Analysis
- max time kernel
150s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/07/2026, 10:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe
- Size 12.5MB
- Sample260722-mfdk4sdf34
- SHA256 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081
- MD5 4e9385c18402b0fb514b678356d07ca6
- SHA1 88cbedafe7cea2f0092c8be8ed2f13e396ea5995
- SHA512 2fbd3f875ac29d736c5b22b2b80ae96ce6ccdb34dff48ead4f3f3787013b5ceb9fda85fe26d26b90ab44f449041f4b0cc8476ec4691ae630c9aa4e95966dd216
- SSDEEP 98304:rzqEv60gsOTGMN6bbjNCZia56g65PRdKNtMGMnRzBrpFSqLsO86msAeN75jJW5B2:rE0XQGMN6bbMLP+2zqqGGEn
- TLSH T172D639BE6F64FC609880AC52D9B2CE50DD8F5C827199C430857EF9608E44ED1CDADAB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 2 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/memory/3376-0-0x0000000000400000-0x0000000000407000-memory.dmp family_cosmu behavioral2/memory/3376-30-0x0000000000400000-0x0000000000407000-memory.dmp family_cosmu - Renames multiple (220) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\Lang\ga.txt.tmp 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe File created C:\Program Files\7-Zip\Lang\sk.txt.tmp 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll.tmp 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.tmp 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.tmp 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\cpprestsdk.dll.tmp 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe File created C:\Program Files\7-Zip\Lang\ru.txt.tmp 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe File created C:\Program Files\7-Zip\License.txt.tmp 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.tmp 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll.tmp 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.et-ee.dll.tmp 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities.json.tmp 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe File created C:\Program Files\7-Zip\Lang\ta.txt.tmp 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\offreg.dll.tmp 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml.tmp 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe File created C:\Program Files\Common Files\microsoft shared\ink\be-BY\tipresx.dll.mui.tmp 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe File created C:\Program Files\7-Zip\Lang\ka.txt.tmp 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hi-in.dll.tmp 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.tmp 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ja-jp.dll.tmp 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe File created C:\Program Files\Common Files\microsoft shared\ink\cy-GB\tipresx.dll.mui.tmp 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe File created C:\Program Files\7-Zip\7-zip.chm.tmp 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe File created C:\Program Files\7-Zip\Lang\cs.txt.tmp 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe File created C:\Program Files\7-Zip\Lang\he.txt.tmp 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe File created C:\Program Files\7-Zip\Lang\lij.txt.tmp 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.tmp 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe.tmp 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\SubsystemController.man.tmp 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe File created C:\Program Files\7-Zip\Lang\ja.txt.tmp 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe File created C:\Program Files\7-Zip\Lang\pa-in.txt.tmp 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe File created C:\Program Files\7-Zip\Lang\sw.txt.tmp 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe File created C:\Program Files\7-Zip\Lang\th.txt.tmp 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sl-si.dll.tmp 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe File created C:\Program Files\Common Files\microsoft shared\ink\ca-ES\tipresx.dll.mui.tmp 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe File created C:\Program Files\7-Zip\Lang\pt-br.txt.tmp 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lt-lt.dll.tmp 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msix.dll.tmp 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\RepoMan.dll.tmp 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe File created C:\Program Files\7-Zip\Lang\id.txt.tmp 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe File created C:\Program Files\7-Zip\Lang\ne.txt.tmp 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ru-ru.dll.tmp 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.tmp 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll.tmp 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe File created C:\Program Files\7-Zip\Lang\pl.txt.tmp 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.el-gr.dll.tmp 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe File created C:\Program Files\7-Zip\Lang\ca.txt.tmp 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe File created C:\Program Files\7-Zip\Lang\et.txt.tmp 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe File created C:\Program Files\7-Zip\Lang\it.txt.tmp 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe File created C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.tmp 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe File created C:\Program Files\7-Zip\Lang\tk.txt.tmp 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll.tmp 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe File created C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui.tmp 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe File created C:\Program Files\7-Zip\Lang\bn.txt.tmp 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ko-kr.dll.tmp 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ms-my.dll.tmp 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe File created C:\Program Files\7-Zip\Lang\af.txt.tmp 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe File created C:\Program Files\7-Zip\Lang\tt.txt.tmp 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pl-pl.dll.tmp 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe File created C:\Program Files\7-Zip\7z.sfx.tmp 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe File created C:\Program Files\7-Zip\Lang\br.txt.tmp 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe File created C:\Program Files\7-Zip\Lang\hi.txt.tmp 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll.tmp 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll.tmp 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe"C:\Users\Admin\AppData\Local\Temp\07da5fdcc5b69fdbdd7c8b1bd41d37be1687074545ade9ac0d72784e34190081.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3376
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1738198120-2966725515-3980530802-1000\desktop.ini.tmp
- Size 12.5MB
- SHA256 b3a6a75cb32e95f4e303205fca168b8f759828dae2fe567a349a4eedc1ce3b91
- MD5 299d7c79f1b0977efa3359ce00f5a6eb
- SHA1 5dd7f796d5375dc29efc3966bc794ba6a7c12d45
- SHA512 ea0b7029f6f20afd53e56b9b9b430d34abcd0c8c4cedf4b7fae50b951aa824cba9d514279ce9499d7b1108c030c3bc7f30894e764c336ab19bfc065effa1e7a1
- SSDEEP 98304:rzqEv60gsOTGMN6bbjNCZia56g65PRdKNtMGMnRzBrpFSqLsO86msAeN75jJW5B6:rE0XQGMN6bbMLP+2zqqGGEb
- TLSH T111D639BE6F64FC609880AC52D9B2CE50DD8F5C827199C430857EF9608E44ED1CDADAB7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 12.6MB
- SHA256 e6699fad684d31727868cf0b0ca9c97439d4514c8857147277c80bcf1d04948a
- MD5 f69e27b1ad9a5623198133e788017a1b
- SHA1 844e03057c31f30309d005fd4cea65a84357d7ad
- SHA512 9f5af5e64da451b643d8442009eb3a196b55ede15e432eefed58e95f253e3dc0dba6953fb822917833ad9141adc0122da016cd6629179241cdb115043ec57976
- SSDEEP 98304:rzqEv60gsOTGMN6bbjNCZia56g65PRdKNtMGMnRzBrpFSqLsO86msAeN75jJW5BL:rE0XQGMN6bbMLP+2zqqGGEC
- TLSH T164D639BE6F64FC608880AC52D9B2CE50DD8F5C827599C430857EF9608E44ED1CDADAB7
- MD5 SHA1 SHA512 SSDEEP TLSH