Analysis
- max time kernel
148s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/10/2026, 22:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_Trojan.Win32.Cosmu.dnej.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_Trojan.Win32.Cosmu.dnej.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target jaffacakes118_Trojan.Win32.Cosmu.dnej.exe
- Size 267KB
- Sample261018-2mxpwsch76
- SHA256 0622f0b44017602a4b64e56df0dd5d94cfdaa646f1be272194fffb36b590b760
- MD5 8fceddb73a6a4ad6d70afb6d6dcfb771
- SHA1 4f4fa6490e4e301a977f37b097732ab1cbf537c4
- SHA512 6b2d21c0eb7684d00a3d317d4aeba13f9db5f986d21420aab8970b08caf39fe809162041daf5395a2a711467ae2e8fe7f9b13ccf353b6f6231955d8e3c45948b
- SSDEEP 3072:/PP3tGXRvjxCb5NgXDY7uSlkJcUa7kYQTcqW2NdQQGH/UDhSCUc4aqTBrgmQ+:3IlKgzelZNQSBQGH/CSpWqTKmQ
- TLSH T15C44F14179B2C4B3D44286764CAACB61B737AD039A60C143BBAD0F8B5F712D49B2B349
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened (read-only) \??\N: jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened (read-only) \??\G: jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened (read-only) \??\I: jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened (read-only) \??\J: jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened (read-only) \??\L: jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened (read-only) \??\O: jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened (read-only) \??\D: jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened (read-only) \??\H: jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened (read-only) \??\K: jaffacakes118_Trojan.Win32.Cosmu.dnej.exe - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Control Panel\Desktop\Wallpaper = "C:\\windows\\WallPapers.jpg" jaffacakes118_Trojan.Win32.Cosmu.dnej.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.cab jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX6DF8.tmp jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX6DF9.tmp jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.cab jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.cab jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File created C:\Program Files\7-Zip\7z.cab jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX6E3B.tmp jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File created C:\Program Files\7-Zip\7zFM.cab jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX6DE6.tmp jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File created C:\Program Files\Internet Explorer\ielowutil.exe jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File created C:\Program Files\dotnet\dotnet.exe jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX6DB2.tmp jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.cab jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\dotnet\dotnet.cab jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\7-Zip\7z.exe jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.cab jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File created C:\Program Files\Internet Explorer\ieinstal.exe jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File created C:\Program Files\7-Zip\7z.exe jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File created C:\Program Files\Internet Explorer\ExtExport.cab jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX6F57.tmp jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\7-Zip\RCX6C78.tmp jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\7-Zip\RCX6C89.tmp jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX6DE7.tmp jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.cab jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX7025.tmp jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.cab jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX6DF7.tmp jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.cab jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\Mozilla Firefox\RCX7015.tmp jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File created C:\Program Files\Internet Explorer\iediagcmd.cab jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.cab jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCX7067.tmp jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX6C9D.tmp jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\dotnet\dotnet.exe jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCX6D02.tmp jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX6DA0.tmp jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX6DB1.tmp jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX6E7D.tmp jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX6E9F.tmp jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX6EA0.tmp jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.cab jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX6F03.tmp jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\RCX6F04.tmp jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File created C:\Program Files\Mozilla Firefox\crashreporter.cab jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\7-Zip\7zFM.cab jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX6C9C.tmp jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.cab jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.cab jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe jaffacakes118_Trojan.Win32.Cosmu.dnej.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\windows\readme.1xt jaffacakes118_Trojan.Win32.Cosmu.dnej.exe File created C:\windows\WallPapers.jpg jaffacakes118_Trojan.Win32.Cosmu.dnej.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_Trojan.Win32.Cosmu.dnej.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Desktop\General jaffacakes118_Trojan.Win32.Cosmu.dnej.exe Set value (str) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Desktop\General\WallpaperSource = "C:\\windows\\WallPapers.jpg" jaffacakes118_Trojan.Win32.Cosmu.dnej.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Cosmu.dnej.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Cosmu.dnej.exe"1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:2948
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 249KB
- SHA256 897ba37b90c92f1b7fe0fb81c94f5b14cc25840540a93b77dadc3c91abbf1943
- MD5 aa77be17d2d7c02d884f5299fa7b4cc3
- SHA1 bca892e5846f50615dd3c69759f41795fe67bf8c
- SHA512 eece3cee265e17c8ceea3139916e8fe97e1ec4c33914db12775d606d659aefd863db0e45f5b5ed2a67c663b7bc4af7231dd5b69b476c502618d94a5668b43f0b
- SSDEEP 3072:7PP3tGXRvjxCb5NgXDY7uSlkJcUa7kYQTcqW2NdQQGH/UDhSCUc4aqTB:bIlKgzelZNQSBQGH/CSpWqT
- TLSH T14844E1453C93C4B3E4414D358AD58AD18BBF5D037AE2E15FFF990A4B4EB029C4AA72B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX6EC2.tmp
- Size 212KB
- SHA256 4f6bca6744cd3bf5b5c37f9ad8b5d987fba42e3d99a1f5cf177dd3cfcebc20cb
- MD5 0509f0f9e4b345e5a13d28f98409b2c3
- SHA1 96875693bfc34c46ecfab3a2c06076ad8cad3761
- SHA512 e38b9dd7a6987ac507f54854fbb870d6163910d38d62a4cfa8eeb30f980d964fa0bd7eeef7090b776021ae2487c8782484c4c9861097aff27aa000823a2875e5
- SSDEEP 3072:TPP3tGXRvjxCb5NgXDY7uSlkJcUa7kYQTcqW2NdQQGH/UDhSCUc4aqTBa:jIlKgzelZNQSBQGH/CSpWqTU
- TLSH T1E724F1453C93C4B3D445493689E68BD18B7F5D037AE2E11BFF990E4B5EB02C84BA72A1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX6ED2.tmp
- Size 212KB
- SHA256 8fa88cdc0b1cbd03ee1708c5eeb49df054ff44a1515bfb2686ed30fc14e13971
- MD5 358bbccda47cbeac45ccc6ab65fa2793
- SHA1 af0be551c82ed8c723fd84ea157593a81f273293
- SHA512 86bb4bf1c8185e6b33e6bd8b5230f3920741257092b8a975172bc842e7912e8657f3bde278401d4c221c2787626299e52964633459a0d41987cecba892e1cbc8
- SSDEEP 3072:zPP3tGXRvjxCb5NgXDY7uSlkJcUa7kYQTcqW2NdQQGH/UDhSCUc4aqTBA:DIlKgzelZNQSBQGH/CSpWqTm
- TLSH T1DC24F1553D93C4B3E441493589E58BD18B7F6D03BAA2E11BFF990E4B4EB02C84BA7361
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\RCX6DB2.tmp
- Size 212KB
- SHA256 80dc2f24a6205e128b1bdaa5c14d710dfe44c0ccba1edfc34e839919eb09dc83
- MD5 5cc45ef39d8d00fa5e1576b1d4cc90ac
- SHA1 ade8f9ddcd0dd70b506b39a2b6a5853ec2aa0f6d
- SHA512 0906dcbcf895618cf46dce5cfcf7ad0debe6e3f2eb4f9543e47e407cfaa26e81adbccdcdccd623242c7e3ab78e2db7bbb391bc8f7dc3331d79b40735d334f655
- SSDEEP 3072:PPP3tGXRvjxCb5NgXDY7uSlkJcUa7kYQTcqW2NdQQGH/UDhSCUc4aqTBd:HIlKgzelZNQSBQGH/CSpWqTP
- TLSH T1E224F1453C93C4B3E4414D3589D58BD18BBF5D037AE2E15FFF990A4B5EB028C4AAB2A1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome.exe
- Size 1.5MB
- SHA256 eb1fa4422fd102f50203a7b36d625ffb37d94bc5659c1cffc91e180fda99c2e5
- MD5 d0ffe6be30c40ae14f7aa3fe68a1a7cf
- SHA1 6784c1c68d5fd3cb1f5f2d2b2cfba5383982f1e4
- SHA512 4ff599efcff7458b4b5b367c1cc5cb9e17203b87002b357434359b72ee9bd66513d56c07927815da0400553937bb3b8d770b17678ad71a93212acd10df03e112
- SSDEEP 3072:/PP3tGXRvjxCb5NgXDY7uSlkJcUa7kYQTcqW2NdQQGH/UDhSCUc4aqTBrVBI:3IlKgzelZNQSBQGH/CSpWqT
- TLSH T1FC65AE42B55BCDF3E1430431C85AC2B01B3AA91FB267D53BB7592B072DE138506AF7A6
- MD5 SHA1 SHA512 SSDEEP TLSH