Overview
overview
10Static
static
10desktop.ini.exe
windows11-21h2-x64
10desktop.ini.exe
windows11-ltsc_2024-x64
10desktop.ini.exe
android-15-x64
desktop.ini.exe
macos-10.15-amd64
4desktop.ini.exe
debian-12-armhf
desktop.ini.exe
debian-12-mipsel
desktop.ini.exe
ubuntu-20.04-amd64
desktop.ini.exe
ubuntu-22.04-amd64
desktop.ini.exe
ubuntu-24.04-amd64
Analysis
- max time kernel
82s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/10/2026, 07:28
Behavioral task
behavioral1
Sample
desktop.ini.exe
Resource
win11-20260911-en
windows11-21h2-x64
5 signatures
900 seconds
Behavioral task
behavioral2
Sample
desktop.ini.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
900 seconds
Behavioral task
behavioral3
Sample
desktop.ini.exe
Resource
android-35-x64-arm64-20260325-en
android-15-x64
0 signatures
900 seconds
Behavioral task
behavioral4
Sample
desktop.ini.exe
Resource
macos-20260915-en
macos-10.15-amd64
1 signatures
900 seconds
Behavioral task
behavioral5
Sample
desktop.ini.exe
Resource
debian12-armhf-20260127-en
debian-12-armhf
0 signatures
900 seconds
Behavioral task
behavioral6
Sample
desktop.ini.exe
Resource
debian12-mipsel-20260513-en
debian-12-mipsel
0 signatures
900 seconds
Behavioral task
behavioral7
Sample
desktop.ini.exe
Resource
ubuntu2004-amd64-20260513-en
ubuntu-20.04-amd64
0 signatures
900 seconds
Behavioral task
behavioral8
Sample
desktop.ini.exe
Resource
ubuntu2204-amd64-20260513-en
ubuntu-22.04-amd64
0 signatures
900 seconds
Behavioral task
behavioral9
Sample
desktop.ini.exe
Resource
ubuntu2404-amd64-20260127-en
ubuntu-24.04-amd64
0 signatures
900 seconds
General
- Target desktop.ini.exe
- Size 6.1MB
- Sample261014-javews1vb1
- SHA256 7cab3b0225d9d5995de4bd4697d5a84f349b0481ca019ef0c369885d0bb892aa
- MD5 f5819396d22ec324c25a0df3019df94b
- SHA1 8a259a7c3a981b098a3b8757a42fd43ae4025191
- SHA512 a664b65bd9cf0902df801eb4753b20c88ab10000adc84ce5f64170b6a91f1ca6c63b6c64de8a62034fe1fd4350d7d525fecb571e24f2d9b069a62df7602d3794
- SSDEEP 98304:QdxBOwf1S4YDjvJ6fIO0XTs8HJsaBfnnsUdAngF1ritVrUurgrW9T1n5HpSmVbQW:QBOZglh8pbW9T1n5HrbjP
- TLSH T13C567C6871257CB1D3E0E861B4C1B7580B63716F7AC96B18C082B3483EBEA175DDE6B4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 4 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/memory/3508-0-0x0000000000400000-0x000000000040A000-memory.dmp family_cosmu behavioral2/files/0x0007000000016d02-2.dat family_cosmu behavioral2/files/0x00030000000003bb-5.dat family_cosmu behavioral2/memory/3508-81-0x0000000000400000-0x000000000040A000-memory.dmp family_cosmu - Renames multiple (220) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\Lang\lt.txt.tmp desktop.ini.exe File created C:\Program Files\7-Zip\Lang\nb.txt.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll.tmp desktop.ini.exe File created C:\Program Files\7-Zip\Lang\ca.txt.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClient.man.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sr-latn-rs.dll.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\SubsystemController.man.tmp desktop.ini.exe File created C:\Program Files\7-Zip\Lang\si.txt.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui.tmp desktop.ini.exe File created C:\Program Files\7-Zip\Lang\gu.txt.tmp desktop.ini.exe File created C:\Program Files\7-Zip\Lang\he.txt.tmp desktop.ini.exe File created C:\Program Files\7-Zip\Lang\lv.txt.tmp desktop.ini.exe File created C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp desktop.ini.exe File created C:\Program Files\7-Zip\Lang\uz.txt.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\rtscom.dll.mui.tmp desktop.ini.exe File created C:\Program Files\7-Zip\7-zip.chm.tmp desktop.ini.exe File created C:\Program Files\7-Zip\7z.exe.tmp desktop.ini.exe File created C:\Program Files\7-Zip\Lang\cy.txt.tmp desktop.ini.exe File created C:\Program Files\7-Zip\Lang\id.txt.tmp desktop.ini.exe File created C:\Program Files\7-Zip\Lang\mk.txt.tmp desktop.ini.exe File created C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz.dll.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.cab.cat.tmp desktop.ini.exe File created C:\Program Files\7-Zip\Lang\io.txt.tmp desktop.ini.exe File created C:\Program Files\7-Zip\Lang\pl.txt.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ink\bs-Latn-BA\tipresx.dll.mui.tmp desktop.ini.exe File created C:\Program Files\7-Zip\Lang\ja.txt.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.el-gr.dll.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities.json.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.tmp desktop.ini.exe File created C:\Program Files\7-Zip\7z.sfx.tmp desktop.ini.exe File created C:\Program Files\7-Zip\Lang\gl.txt.tmp desktop.ini.exe File created C:\Program Files\7-Zip\Lang\hy.txt.tmp desktop.ini.exe File created C:\Program Files\7-Zip\readme.txt.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.tmp desktop.ini.exe File created C:\Program Files\7-Zip\Lang\pt-br.txt.tmp desktop.ini.exe File created C:\Program Files\7-Zip\Lang\bn.txt.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msix.dll.tmp desktop.ini.exe File created C:\Program Files\7-Zip\7-zip.dll.tmp desktop.ini.exe File created C:\Program Files\7-Zip\Lang\ar.txt.tmp desktop.ini.exe File created C:\Program Files\7-Zip\Lang\ps.txt.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.tmp desktop.ini.exe File created C:\Program Files\7-Zip\Lang\el.txt.tmp desktop.ini.exe File created C:\Program Files\7-Zip\Lang\hr.txt.tmp desktop.ini.exe File created C:\Program Files\7-Zip\Lang\sa.txt.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\offreg.dll.tmp desktop.ini.exe File created C:\Program Files\7-Zip\Uninstall.exe.tmp desktop.ini.exe File created C:\Program Files\7-Zip\Lang\co.txt.tmp desktop.ini.exe File created C:\Program Files\7-Zip\Lang\da.txt.tmp desktop.ini.exe File created C:\Program Files\7-Zip\Lang\tt.txt.tmp desktop.ini.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll.tmp desktop.ini.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language desktop.ini.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-4280978039-528710165-233981602-1000\desktop.ini.tmp
- Size 6.1MB
- SHA256 6984f21b7ce63b8c1da6f45ee595d694d387d4f248fda0d003b48ae290fa6f48
- MD5 077a60b7cdc79f16378629bfae053958
- SHA1 b40787ea31078ec274ec16d9be886a967a59b761
- SHA512 cd60438a39728d8fd029743640494222d6de94066b48b44cbcafccb6741434be2ea1f4fc5ecd5590802ac4db9ff3d48c69a7d786002f2a531065df9337f96c87
- SSDEEP 98304:QdxBOwf1S4YDjvJ6fIO0XTs8HJsaBfnnsUdAngF1ritVrUurgrW9T1n5HpSmVbQT:QBOZglh8pbW9T1n5Hrbjm
- TLSH T193567C6871257CB1D3E0E861B4C1B7580B63716F7AC96B18C082B3483EBEA175DDE6B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.chm.tmp
- Size 6.2MB
- SHA256 b5d9c8daf6624ddb5bb54e8cbb8a06a571d0e79f04c67fbc48027b861ba6a529
- MD5 12999584ad325c448b50e95a008a9c68
- SHA1 cd92d6108be79aaa9efce9d30d6e24df8d9dce0c
- SHA512 f29860fb973ce7d48d11ec620a2a104de938700d9c2eaad2fed0a7109119cf30f114bf2dbcacb4d588ae1eb2360c6a7713b00678646fa4b37931ab116ba741b5
- SSDEEP 98304:QdxBOwf1S4YDjvJ6fIO0XTs8HJsaBfnnsUdAngF1ritVrUurgrW9T1n5HpSmVbQ5:QBOZglh8pbW9T1n5Hrbjtm
- TLSH T116667C6871257CB1D3E0E871B4C1B7580B63716F7AC96B18C082B3483EBEA175DDE6A4
- MD5 SHA1 SHA512 SSDEEP TLSH