Analysis
- max time kernel
150s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/11/2026, 08:38
Behavioral task
behavioral1
Sample
f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe
- Size 5.7MB
- Sample261105-kjzlmsg131
- SHA256 f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3
- MD5 0e713cf33615c2db1f796c8972d8ae5b
- SHA1 9723ba7a3c0a7b08fd508f155012e42efdc1130d
- SHA512 bfd5e1dfc01d410f4c8c7a53a6caebf9c194e1cff9b2bca48a572b6cb418cd12c582587596f8f592517d256c380493d42dd2e25eb495807110044a8040f9aad8
- SSDEEP 49152:H24pOK123wBa1c603wsZga2udET1I+51Oj1CvTA+GG6OT75XvPWzYSH:HqEv60gsOTGMN8
- TLSH T145565CAABB7CB574D000697BBAAD9B47ED0C1D023341976C917E81B54F48AA0CC49F7E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Cosmu payload 2 IoCs
Cosmu is a worm written in C++.
resource yara_rule behavioral2/files/0x000600000001b85a-1.dat family_cosmu behavioral2/files/0x00030000000003b1-4.dat family_cosmu - Renames multiple (295) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe File created C:\Program Files\Common Files\System\ado\msader15.dll.tmp f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe File created C:\Program Files\7-Zip\Lang\kab.txt.tmp f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.tmp f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll.tmp f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ru-ru.dll.tmp f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe File created C:\Program Files\Common Files\microsoft shared\ink\mshwstaging.dll.tmp f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui.tmp f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.tmp f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipRes.dll.mui.tmp f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe File created C:\Program Files\Common Files\microsoft shared\ink\sq-AL\tipresx.dll.mui.tmp f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui.tmp f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe File created C:\Program Files\7-Zip\Lang\eu.txt.tmp f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hi-in.dll.tmp f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui.tmp f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml.tmp f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msdaremr.dll.mui.tmp f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe File created C:\Program Files\7-Zip\Lang\kk.txt.tmp f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml.tmp f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml.tmp f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe File created C:\Program Files\7-Zip\Lang\nb.txt.tmp f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tipresx.dll.mui.tmp f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipRes.dll.mui.tmp f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe File created C:\Program Files\Common Files\microsoft shared\ink\ga-IE\tipresx.dll.mui.tmp f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe File created C:\Program Files\Common Files\System\msadc\adcjavas.inc.tmp f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui.tmp f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe File created C:\Program Files\Common Files\microsoft shared\ink\bn-IN\tipresx.dll.mui.tmp f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe File created C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui.tmp f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe File created C:\Program Files\7-Zip\Lang\et.txt.tmp f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe File created C:\Program Files\7-Zip\Lang\ne.txt.tmp f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe File created C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui.tmp f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\RepoMan.dll.tmp f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe File created C:\Program Files\7-Zip\Lang\pt-br.txt.tmp f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe File created C:\Program Files\7-Zip\Lang\it.txt.tmp f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe File created C:\Program Files\7-Zip\Lang\id.txt.tmp f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.he-il.dll.tmp f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe File created C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui.tmp f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml.tmp f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TabTip.exe.mui.tmp f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe File created C:\Program Files\7-Zip\7zG.exe.tmp f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe File created C:\Program Files\7-Zip\Lang\fy.txt.tmp f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe File created C:\Program Files\7-Zip\Lang\pa-in.txt.tmp f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe File created C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.tmp f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe File created C:\Program Files\Common Files\microsoft shared\ink\kk-KZ\tipresx.dll.mui.tmp f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe File created C:\Program Files\7-Zip\Lang\es.txt.tmp f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.tmp f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.tmp f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll.tmp f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui.tmp f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe File created C:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui.tmp f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe File created C:\Program Files\Common Files\microsoft shared\ink\or-IN\tipresx.dll.mui.tmp f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe File created C:\Program Files\7-Zip\Lang\hu.txt.tmp f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe File created C:\Program Files\7-Zip\Lang\nl.txt.tmp f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll.tmp f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe File created C:\Program Files\Common Files\microsoft shared\ink\km-KH\tipresx.dll.mui.tmp f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe File created C:\Program Files\Common Files\microsoft shared\ink\kok-IN\tipresx.dll.mui.tmp f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msadcer.dll.mui.tmp f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe File created C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll.tmp f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOMessageProvider.dll.tmp f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml.tmp f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe File created C:\Program Files\Common Files\microsoft shared\ink\ko-KR\tipresx.dll.mui.tmp f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe File created C:\Program Files\Common Files\microsoft shared\ink\lo-LA\tipresx.dll.mui.tmp f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe File created C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui.tmp f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe"C:\Users\Admin\AppData\Local\Temp\f5ca5755704476b4250807c41800ac2881b6fc229d922189e62f0001e187c8d3.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4320
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-461973139-3212354679-1508698038-1000\desktop.ini.tmp
- Size 5.7MB
- SHA256 169089f38f66649afbb25da1e1681e34b5f89cd7f19bde2b3ed8c613c15a4b9e
- MD5 d1ad44066fd565e22ce62d4e69dfab3b
- SHA1 d5254c48ab14a00a86b2efa8d615fd6a10714f56
- SHA512 017eaa07645c49ce88d4325c9032b9dd45212a8008c82ad10ebd4f00612da36191898b29421f2a44dcc32e45941cae24457d63f9334ac6e4d23a5baac254d718
- SSDEEP 49152:H24pOK123wBa1c603wsZga2udET1I+51Oj1CvTA+GG6OT75XvPWzYSo:HqEv60gsOTGMN/
- TLSH T1E7565CAABB7CB574D000697BBAAD9B47ED0C1D023341976C917E81B54F48AA0CC49F7E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7-zip.chm.tmp
- Size 5.8MB
- SHA256 e7ecc8a249fccf04a0f911cf2a14821c67c3923104a665c2706f8a19be0ffb47
- MD5 37fa3920f32970457a05fea29cd8b2fa
- SHA1 f4d2dea737a9dd49aaff1a11dd3ea3c49e17ae56
- SHA512 f5012dc891bd807096f740eed6bad5251bb9a583b9c1d2234693e2d484791444b0af24dc945b1ea35a99a8a25f52e1477e6891eb7e2c5e5b8b3e8926d4cb78a9
- SSDEEP 49152:H24pOK123wBa1c603wsZga2udET1I+51Oj1CvTA+GG6OT75XvPWzYSiwGd:HqEv60gsOTGMNXVd
- TLSH T181566CAABB7CB574D000597BBAAD9B4BED0C1D023341976C917E81B54F48AA0CC49F7E
- MD5 SHA1 SHA512 SSDEEP TLSH