Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
15/04/2026, 09:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7887cc3e503b86f4cfcfff0776251477b32b9ffcec2d2de1bbc10fc637a15b9a.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
7887cc3e503b86f4cfcfff0776251477b32b9ffcec2d2de1bbc10fc637a15b9a.exe
Resource
win11-20260130-en
windows11-21h2-x64
8 signatures
150 seconds
General
- Target 7887cc3e503b86f4cfcfff0776251477b32b9ffcec2d2de1bbc10fc637a15b9a.exe
- Size 679KB
- Sample260415-ltmkhaes4y
- SHA256 7887cc3e503b86f4cfcfff0776251477b32b9ffcec2d2de1bbc10fc637a15b9a
- MD5 8acaf37afed93941c27e32af33f43ba5
- SHA1 5f5d8cfbce6d5985f605e933f346d9605e941ee1
- SHA512 ee6e6db474a42680fd978dedd49dbb27e4d9a807288b66c23f53edcdabd6411462a94331d929c87ff82dea189a05bb97ce4ad4629d1afbd32f9ddfc3c67eb73c
- SSDEEP 12288:OSvO2x9mONvKRILSFnOkx2LIaxya5FAQjU/Lik8CQ3K:tvO2xJKRI2FOkx2LFEvcUQPK
- TLSH T130E45A31E641C036D4A74576C6FA0BBFE964BD25131165CBA3C43A262FB36D2BA3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5928 c5cf63b3 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 1 114.114.114.114 5224 7887cc3e503b86f4cfcfff0776251477b32b9ffcec2d2de1bbc10fc637a15b9a.exe Destination IP 2 223.5.5.5 5224 7887cc3e503b86f4cfcfff0776251477b32b9ffcec2d2de1bbc10fc637a15b9a.exe Destination IP 7 114.114.114.114 5224 7887cc3e503b86f4cfcfff0776251477b32b9ffcec2d2de1bbc10fc637a15b9a.exe Destination IP 8 223.5.5.5 5224 7887cc3e503b86f4cfcfff0776251477b32b9ffcec2d2de1bbc10fc637a15b9a.exe - Drops file in System32 directory 11 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 c5cf63b3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 c5cf63b3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE c5cf63b3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 c5cf63b3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft c5cf63b3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content c5cf63b3 File created C:\Windows\SysWOW64\c5cf63b3 7887cc3e503b86f4cfcfff0776251477b32b9ffcec2d2de1bbc10fc637a15b9a.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies c5cf63b3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache c5cf63b3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData c5cf63b3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 c5cf63b3 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\657d50 c5cf63b3 File opened for modification C:\Windows\596fd0 7887cc3e503b86f4cfcfff0776251477b32b9ffcec2d2de1bbc10fc637a15b9a.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7887cc3e503b86f4cfcfff0776251477b32b9ffcec2d2de1bbc10fc637a15b9a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c5cf63b3 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix c5cf63b3 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" c5cf63b3 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" c5cf63b3 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" c5cf63b3 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing c5cf63b3 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" c5cf63b3 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ c5cf63b3 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" c5cf63b3 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" c5cf63b3 - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 5928 c5cf63b3 5928 c5cf63b3 5928 c5cf63b3 5928 c5cf63b3 5928 c5cf63b3 5928 c5cf63b3 5928 c5cf63b3 5928 c5cf63b3 5224 7887cc3e503b86f4cfcfff0776251477b32b9ffcec2d2de1bbc10fc637a15b9a.exe 5224 7887cc3e503b86f4cfcfff0776251477b32b9ffcec2d2de1bbc10fc637a15b9a.exe 5224 7887cc3e503b86f4cfcfff0776251477b32b9ffcec2d2de1bbc10fc637a15b9a.exe 5224 7887cc3e503b86f4cfcfff0776251477b32b9ffcec2d2de1bbc10fc637a15b9a.exe 5224 7887cc3e503b86f4cfcfff0776251477b32b9ffcec2d2de1bbc10fc637a15b9a.exe 5224 7887cc3e503b86f4cfcfff0776251477b32b9ffcec2d2de1bbc10fc637a15b9a.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 5224 7887cc3e503b86f4cfcfff0776251477b32b9ffcec2d2de1bbc10fc637a15b9a.exe Token: SeTcbPrivilege 5224 7887cc3e503b86f4cfcfff0776251477b32b9ffcec2d2de1bbc10fc637a15b9a.exe Token: SeDebugPrivilege 5928 c5cf63b3 Token: SeTcbPrivilege 5928 c5cf63b3
Processes
-
C:\Users\Admin\AppData\Local\Temp\7887cc3e503b86f4cfcfff0776251477b32b9ffcec2d2de1bbc10fc637a15b9a.exe"C:\Users\Admin\AppData\Local\Temp\7887cc3e503b86f4cfcfff0776251477b32b9ffcec2d2de1bbc10fc637a15b9a.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5224
-
C:\Windows\Syswow64\c5cf63b3C:\Windows\Syswow64\c5cf63b31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5928
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\c5cf63b3
- Size 679KB
- SHA256 8928fff7dc6ac802188a3aec7e682351cd2f7e41bf8b4c21f15baf12c4c5fa9d
- MD5 b821ab863a788c6e5891edad2ea3b708
- SHA1 435b05b42b00040d6489d5cb59a48199af325750
- SHA512 3e82fd62315ef90793d4971bfd32b7272f4d307a61fbdc783744f747c5f33e59beab19919d5088dfc175f06c495fc9bfaee2ac3016ed7b61177662869892d6d4
- SSDEEP 12288:mSvO2x9mONvKRILSFnOkx2LIaxya5FAQjU/Lik8CQ3K:FvO2xJKRI2FOkx2LFEvcUQPK
- TLSH T106E45A31E641C036D4A74576C6FA0BBFE964BD25131165CBA3C43A262FB36D2BA3170E
- MD5 SHA1 SHA512 SSDEEP TLSH