Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20250619-en -
resource tags
arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system -
submitted
02/07/2025, 19:23
Static task
static1
Behavioral task
behavioral1
Sample
b76a89a34a750475510e133a2d80e50312259241795a54a73c0ef6605e70bc2a.exe
Resource
win10v2004-20250619-en
General
-
Target
b76a89a34a750475510e133a2d80e50312259241795a54a73c0ef6605e70bc2a.exe
-
Size
1.2MB
-
MD5
24e2ce1a501c179607fe88e1a9d2675f
-
SHA1
9a49fadf1553f85e1ff8396eb4f1fed874013083
-
SHA256
b76a89a34a750475510e133a2d80e50312259241795a54a73c0ef6605e70bc2a
-
SHA512
79bf7a62145b3be6b81ec3136e5c3bc1b1635751614a399fdbd35e21c43b06bd60f9a571e6af66fc7ce34565eb723562f3ff4f8e90f2996422e6dfc89b34bb9f
-
SSDEEP
24576:qvO2xJKRI2dOkx2LFAAX1oOYSY82e5QPJJOgufWWsY+cPtN:qHHKO2FQd1oOU82lPJ6Ph
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1824 47343e2c -
Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 3 114.114.114.114 760 b76a89a34a750475510e133a2d80e50312259241795a54a73c0ef6605e70bc2a.exe Destination IP 27 223.5.5.5 760 b76a89a34a750475510e133a2d80e50312259241795a54a73c0ef6605e70bc2a.exe Destination IP 44 114.114.114.114 760 b76a89a34a750475510e133a2d80e50312259241795a54a73c0ef6605e70bc2a.exe Destination IP 56 223.5.5.5 760 b76a89a34a750475510e133a2d80e50312259241795a54a73c0ef6605e70bc2a.exe -
Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\47343e2c b76a89a34a750475510e133a2d80e50312259241795a54a73c0ef6605e70bc2a.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 47343e2c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 47343e2c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 47343e2c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 47343e2c -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\1f3a40 47343e2c File opened for modification C:\Windows\d02f0 b76a89a34a750475510e133a2d80e50312259241795a54a73c0ef6605e70bc2a.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b76a89a34a750475510e133a2d80e50312259241795a54a73c0ef6605e70bc2a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 47343e2c -
Modifies data under HKEY_USERS 8 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 47343e2c Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 47343e2c Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 47343e2c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 47343e2c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 47343e2c Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 47343e2c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 47343e2c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 47343e2c -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 1824 47343e2c 1824 47343e2c 1824 47343e2c 1824 47343e2c 1824 47343e2c 1824 47343e2c 1824 47343e2c 1824 47343e2c 760 b76a89a34a750475510e133a2d80e50312259241795a54a73c0ef6605e70bc2a.exe 760 b76a89a34a750475510e133a2d80e50312259241795a54a73c0ef6605e70bc2a.exe 760 b76a89a34a750475510e133a2d80e50312259241795a54a73c0ef6605e70bc2a.exe 760 b76a89a34a750475510e133a2d80e50312259241795a54a73c0ef6605e70bc2a.exe 760 b76a89a34a750475510e133a2d80e50312259241795a54a73c0ef6605e70bc2a.exe 760 b76a89a34a750475510e133a2d80e50312259241795a54a73c0ef6605e70bc2a.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 760 b76a89a34a750475510e133a2d80e50312259241795a54a73c0ef6605e70bc2a.exe Token: SeTcbPrivilege 760 b76a89a34a750475510e133a2d80e50312259241795a54a73c0ef6605e70bc2a.exe Token: SeDebugPrivilege 1824 47343e2c Token: SeTcbPrivilege 1824 47343e2c
Processes
-
C:\Users\Admin\AppData\Local\Temp\b76a89a34a750475510e133a2d80e50312259241795a54a73c0ef6605e70bc2a.exe"C:\Users\Admin\AppData\Local\Temp\b76a89a34a750475510e133a2d80e50312259241795a54a73c0ef6605e70bc2a.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:760
-
C:\Windows\Syswow64\47343e2cC:\Windows\Syswow64\47343e2c1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1824
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5cf67215e8d740450c3eeedcea346fe8b
SHA1a9416b2c4007bc10e259f16353da645db3019694
SHA256391f8e8cead23fc44564969d9b856cd5b922db63339b2dc9c6c989a1588054c3
SHA512a593683c7cb21d755a049e8b4be609adfde735242be486b3d1475d6688c8cf542bd3546dac5e99fbae7abd9fb7a947ac0ec0e88b5735f3a24a23f46617e271eb