Analysis
-
max time kernel
143s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20250502-en -
resource tags
arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system -
submitted
02/07/2025, 19:23
Static task
static1
Behavioral task
behavioral1
Sample
94895a7224f376f7b2fdc5d5d92fec372c0e89340f9ad556caffa37dbac09ed6.exe
Resource
win10v2004-20250502-en
General
-
Target
94895a7224f376f7b2fdc5d5d92fec372c0e89340f9ad556caffa37dbac09ed6.exe
-
Size
704KB
-
MD5
7c2c4299fdce3539ac1e8d6b2a0a2efb
-
SHA1
e80d211bea25b1982cb013ae8c27f5f7f81be95b
-
SHA256
94895a7224f376f7b2fdc5d5d92fec372c0e89340f9ad556caffa37dbac09ed6
-
SHA512
194ea125def6d70090d19f3353e0b51dd76ee8741df278af17d753c59c1cd64a474fdaed6ea1fc87af8a0030946e46672262fccb25f1bbf8e9899ed4a7de13fe
-
SSDEEP
12288:zSvO2x9mONvKRILSFnOkx2LIaxy6RJ05r:GvO2xJKRI2FOkx2LFEF
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1780 c52ba20a -
Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 42 223.5.5.5 680 94895a7224f376f7b2fdc5d5d92fec372c0e89340f9ad556caffa37dbac09ed6.exe Destination IP 1 114.114.114.114 680 94895a7224f376f7b2fdc5d5d92fec372c0e89340f9ad556caffa37dbac09ed6.exe Destination IP 14 223.5.5.5 680 94895a7224f376f7b2fdc5d5d92fec372c0e89340f9ad556caffa37dbac09ed6.exe Destination IP 36 114.114.114.114 680 94895a7224f376f7b2fdc5d5d92fec372c0e89340f9ad556caffa37dbac09ed6.exe -
Drops file in System32 directory 5 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 c52ba20a File created C:\Windows\SysWOW64\c52ba20a 94895a7224f376f7b2fdc5d5d92fec372c0e89340f9ad556caffa37dbac09ed6.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 c52ba20a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE c52ba20a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies c52ba20a -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\ba450 94895a7224f376f7b2fdc5d5d92fec372c0e89340f9ad556caffa37dbac09ed6.exe File opened for modification C:\Windows\1e7968 c52ba20a -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 94895a7224f376f7b2fdc5d5d92fec372c0e89340f9ad556caffa37dbac09ed6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c52ba20a -
Modifies data under HKEY_USERS 8 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix c52ba20a Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" c52ba20a Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ c52ba20a Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" c52ba20a Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" c52ba20a Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" c52ba20a Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" c52ba20a Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" c52ba20a -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 1780 c52ba20a 1780 c52ba20a 1780 c52ba20a 1780 c52ba20a 1780 c52ba20a 1780 c52ba20a 1780 c52ba20a 1780 c52ba20a 680 94895a7224f376f7b2fdc5d5d92fec372c0e89340f9ad556caffa37dbac09ed6.exe 680 94895a7224f376f7b2fdc5d5d92fec372c0e89340f9ad556caffa37dbac09ed6.exe 680 94895a7224f376f7b2fdc5d5d92fec372c0e89340f9ad556caffa37dbac09ed6.exe 680 94895a7224f376f7b2fdc5d5d92fec372c0e89340f9ad556caffa37dbac09ed6.exe 680 94895a7224f376f7b2fdc5d5d92fec372c0e89340f9ad556caffa37dbac09ed6.exe 680 94895a7224f376f7b2fdc5d5d92fec372c0e89340f9ad556caffa37dbac09ed6.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 680 94895a7224f376f7b2fdc5d5d92fec372c0e89340f9ad556caffa37dbac09ed6.exe Token: SeTcbPrivilege 680 94895a7224f376f7b2fdc5d5d92fec372c0e89340f9ad556caffa37dbac09ed6.exe Token: SeDebugPrivilege 1780 c52ba20a Token: SeTcbPrivilege 1780 c52ba20a
Processes
-
C:\Users\Admin\AppData\Local\Temp\94895a7224f376f7b2fdc5d5d92fec372c0e89340f9ad556caffa37dbac09ed6.exe"C:\Users\Admin\AppData\Local\Temp\94895a7224f376f7b2fdc5d5d92fec372c0e89340f9ad556caffa37dbac09ed6.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:680
-
C:\Windows\Syswow64\c52ba20aC:\Windows\Syswow64\c52ba20a1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1780
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
704KB
MD5dfc74b626016133f27d647cb5b8b6d0f
SHA108b140463d15b1d5d2351dcf2f88f51f30a9ac98
SHA2569af1a35783cd73cc749bf30b6e03f41f266e3664b563fe69c14d506068e81899
SHA5121ace325e4fee7f54e712d6441b69ff9704f44d0ac02b14ba39ee8e96af60d68cab1b02a8b010f1d8f85eef7d344cc83f290592338299d58eea85cdb3e69c5542