Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/10/2026, 22:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_Trojan.Win32.Cosmu.dnej.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_Trojan.Win32.Cosmu.dnej.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target jaffacakes118_Trojan.Win32.Cosmu.dnej.exe
- Size 314KB
- Sample261018-2ms2psbv7t
- SHA256 4bbba51eb04c3168213245defd0ab98041a658e236bb9d07834761792d5c897d
- MD5 6563c2fbe4a85561115bd0c02a3ecab8
- SHA1 8499bed5f7292bd1923a80a462ffeba1dc823f0a
- SHA512 b983468514f5f6ea25ba541f5ec85b5ee0e0d8c5344d55648e6c9bb5165e99d864509e22ca42ace85af578d1a16e15986ed00cda565c65fc49f29af13941f67b
- SSDEEP 3072:SPP3tGXRvjxCb5NgXDY7uSlkJcUa7kYQTcqW2NdQQGH/UDhSCUc4aqTBrgmQ+:+IlKgzelZNQSBQGH/CSpWqTKmQ
- TLSH T1CF64F14179B2C4B3D44286764CAACB61B737AD139A60C143BBAD0F8B5F712D49F2B349
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened (read-only) \??\H: jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened (read-only) \??\J: jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened (read-only) \??\K: jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened (read-only) \??\D: jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened (read-only) \??\I: jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened (read-only) \??\L: jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened (read-only) \??\M: jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened (read-only) \??\N: jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened (read-only) \??\O: jaffacakes118_Trojan.Win32.Cosmu.dnej.exe - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Control Panel\Desktop\Wallpaper = "C:\\windows\\WallPapers.jpg" jaffacakes118_Trojan.Win32.Cosmu.dnej.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\RCX32C0.tmp jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX337B.tmp jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.cab jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX34C4.tmp jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.cab jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX3358.tmp jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX34A2.tmp jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\7-Zip\RCX311D.tmp jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\7-Zip\RCX30EA.tmp jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX313E.tmp jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.cab jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX3369.tmp jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX339D.tmp jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.cab jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.cab jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX3568.tmp jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.cab jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\dotnet\RCX31A0.tmp jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX32AE.tmp jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX341E.tmp jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX344F.tmp jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File created C:\Program Files\7-Zip\7z.cab jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\7-Zip\RCX310D.tmp jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX338B.tmp jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\dotnet\dotnet.exe jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.cab jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX3518.tmp jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\7-Zip\7z.cab jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX3170.tmp jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.cab jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File created C:\Program Files\Mozilla Firefox\crashreporter.cab jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX3305.tmp jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File created C:\Program Files\Internet Explorer\ExtExport.exe jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File created C:\Program Files\Internet Explorer\ielowutil.cab jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File created C:\Program Files\Internet Explorer\ielowutil.exe jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX3480.tmp jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.cab jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX3491.tmp jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.cab jaffacakes118_Trojan.Win32.Cosmu.dnej.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\windows\readme.1xt jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File created C:\windows\WallPapers.jpg jaffacakes118_Trojan.Win32.Cosmu.dnej.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_Trojan.Win32.Cosmu.dnej.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\Desktop\General jaffacakes118_Trojan.Win32.Cosmu.dnej.exe Set value (str) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\Desktop\General\WallpaperSource = "C:\\windows\\WallPapers.jpg" jaffacakes118_Trojan.Win32.Cosmu.dnej.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Cosmu.dnej.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Cosmu.dnej.exe"1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:3640
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 249KB
- SHA256 ae99bb58e694fddee7c8c55c031354cb9bb3c1a2ac55c4567b85606f4d948103
- MD5 423dfab346b2e5f6b7240b84f10a8bd8
- SHA1 4c08bbf7133645d52ff122ee0857aaf3bc373ac1
- SHA512 cc1c48655c038031ee7584c35fd581720d796225ebbb88c6e96808a9f0177740ef60e37f935cab716b30081fc97d81bc7d1e663c76beb34ffc8332efede7b36b
- SSDEEP 3072:7PP3tGXRvjxCb5NgXDY7uSlkJcUa7kYQTcqW2NdQQGH/UDhSCUc4aqTB:bIlKgzelZNQSBQGH/CSpWqT
- TLSH T16244F1453C93C4B3E4414D358AD58AD18BBF5D0376E2E15FFF990A4B4EB029C4AAB2B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 1.5MB
- SHA256 5a034168f5a208fd641391752230fe466d0327c8c259642f4f7375bca5978adb
- MD5 1fd34219dd68624da0db4aba7200a7d3
- SHA1 aaad7a4b9e002085b46bc4925bad6d39764bb214
- SHA512 36dabb4c2437c5c234743d8f399a50974db9512c17626954e48f46ef4d2d66533993698ed7e4e1f1e17e8a97b086be88483751f93998e3439995857dcd90de24
- SSDEEP 3072:TPP3tGXRvjxCb5NgXDY7uSlkJcUa7kYQTcqW2NdQQGH/UDhSCUc4aqTB:jIlKgzelZNQSBQGH/CSpWqT
- TLSH T13465F1453C93C4B3D445493689E68BD18B7F5D037AE2E11BFF990E4B5EB02C84BA72A1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\RCX32D0.tmp
- Size 212KB
- SHA256 80dc2f24a6205e128b1bdaa5c14d710dfe44c0ccba1edfc34e839919eb09dc83
- MD5 5cc45ef39d8d00fa5e1576b1d4cc90ac
- SHA1 ade8f9ddcd0dd70b506b39a2b6a5853ec2aa0f6d
- SHA512 0906dcbcf895618cf46dce5cfcf7ad0debe6e3f2eb4f9543e47e407cfaa26e81adbccdcdccd623242c7e3ab78e2db7bbb391bc8f7dc3331d79b40735d334f655
- SSDEEP 3072:PPP3tGXRvjxCb5NgXDY7uSlkJcUa7kYQTcqW2NdQQGH/UDhSCUc4aqTBd:HIlKgzelZNQSBQGH/CSpWqTP
- TLSH T1E224F1453C93C4B3E4414D3589D58BD18BBF5D037AE2E15FFF990A4B5EB028C4AAB2A1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome.exe
- Size 260KB
- SHA256 2fc396bbdbaf73c8aeb8b8d26f05ce5f3fab3d1f84c8864b55ed1d775cf6ee69
- MD5 95518690541b2ab28f7640d619fb1fa0
- SHA1 964d10f2e087f71c60f6707f71985ad3bcd0510c
- SHA512 5562560d48dbdcd379c2fb5ca8484deebc0892739839e1283645cd7a98a2f5329d299ff8a43f19ee45f671ea2c3be4c8132459237f2cb34188d73b12055ca89e
- SSDEEP 3072:pPP3tGXRvjxCb5NgXDY7uSlkJcUa7kYQTcqW2NdQQGH/UDhSCUc4aqTB7aUkLKUZ:VIlKgzelZNQSBQGH/CSpWqTtaXKv7C
- TLSH T12244F1257993D773D140C83199A687C0C77F7C07A6A29023FBA83A879FB52DC5B67281
- MD5 SHA1 SHA512 SSDEEP TLSH