Overview
overview
10Static
static
10Red-Flaged...3b.exe
windows10-2004-x64
10Red-Flaged...3b.exe
windows11-ltsc_2024-x64
10Red-Flaged...6a.exe
windows10-2004-x64
10Red-Flaged...6a.exe
windows11-ltsc_2024-x64
10Red-Flaged...eb.exe
windows10-2004-x64
10Red-Flaged...eb.exe
windows11-ltsc_2024-x64
10Red-Flaged...02.exe
windows10-2004-x64
10Red-Flaged...02.exe
windows11-ltsc_2024-x64
10Red-Flaged...c5.exe
windows10-2004-x64
10Red-Flaged...c5.exe
windows11-ltsc_2024-x64
10Red-Flaged...37.exe
windows10-2004-x64
10Red-Flaged...37.exe
windows11-ltsc_2024-x64
10Red-Flaged...e7.exe
windows10-2004-x64
10Red-Flaged...e7.exe
windows11-ltsc_2024-x64
10Red-Flaged...64.exe
windows10-2004-x64
8Red-Flaged...64.exe
windows11-ltsc_2024-x64
8Red-Flaged...5d.exe
windows10-2004-x64
10Red-Flaged...5d.exe
windows11-ltsc_2024-x64
10Red-Flaged...d6.exe
windows10-2004-x64
10Red-Flaged...d6.exe
windows11-ltsc_2024-x64
10Red-Flaged...e7.exe
windows10-2004-x64
10Red-Flaged...e7.exe
windows11-ltsc_2024-x64
10Red-Flaged...d8.exe
windows10-2004-x64
10Red-Flaged...d8.exe
windows11-ltsc_2024-x64
10Red-Flaged...55.exe
windows10-2004-x64
10Red-Flaged...55.exe
windows11-ltsc_2024-x64
10Red-Flaged...bc.exe
windows10-2004-x64
10Red-Flaged...bc.exe
windows11-ltsc_2024-x64
10Red-Flaged...6a.exe
windows10-2004-x64
10Red-Flaged...6a.exe
windows11-ltsc_2024-x64
10Red-Flaged...03.exe
windows10-2004-x64
10Red-Flaged...03.exe
windows11-ltsc_2024-x64
10Resubmissions
26/09/2026, 22:37
260926-2j7qpatv8r26/09/2026, 01:02
260926-bd84fs1bnc1026/09/2026, 00:59
260926-bcllrs1y2k1020/09/2026, 10:36
260920-mnczjsab771020/09/2026, 07:07
260920-hx3jcadp5x1008/09/2026, 15:38
260908-s27nzagd9315/08/2026, 21:05
260815-zw6ytat1ez15/08/2026, 20:50
260815-zmxnsatzgs15/08/2026, 20:46
260815-zkklfatcnf15/08/2026, 20:40
260815-zf5e2stcjbAnalysis
- max time kernel
150s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/07/2026, 12:54
Static task
static1
Behavioral task
behavioral1
Sample
Red-Flaged/a2c01011d0a2b5ee0a51fae41109e9ccfe2aae16e6c4212addac7f757f23893b.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
Red-Flaged/a2c01011d0a2b5ee0a51fae41109e9ccfe2aae16e6c4212addac7f757f23893b.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
Red-Flaged/ab036cc442800d2d71a3baa9f2d6b27e3813b9f740d7c3e7635b84e3e7a8d66a.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
Red-Flaged/ab036cc442800d2d71a3baa9f2d6b27e3813b9f740d7c3e7635b84e3e7a8d66a.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
Red-Flaged/aca01073676a7e2003ac7af9b27b9aa54c076ea94cf4c9627828b12955261aeb.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
Red-Flaged/aca01073676a7e2003ac7af9b27b9aa54c076ea94cf4c9627828b12955261aeb.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
Red-Flaged/b0dfaf509de38749c49afcb3cd34d27126044bb77cc16896b02ebced6f95db02.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
Red-Flaged/b0dfaf509de38749c49afcb3cd34d27126044bb77cc16896b02ebced6f95db02.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
Red-Flaged/b2e27be69931b678ee13b42f83438dc5.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
Red-Flaged/b2e27be69931b678ee13b42f83438dc5.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
Red-Flaged/b3da793a00eebaf8987fe2b759369e3d7ff02d91111c219c707bcb9709357637.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
Red-Flaged/b3da793a00eebaf8987fe2b759369e3d7ff02d91111c219c707bcb9709357637.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
Red-Flaged/b8e71845cc8ccd668a3436d1952a6c57649974bb8399e599dc33afc4c0843be7.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
Red-Flaged/b8e71845cc8ccd668a3436d1952a6c57649974bb8399e599dc33afc4c0843be7.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
Red-Flaged/bfb39f486372a509f307cde3361795a2f9f759cbeb4cac07562dcbaebc070364.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
Red-Flaged/bfb39f486372a509f307cde3361795a2f9f759cbeb4cac07562dcbaebc070364.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral17
Sample
Red-Flaged/c43a34e78ba6913551af41857fb63a3545acd6a9248e8a4de884988b3ccf895d.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
Red-Flaged/c43a34e78ba6913551af41857fb63a3545acd6a9248e8a4de884988b3ccf895d.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral19
Sample
Red-Flaged/c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
Red-Flaged/c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral21
Sample
Red-Flaged/c5f49c0f566a114b529138f8bd222865c9fa9fa95f96ec1ded50700764a1d4e7.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
Red-Flaged/c5f49c0f566a114b529138f8bd222865c9fa9fa95f96ec1ded50700764a1d4e7.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
Behavioral task
behavioral23
Sample
Red-Flaged/c9fd60a7a3974913a39a4dcdad4b4ccaeb93b614741af2eb7ee0d892130689d8.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
Red-Flaged/c9fd60a7a3974913a39a4dcdad4b4ccaeb93b614741af2eb7ee0d892130689d8.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
Behavioral task
behavioral25
Sample
Red-Flaged/d60dc6965f6d68a3e7c82d42e90bfda7ad3c5874d2c59a66df6212aef027b455.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
Red-Flaged/d60dc6965f6d68a3e7c82d42e90bfda7ad3c5874d2c59a66df6212aef027b455.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral27
Sample
Red-Flaged/d8c5d04d859189de3321a635abcd5ddf84f28f04119830402c66527ae36ae3bc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
Red-Flaged/d8c5d04d859189de3321a635abcd5ddf84f28f04119830402c66527ae36ae3bc.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral29
Sample
Red-Flaged/dc54117b965674bad3d7cd203ecf5e7fc822423a3f692895cf5e96e83fb88f6a.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
Red-Flaged/dc54117b965674bad3d7cd203ecf5e7fc822423a3f692895cf5e96e83fb88f6a.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral31
Sample
Red-Flaged/df5ab9015833023a03f92a797e20196672c1d6525501a9f9a94a45b0904c7403.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
Red-Flaged/df5ab9015833023a03f92a797e20196672c1d6525501a9f9a94a45b0904c7403.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
General
- Target Red-Flaged/c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe
- Size 436KB
- Sample260712-p5a8dsas8k
- SHA256 c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6
- MD5 a59cca1e2762abe6f3518452655e7c32
- SHA1 3302718cffc7454b85df790a61da318b4a93505d
- SHA512 016e09b7895f1fbe814ce395a7277d2e4c09f3168ae86e16de7a1e6cdb6e63d6865beee0d0718b1f76b3cb12310563094c642bd3e02e15abbb25c130b71fa760
- SSDEEP 6144:KbEJIjNDv0bNXkbvLdEJIjNDv0bNXkbvL5:rIZGNXkbvL0IZGNXkbvL5
- TLSH T1A394185069BDFD60EA245279AC537DC392593ECA3F9DCF52B1A188F38438AA51C4B0D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral20/memory/4100-0-0x0000000000400000-0x000000000040B000-memory.dmp family_cosmu behavioral20/files/0x000b00000001b87e-2.dat family_cosmu behavioral20/files/0x000600000001b1c8-6.dat family_cosmu behavioral20/memory/4100-409-0x0000000000400000-0x000000000040B000-memory.dmp family_cosmu - Renames multiple (2547) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral20/memory/4100-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral20/files/0x000b00000001b87e-2.dat upx behavioral20/files/0x000600000001b1c8-6.dat upx behavioral20/memory/4100-409-0x0000000000400000-0x000000000040B000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\he.pak.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\Java\jre-1.8\bin\javafx_iio.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordaccore.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\Java\jre-1.8\bin\jp2native.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Text.Encoding.Extensions.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\PresentationCore.resources.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\UIAutomationProvider.resources.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Windows.Controls.Ribbon.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\System.Xaml.resources.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\Common Files\microsoft shared\ink\hy-AM\tipresx.dll.mui.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationClient.resources.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Permissions.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\MEIPreload\manifest.json.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\mesa3d.md.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\clrjit.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Runtime.InteropServices.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.Design.resources.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Windows.Input.Manipulations.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\WindowsBase.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\currency.data.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\7-Zip\Lang\et.txt.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\Common Files\microsoft shared\ink\ml-IN\tipresx.dll.mui.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\Common Files\System\Ole DB\ja-JP\msdasqlr.dll.mui.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\dotnet\host\fxr\6.0.27\hostfxr.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\dotnet\host\fxr\8.0.15\hostfxr.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processenvironment-l1-1-0.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.IsolatedStorage.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.UnmanagedMemoryStream.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.SecureString.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\WindowsBase.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationClientSideProviders.resources.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\System.Windows.Forms.resources.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\public_suffix.md.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngdatatype.md.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\jsse.jar.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\Java\jre-1.8\bin\fontmanager.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\tabskb.dll.mui.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\7-Zip\Lang\co.txt.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Tools.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.CompilerServices.Unsafe.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\netstandard.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\deployJava1.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Algorithms.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationClient.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Input.Manipulations.resources.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-processthreads-l1-1-1.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\msinfo32.exe.mui.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationFramework.resources.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationFramework.resources.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationClientSideProviders.resources.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\Internet Explorer\ja-JP\ieinstal.exe.mui.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\Java\jre-1.8\bin\w2k_lsa_auth.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.AccessControl.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Input.Manipulations.resources.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Input.Manipulations.resources.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Xaml.resources.dll.tmp c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Red-Flaged\c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe"C:\Users\Admin\AppData\Local\Temp\Red-Flaged\c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4100
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini.tmp
- Size 436KB
- SHA256 4c7473bbdd0c13428e0374fbe53daadbed5d1d8aedbbc00a5b9f0ff5f1fdfba1
- MD5 c7089b1967b1013160b13d7d4efbb08d
- SHA1 2ed99c667b62c742ae5f942173c907e13ec385ef
- SHA512 808b405374ec86295f9f8944ca75cce4045bd8280aca739546c4f774c41576bdf3fc69716e1954cd25393aa9e30f6c435206acecb601639b2d5cdee74e558662
- SSDEEP 6144:KbEJIjNDv0bNXkbvLdEJIjNDv0bNXkbvLa:rIZGNXkbvL0IZGNXkbvLa
- TLSH T19694185069BDFD60EA245279AC537DC392593ECA3F9DCF52B1A188F38438AA51C4B0D3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 535KB
- SHA256 882a6b95b5d9a18a9b5cdc024ae4a2cb9a362d8ad99f8afef2bbc297d89e7f13
- MD5 475bbbe9b5f6ba6e1fb29a16dbb7c13e
- SHA1 aa9bccd042bce113b577fb7a545e5c9cad5786e4
- SHA512 449586486922869fd88a963b5007279d7f58a9bb95346e3cf66818c0d6ddd20f1e4303a9f0f892795c620c42b3f526ad67cb3d211246131292ffe7f184749022
- SSDEEP 6144:KbEJIjNDv0bNXkbvLdEJIjNDv0bNXkbvLjMfTinqncsWp+/:rIZGNXkbvL0IZGNXkbvLjMfunbsW8/
- TLSH T15BC408507DAEFD60EE245279AC537D8392493ACA3E9DCF52B1A188F3843CA951C4B4D3
- MD5 SHA1 SHA512 SSDEEP TLSH