Analysis
- max time kernel
149s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
25/08/2026, 10:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe
- Size 9.6MB
- Sample260825-mstsvshk21
- SHA256 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24
- MD5 2ce57c45f6c2dd4777b312216b731e3a
- SHA1 09531122b5871ef312e7bb8c1fe9a1c3166e6b7f
- SHA512 25b264246bab53d8d03ffaa3b3b6091793ea7e5d83ff4f5df316a77f74b607afa301c27bc6fb9f40bcee45f6982a8e8fbf4b7775185d985d88321015e947b0d6
- SSDEEP 196608:B49HITN8Pmfa+GT0VilwA2EBNnZfM17Ma5geTwi0lL:BYHITN8PmfjGH
- TLSH T1C3A6E41BEBE2B8F0E653A811218D766816DA38D9FDCD761F0262B1C66C75E020CFCD65
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 1 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral1/memory/4300-63-0x0000000000400000-0x0000000000408000-memory.dmp family_cosmu - Renames multiple (248) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipRes.dll.mui.tmp 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe File created C:\Program Files\Common Files\microsoft shared\ink\nl-NL\tipresx.dll.mui.tmp 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe File created C:\Program Files\7-Zip\Lang\fa.txt.tmp 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.tmp 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml.tmp 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\ShapeCollector.exe.mui.tmp 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe File created C:\Program Files\Common Files\System\ado\adojavas.inc.tmp 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll.tmp 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.tmp 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.tmp 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml.tmp 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml.tmp 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\ShapeCollector.exe.mui.tmp 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOLoaderUI.dll.tmp 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe File created C:\Program Files\7-Zip\7zG.exe.tmp 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\mshwLatin.dll.mui.tmp 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml.tmp 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipshrv.xml.tmp 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe File created C:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui.tmp 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe File created C:\Program Files\Common Files\microsoft shared\ink\sk-SK\tipresx.dll.mui.tmp 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe File created C:\Program Files\Common Files\System\ado\msadox.dll.tmp 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe File created C:\Program Files\7-Zip\descript.ion.tmp 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe File created C:\Program Files\7-Zip\Lang\et.txt.tmp 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe File created C:\Program Files\7-Zip\Lang\hy.txt.tmp 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe File created C:\Program Files\7-Zip\Lang\si.txt.tmp 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsrom.xml.tmp 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\msinfo32.exe.mui.tmp 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.tmp 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml.tmp 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe File created C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui.tmp 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui.tmp 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwritash.dat.tmp 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe File created C:\Program Files\Common Files\microsoft shared\ink\IpsMigrationPlugin.dll.tmp 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsptg.xml.tmp 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.cab.cat.tmp 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-MX\tipresx.dll.mui.tmp 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe File created C:\Program Files\Common Files\microsoft shared\ink\rtscom.dll.tmp 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe File created C:\Program Files\7-Zip\Lang\nb.txt.tmp 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll.tmp 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll.tmp 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml.tmp 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrespsh.dat.tmp 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe File created C:\Program Files\Common Files\System\ado\msadrh15.dll.tmp 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe File created C:\Program Files\7-Zip\Lang\pa-in.txt.tmp 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe File created C:\Program Files\7-Zip\Lang\pt-br.txt.tmp 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.tmp 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml.tmp 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml.tmp 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe File created C:\Program Files\7-Zip\Lang\af.txt.tmp 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml.tmp 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOLoader.dll.tmp 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe File created C:\Program Files\7-Zip\Lang\it.txt.tmp 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\SubsystemController.man.tmp 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml.tmp 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrdeulm.dat.tmp 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tabskb.dll.mui.tmp 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe File created C:\Program Files\7-Zip\Lang\kaa.txt.tmp 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe File created C:\Program Files\7-Zip\Lang\ug.txt.tmp 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll.tmp 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipTsf.dll.mui.tmp 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\tabskb.dll.mui.tmp 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml.tmp 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe File created C:\Program Files\Common Files\System\ado\msado15.dll.tmp 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrfralm.dat.tmp 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe"C:\Users\Admin\AppData\Local\Temp\19f5778d30de61afffdcec5ee698bb75210f0a05a15bce864a5b2631cfa8ce24.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4300
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-204488895-2999877624-296153668-1000\desktop.ini.tmp
- Size 9.6MB
- SHA256 640d196fafbed29a6d1455fdaf9bd0651c84ef92aa174be440a58a0d71f6f643
- MD5 a999b899ece8770f9637f80a829b93dc
- SHA1 c86f8460943ead65c41a0624281fe31d37670716
- SHA512 2cdf0f7ef6e8c97e4f3fcd643d3367f008b1be01728c0ca8985bdb4939a69854212baca98ffa5c7eaa0660fa46887646c6183da0195fafe1ab37a6281683fdca
- SSDEEP 196608:B49HITN8Pmfa+GT0VilwA2EBNnZfM17Ma5geTwi0lR:BYHITN8PmfjGd
- TLSH T129A6E41BEBE2B8F0E653A811218D766816DA38D9FDCD761F0262B1C66C75E020CFCD65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 9.6MB
- SHA256 939f2f29007c19a7c94619e62261210d58ab0a8104b129202c252987117204dd
- MD5 db02de70358fe2e5683685f3f2bb8a00
- SHA1 59f2e8ae7e4609a54a105cdd1fc95e3b5a2aa6e2
- SHA512 fd36489b5318c17614f59d913a8095dcde62d3a09143e477b44d61d6ddf07c241eeca9531fb80f2bc03e87ba223837372383a62ffce45b3d67e3cb0a63c4dcd6
- SSDEEP 196608:B49HITN8Pmfa+GT0VilwA2EBNnZfM17Ma5geTwi0lK:BYHITN8PmfjG2
- TLSH T1E0A6E51BEBE2B8F0E653A811218D766816DA38D9FDCD761F0262B1C66C75E020CFCD65
- MD5 SHA1 SHA512 SSDEEP TLSH