows.Forms.Primitives.resources.dll.tmp 035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe File created C:\Program Files\Google\Chrome\Application\133.0.6943.60\Locales\af.pak.tmp 035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLFLTR.DAT.tmp 035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe File created C:\Program Files\7-Zip\Lang\fur.txt.tmp 035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe File created C:\Program Files\Java\jre-1.8\lib\tzdb.dat.tmp 035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-ppd.xrm-ms.tmp 035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp 035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe File created C:\Program Files\Microsoft Office\root\Office16\Custom.propdesc.tmp 035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe File created C:\Program Files\Microsoft Office\root\rsod\proofing.msi.16.en-us.tree.dat.tmp 035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe File created C:\Program Files\7-Zip\Lang\sk.txt.tmp 035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l1-1-0.dll.tmp 035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.cpl.tmp 035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp 035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md.tmp 035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\WidescreenPresentation.potx.tmp 035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\rtscom.dll.mui.tmp 035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.osmmui.msi.16.en-us.xml.tmp 035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008\FA000000008.tmp 035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe File created C:\Program Files\Microsoft Office\root\rsod\osmuxmui.msi.16.en-us.tree.dat.tmp 035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\osmia32.msi.tmp 035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.TextWriterTraceListener.dll.tmp 035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe File created C:\Program Files\Google\Chrome\Application\133.0.6943.60\dxil.dll.tmp 035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-errorhandling-l1-1-0.dll.tmp 035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe File created C:\Program Files\Microsoft Office\root\Integration\SPPRedist.msi.tmp 035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ul-phn.xrm-ms.tmp 035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-140.png.tmp 035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe File created C:\Program Files\Microsoft Office\root\Office16\msoutilstat.etw.man.tmp 035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.Design.resources.dll.tmp 035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Design.dll.tmp 035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClient.resources.dll.tmp 035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe File created C:\Program Files\Google\Chrome\Application\133.0.6943.60\VisualElements\SmallLogo.png.tmp 035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\classlist.tmp 035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Ion Boardroom.thmx.tmp 035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_Subscription-ul-oob.xrm-ms.tmp 035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN058.XML.tmp 035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\Microsoft.Win32.Registry.dll.tmp 035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationCore.resources.dll.tmp 035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\nashorn.jar.tmp 035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\jsse.jar.tmp 035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe File created C:\Program Files\Java\jre-1.8\bin\jdwp.dll.tmp 035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ul-oob.xrm-ms.tmp 035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE.HXS.tmp 035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-100.png.tmp 035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\mshwLatin.dll.mui.tmp 035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe File created C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll.tmp 035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe File created C:\Program Files\Microsoft Office\root\Office15\pidgenx.dll.tmp 035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe"C:\Users\Admin\AppData\Local\Temp\035f93695a50583c38d9a608ba3f3f3465119c31821e16384dc2579a49794e5d.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2428
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
22KB
MD5e0953c09c60c98ccd245f762a670eec8
SHA1c96c85ddab20c2bc70c82fa022da8c396324a0a6
SHA256bf7fcc62daed6ff45ff6d797740a2c7c48ef196a437672ad78c25f20b6fb4377
SHA512c08181dc13e36d12749962c17466c5ecfcafc0967f46ed7db1afd3dbf2227b809afb4704e875199515a067f1460330b8d1e579765718ddeecc23c7b5115e4977
-
Filesize
103KB
MD55964526d2817df4a017b630eb209b319
SHA15ca284d0a1c759ad1d5ccc511dcbeb5da93f54e4
SHA2561cb848ca91af3e109ad4c946a838e3e1ac43602dfa32733a0f666dfb9d693418
SHA5120425accc7ff518a72ac4b463bae8898c78d1bede8b6600d1900a84d0eb2dceed2c346d2e527537bbc9cde6d607dcd6ec141abca1b1fd8090165ef5cda927e611