Analysis
- max time kernel
150s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
16/09/2026, 21:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe
- Size 4.6MB
- Sample260916-zzqe8sec62
- SHA256 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462
- MD5 588a82c96fa9caee198589aa8df98517
- SHA1 3d44179176133f7f5d79a8e4ca23e32218b3fccb
- SHA512 733ef0dc43360a1a934cff0c23d1a74b35e698cb24f2aab1684e9a2e2b46c88234ac97d177803174efd0ce6293da71381145318430df61a5d28444bdff560890
- SSDEEP 49152:RVvn8Q5CHCtE4jPTTm4uBLq9gtMyMpy7nEvV47RIg8Ott9TIPjEzPkv2:RF8QUitE4iLqaPWGnEvK7RkOr
- TLSH T13C268DAFD4013955C019F8B5AFA97B5C2721BDE7E86A3DC09720FC39E8A73A74A1D401
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 3 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral1/memory/5108-13-0x0000000000400000-0x0000000000616000-memory.dmp family_cosmu behavioral1/memory/5108-14-0x0000000000400000-0x0000000000616000-memory.dmp family_cosmu behavioral1/memory/5108-69-0x0000000000400000-0x0000000000616000-memory.dmp family_cosmu - Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe - Renames multiple (472) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tipresx.dll.mui.tmp 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe File created C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe.tmp 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tabskb.dll.mui.tmp 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe File created C:\Program Files\Common Files\microsoft shared\ink\tabskb.dll.tmp 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.DriveInfo.dll.tmp 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe File created C:\Program Files\7-Zip\Lang\tg.txt.tmp 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll.tmp 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fr-fr.dll.tmp 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.tmp 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\ShapeCollector.exe.mui.tmp 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui.tmp 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msaddsr.dll.mui.tmp 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe File created C:\Program Files\7-Zip\Lang\kaa.txt.tmp 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll.tmp 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe File created C:\Program Files\Common Files\microsoft shared\ink\dicjp.dll.tmp 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml.tmp 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.dll.tmp 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe File created C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe File created C:\Program Files\ClearResolve.pdf.tmp 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.tmp 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-MX\tipresx.dll.mui.tmp 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe File created C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui.tmp 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lt-lt.dll.tmp 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msix.dll.tmp 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\mshwLatin.dll.mui.tmp 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe File created C:\Program Files\Common Files\System\ado\adovbs.inc.tmp 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe File created C:\Program Files\Common Files\System\Ole DB\msdatl3.dll.tmp 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe File created C:\Program Files\Common Files\System\Ole DB\msxactps.dll.tmp 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-libraryloader-l1-1-0.dll.tmp 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-process-l1-1-0.dll.tmp 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe File created C:\Program Files\7-Zip\Lang\nb.txt.tmp 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipTsf.dll.mui.tmp 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe File created C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui.tmp 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe File created C:\Program Files\Common Files\microsoft shared\ink\sl-SI\tipresx.dll.mui.tmp 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe File created C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.tmp 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Specialized.dll.tmp 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe File created C:\Program Files\chrome_installer.log.tmp 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml.tmp 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml.tmp 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui.tmp 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-conio-l1-1-0.dll.tmp 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-time-l1-1-0.dll.tmp 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.Brotli.dll.tmp 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.dll.tmp 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.tmp 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml.tmp 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml.tmp 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat.tmp 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml.tmp 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui.tmp 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe File created C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc.tmp 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l1-1-0.dll.tmp 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe File created C:\Program Files\7-Zip\Lang\be.txt.tmp 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe File created C:\Program Files\7-Zip\Lang\nl.txt.tmp 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ko-kr.dll.tmp 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat.tmp 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe File created C:\Program Files\Common Files\System\ado\msado60.tlb.tmp 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msadcor.dll.mui.tmp 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.dll.tmp 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InkObj.dll.mui.tmp 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msadcor.dll.mui.tmp 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.dll.tmp 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml.tmp 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-util-l1-1-0.dll.tmp 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe - Modifies registry class 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InProcServer32\ = "%SystemRoot%\\SysWow64\\windowscodecs.dll" 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InProcServer32\ThreadingModel = "Both" 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2} 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\Containers 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InProcServer32 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 5108 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe Token: SeIncBasePriorityPrivilege 5108 1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe"C:\Users\Admin\AppData\Local\Temp\1c39d7902536565e80e5263f3fb764d6b54273411177e3c5ffc43ba26018f462.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5108
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2091445952-3649787497-104050984-1000\desktop.ini.tmp
- Size 4.8MB
- SHA256 38fc088c99bc1d9489ab84b60406d713c0267b639d1a2ad94aeceb2e6c9756e1
- MD5 45d5cdaf729596491df0b7d37343acfb
- SHA1 0ea3349a64cc0f2aed2750ed03b3a7df6aa3c932
- SHA512 f459d06a64def7b9d7fb1799d341681854d05861f367615bd341bb42bfaf0d28a28894bf5b2f12c838ea4a724eb1575ca8ed31863c21de0744cdfae81eebaa40
- SSDEEP 49152:RVvn8Q5CHCtE4jPTTm4uBLq9gtMyMpy7nEvV47RIg8Ott9TIPjEzPkvDw:RF8QUitE4iLqaPWGnEvK7RkO3
- TLSH T188368EAFD4013955C019F8B5AFA97B5C2721BDE7E86A3DC09720FC39E8A73A74A1D401
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 4.9MB
- SHA256 15379e0eccd63a35c9171b6741a866b8b4f29ab26fa40b4fe31c4a03ad2ac2e7
- MD5 ae43b06cdd6baeb9a62553200ddb90df
- SHA1 34228f814a49e3d2b0108997765d67e91ac5342e
- SHA512 bc8da027e71c9367cf890f78d54fd665390903031c0ded740097e37e1609f8ae05a67798e0c45a31ffc709eb337cd6f63441967fd9c4786739a8201fd94d8f02
- SSDEEP 49152:RVvn8Q5CHCtE4jPTTm4uBLq9gtMyMpy7nEvV47RIg8Ott9TIPjEzPkvDu:RF8QUitE4iLqaPWGnEvK7RkOx
- TLSH T15F368DAFD4013951C219F8B5AFA97B5C2721BDE7E8663DD08720FC39E8A67B74A1C401
- MD5 SHA1 SHA512 SSDEEP TLSH