Analysis
- max time kernel
150s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/07/2026, 18:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe
- Size 12.5MB
- Sample260722-wwdeqa1fla
- SHA256 eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8
- MD5 4d3e5a599fb440cc1e8fe48fe05eef88
- SHA1 932935cdb211c9c8b58611c126155a9b86065861
- SHA512 d5ce119fdd2308dfbe8e5157d60135150c1a17aa4241ba17320b9ba96d46416de42011317c5d557c45a1bffd06bac80e6f03707a210c01d643d70f39428a45a0
- SSDEEP 98304:rzqEv60gsOTGMN6bbjNCZia56g65PRdKNtMGMnRzBrpFSqLsO86msAeN75jJW5Br:rE0XQGMN6bbMLP+2zqqGGEu
- TLSH T179D639BE6F64FC609880AC52D9B2CE50DD8F5C827199C430857EF9608E44ED1CDADAB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 2 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/memory/5924-0-0x0000000000400000-0x0000000000407000-memory.dmp family_cosmu behavioral2/memory/5924-26-0x0000000000400000-0x0000000000407000-memory.dmp family_cosmu - Renames multiple (219) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\be-BY\tipresx.dll.mui.tmp eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe File created C:\Program Files\7-Zip\Lang\hi.txt.tmp eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll.tmp eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ko-kr.dll.tmp eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ms-my.dll.tmp eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe File created C:\Program Files\7-Zip\7zG.exe.tmp eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe File created C:\Program Files\7-Zip\Lang\fr.txt.tmp eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe File created C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.bg-bg.dll.tmp eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.tmp eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe File created C:\Program Files\Common Files\microsoft shared\ink\af-ZA\tipresx.dll.mui.tmp eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe File created C:\Program Files\7-Zip\Lang\mng.txt.tmp eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe File created C:\Program Files\7-Zip\Uninstall.exe.tmp eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ja-jp.dll.tmp eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.it-it.dll.tmp eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ru-ru.dll.tmp eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll.tmp eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe File created C:\Program Files\7-Zip\Lang\co.txt.tmp eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe File created C:\Program Files\7-Zip\Lang\de.txt.tmp eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv.dll.tmp eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe File created C:\Program Files\7-Zip\Lang\az.txt.tmp eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe File created C:\Program Files\7-Zip\Lang\ba.txt.tmp eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe File created C:\Program Files\Common Files\microsoft shared\ink\as-IN\tipresx.dll.mui.tmp eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe File created C:\Program Files\7-Zip\Lang\eu.txt.tmp eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe File created C:\Program Files\7-Zip\Lang\mr.txt.tmp eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll.tmp eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sr-latn-rs.dll.tmp eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe File created C:\Program Files\7-Zip\7-zip32.dll.tmp eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe File created C:\Program Files\7-Zip\7z.sfx.tmp eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe File created C:\Program Files\7-Zip\History.txt.tmp eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe File created C:\Program Files\7-Zip\Lang\ku.txt.tmp eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll.tmp eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.he-il.dll.tmp eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe File created C:\Program Files\7-Zip\7-zip.dll.tmp eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe File created C:\Program Files\7-Zip\Lang\ko.txt.tmp eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe File created C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.tmp eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe File created C:\Program Files\7-Zip\Lang\ar.txt.tmp eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe File created C:\Program Files\7-Zip\Lang\bg.txt.tmp eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe File created C:\Program Files\7-Zip\Lang\br.txt.tmp eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe File created C:\Program Files\7-Zip\Lang\gl.txt.tmp eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe File created C:\Program Files\7-Zip\Lang\va.txt.tmp eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.tmp eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ro-ro.dll.tmp eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-cn.dll.tmp eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.tmp eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hi-in.dll.tmp eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll.tmp eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll.tmp eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\RepoMan.dll.tmp eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.tmp eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll.tmp eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.tmp eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll.tmp eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe File created C:\Program Files\7-Zip\Lang\he.txt.tmp eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe File created C:\Program Files\7-Zip\Lang\pt-br.txt.tmp eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe File created C:\Program Files\7-Zip\Lang\ro.txt.tmp eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.cab.cat.tmp eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\offreg.dll.tmp eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe File created C:\Program Files\7-Zip\Lang\is.txt.tmp eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.tmp eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.da-dk.dll.tmp eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe File created C:\Program Files\Common Files\microsoft shared\ink\az-Latn-AZ\tipresx.dll.mui.tmp eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe File created C:\Program Files\7-Zip\7zCon.sfx.tmp eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe"C:\Users\Admin\AppData\Local\Temp\eedd75da32ee459c0929d760fed205c1651f54af56d7399106164f6942a702c8.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5924
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1875162379-3804078649-638427191-1000\desktop.ini.tmp
- Size 12.5MB
- SHA256 3f1f542a600745805118a7e616eb10cef31582aabf08ca72daf5d63208eede7c
- MD5 f707c8fc9c14536b3ef3dbcafd530959
- SHA1 a5b2b60d1ddac9705331ac07694afe53b4fffa7f
- SHA512 30ea4b1c0ad748ea4bb972145330112d5d94da4e703cebf466083988447715e538ea3f8334749bd972d7dbdcaf103e417b2ba95b9162522225abb745e7f8b179
- SSDEEP 98304:rzqEv60gsOTGMN6bbjNCZia56g65PRdKNtMGMnRzBrpFSqLsO86msAeN75jJW5Bq:rE0XQGMN6bbMLP+2zqqGGEf
- TLSH T130D639BE6F64FC609880AC52D9B2CE50DD8F5C827199C430857EF9608E44ED1CDADAB7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 12.6MB
- SHA256 45144ba2d7a404c9ca9d2e0d039e667a7d0030af261e7cdae1ea68b34379abef
- MD5 7b8260cca33cd08e737ba06b47237de6
- SHA1 ed9440e9f321328f35836b7b01b4fb86bae5bd5a
- SHA512 95bfc9fde4ba4649bfa79444015919633b89875b306aed2b114f289d198a91658b7de8872875228aa8c440702eafb381431df1c5a513d241d9225eceb293665c
- SSDEEP 98304:rzqEv60gsOTGMN6bbjNCZia56g65PRdKNtMGMnRzBrpFSqLsO86msAeN75jJW5B4:rE0XQGMN6bbMLP+2zqqGGER
- TLSH T11ED639BE6F64FC608880AC52D9B2CE50DD8F5C827599C430857EF9608E44ED1CDADAB7
- MD5 SHA1 SHA512 SSDEEP TLSH