Overview
overview
10Static
static
10desktop.ini.exe
windows11-21h2-x64
10desktop.ini.exe
windows11-ltsc_2024-x64
10desktop.ini.exe
android-15-x64
desktop.ini.exe
macos-10.15-amd64
4desktop.ini.exe
debian-12-armhf
desktop.ini.exe
debian-12-mipsel
desktop.ini.exe
ubuntu-20.04-amd64
desktop.ini.exe
ubuntu-22.04-amd64
desktop.ini.exe
ubuntu-24.04-amd64
Analysis
- user interaction
yes - max time kernel
74s - max time network
33s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
14/10/2026, 07:28
Behavioral task
behavioral1
Sample
desktop.ini.exe
Resource
win11-20260911-en
windows11-21h2-x64
5 signatures
900 seconds
Behavioral task
behavioral2
Sample
desktop.ini.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
900 seconds
Behavioral task
behavioral3
Sample
desktop.ini.exe
Resource
android-35-x64-arm64-20260325-en
android-15-x64
0 signatures
900 seconds
Behavioral task
behavioral4
Sample
desktop.ini.exe
Resource
macos-20260915-en
macos-10.15-amd64
1 signatures
900 seconds
Behavioral task
behavioral5
Sample
desktop.ini.exe
Resource
debian12-armhf-20260127-en
debian-12-armhf
0 signatures
900 seconds
Behavioral task
behavioral6
Sample
desktop.ini.exe
Resource
debian12-mipsel-20260513-en
debian-12-mipsel
0 signatures
900 seconds
Behavioral task
behavioral7
Sample
desktop.ini.exe
Resource
ubuntu2004-amd64-20260513-en
ubuntu-20.04-amd64
0 signatures
900 seconds
Behavioral task
behavioral8
Sample
desktop.ini.exe
Resource
ubuntu2204-amd64-20260513-en
ubuntu-22.04-amd64
0 signatures
900 seconds
Behavioral task
behavioral9
Sample
desktop.ini.exe
Resource
ubuntu2404-amd64-20260127-en
ubuntu-24.04-amd64
0 signatures
900 seconds
General
- Target desktop.ini.exe
- Size 6.1MB
- Sample261014-javews1vb1
- SHA256 7cab3b0225d9d5995de4bd4697d5a84f349b0481ca019ef0c369885d0bb892aa
- MD5 f5819396d22ec324c25a0df3019df94b
- SHA1 8a259a7c3a981b098a3b8757a42fd43ae4025191
- SHA512 a664b65bd9cf0902df801eb4753b20c88ab10000adc84ce5f64170b6a91f1ca6c63b6c64de8a62034fe1fd4350d7d525fecb571e24f2d9b069a62df7602d3794
- SSDEEP 98304:QdxBOwf1S4YDjvJ6fIO0XTs8HJsaBfnnsUdAngF1ritVrUurgrW9T1n5HpSmVbQW:QBOZglh8pbW9T1n5HrbjP
- TLSH T13C567C6871257CB1D3E0E861B4C1B7580B63716F7AC96B18C082B3483EBEA175DDE6B4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral1/memory/4336-0-0x0000000000400000-0x000000000040A000-memory.dmp family_cosmu behavioral1/files/0x000700000000d3f8-2.dat family_cosmu behavioral1/files/0x0002000000025b65-5.dat family_cosmu behavioral1/memory/4336-141-0x0000000000400000-0x000000000040A000-memory.dmp family_cosmu - Renames multiple (220) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\Lang\lv.txt.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ru-ru.dll.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\rtscom.dll.mui.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipssrl.xml.tmp desktop.ini.exe File created C:\Program Files\7-Zip\7z.dll.tmp desktop.ini.exe File created C:\Program Files\7-Zip\7z.sfx.tmp desktop.ini.exe File created C:\Program Files\7-Zip\Lang\sk.txt.tmp desktop.ini.exe File created C:\Program Files\7-Zip\Lang\th.txt.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\ShapeCollector.exe.mui.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrenUSlm.dat.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsar.xml.tmp desktop.ini.exe File created C:\Program Files\7-Zip\Lang\es.txt.tmp desktop.ini.exe File created C:\Program Files\7-Zip\Lang\id.txt.tmp desktop.ini.exe File created C:\Program Files\7-Zip\Lang\sl.txt.tmp desktop.ini.exe File created C:\Program Files\7-Zip\readme.txt.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\tabskb.dll.mui.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipRes.dll.mui.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml.tmp desktop.ini.exe File created C:\Program Files\7-Zip\Lang\nn.txt.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml.tmp desktop.ini.exe File created C:\Program Files\7-Zip\Lang\sq.txt.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.cab.cat.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsrom.xml.tmp desktop.ini.exe File created C:\Program Files\7-Zip\Lang\ca.txt.tmp desktop.ini.exe File created C:\Program Files\7-Zip\Lang\hi.txt.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.es-es.dll.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.it-it.dll.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\InputPersonalization.exe.mui.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\mshwLatin.dll.mui.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\rtscom.dll.mui.tmp desktop.ini.exe File created C:\Program Files\7-Zip\Lang\is.txt.tmp desktop.ini.exe File created C:\Program Files\7-Zip\Lang\lij.txt.tmp desktop.ini.exe File created C:\Program Files\7-Zip\Lang\nl.txt.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipTsf.dll.mui.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml.tmp desktop.ini.exe File created C:\Program Files\7-Zip\Lang\ja.txt.tmp desktop.ini.exe File created C:\Program Files\7-Zip\Lang\ro.txt.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv.dll.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui.tmp desktop.ini.exe File created C:\Program Files\7-Zip\7zG.exe.tmp desktop.ini.exe File created C:\Program Files\7-Zip\Lang\fur.txt.tmp desktop.ini.exe File created C:\Program Files\7-Zip\Lang\tt.txt.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ar-sa.dll.tmp desktop.ini.exe File created C:\Program Files\7-Zip\Lang\bn.txt.tmp desktop.ini.exe File created C:\Program Files\7-Zip\Lang\da.txt.tmp desktop.ini.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language desktop.ini.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-4077919521-2131189092-3796306753-1000\desktop.ini.tmp
- Size 6.1MB
- SHA256 5e718136945d539cb449459d60ed4313159d14279e818cf376e80798eae358d9
- MD5 075f55d33f885ce91c759dcfd9ae155c
- SHA1 5e23f11cbfd0e5e8a7f6f66504ae5a6b1aad3165
- SHA512 7f35a293bff04d706e65b3d0f803f17b0ab2dcfdecf4f149b15d19d594816b7813c981f5435220789651393499b8a906a7e3fe3f630b6f4426d156d051d5beb2
- SSDEEP 98304:QdxBOwf1S4YDjvJ6fIO0XTs8HJsaBfnnsUdAngF1ritVrUurgrW9T1n5HpSmVbQ4:QBOZglh8pbW9T1n5Hrbjx
- TLSH T179567C6871257CB1D3E0E861B4C1B7580B63716F7AC96B18C082B3483EBEA175DDE6B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.chm.tmp
- Size 6.2MB
- SHA256 8daa77af9ffef5d30c43618b1223b19eb217977cc24e360a72a3e1742b096fa2
- MD5 450cf4b813d04bd08ff68cc0aea330c1
- SHA1 aaf893c86e413c6c7d0399f6ec85e76603c2dcc6
- SHA512 cf7f5603c9a20d0e72aca2096a7629441a984f8c1fdd5ac91f78911bdc7ebd0c10e22a5471e68dc1a175dcce853581d7fc06e5c4c20fc9da21dbf4458c56bdbc
- SSDEEP 98304:QdxBOwf1S4YDjvJ6fIO0XTs8HJsaBfnnsUdAngF1ritVrUurgrW9T1n5HpSmVbQe:QBOZglh8pbW9T1n5Hrbjom
- TLSH T100667C6871257CB1D3E0E871B4C1B7580B63716F7AC96B18C082B3483EBEA175DDE6A4
- MD5 SHA1 SHA512 SSDEEP TLSH