Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
15/04/2026, 10:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
14f676e750355c96053486fab219d61e15f8d5c8a7eb3252ad31cf868d3a919f.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
14f676e750355c96053486fab219d61e15f8d5c8a7eb3252ad31cf868d3a919f.exe
Resource
win11-20260130-en
windows11-21h2-x64
8 signatures
150 seconds
General
- Target 14f676e750355c96053486fab219d61e15f8d5c8a7eb3252ad31cf868d3a919f.exe
- Size 511KB
- Sample260415-mf1ewaby6r
- SHA256 14f676e750355c96053486fab219d61e15f8d5c8a7eb3252ad31cf868d3a919f
- MD5 f6d352232819bab04cc260ecad1661cd
- SHA1 c23a1d03f1d547c804d9c047ad5b245b5812c398
- SHA512 bf625d37ad7d702eab23f28ff584566758b5884a42fc3ca54454048d87c1b3784bb812fdbb99e795c0cf361900e0108c7482cb7bbe04bf5a3a6f46550f6434e8
- SSDEEP 6144:UcTgav1cdCTuoPbgwmOLJvKRILSFvdFDcEOkCybEaQRXr9HNdvOax5Rv0:USvO2x9mONvKRILSFnOkx2LIax5F0
- TLSH T141B45C26F6908036C4B34575C5F64BAAFAB4BC21631156CBA3943A6A1F737D2BD3130E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4264 9825ce10 - Unexpected DNS network traffic destination 10 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 47 114.114.114.114 4364 14f676e750355c96053486fab219d61e15f8d5c8a7eb3252ad31cf868d3a919f.exe Destination IP 54 223.5.5.5 4364 14f676e750355c96053486fab219d61e15f8d5c8a7eb3252ad31cf868d3a919f.exe Destination IP 81 223.5.5.5 4364 14f676e750355c96053486fab219d61e15f8d5c8a7eb3252ad31cf868d3a919f.exe Destination IP 103 114.114.114.114 4364 14f676e750355c96053486fab219d61e15f8d5c8a7eb3252ad31cf868d3a919f.exe Destination IP 172 223.5.5.5 4364 14f676e750355c96053486fab219d61e15f8d5c8a7eb3252ad31cf868d3a919f.exe Destination IP 80 114.114.114.114 4364 14f676e750355c96053486fab219d61e15f8d5c8a7eb3252ad31cf868d3a919f.exe Destination IP 104 223.5.5.5 4364 14f676e750355c96053486fab219d61e15f8d5c8a7eb3252ad31cf868d3a919f.exe Destination IP 171 114.114.114.114 4364 14f676e750355c96053486fab219d61e15f8d5c8a7eb3252ad31cf868d3a919f.exe Destination IP 3 114.114.114.114 4364 14f676e750355c96053486fab219d61e15f8d5c8a7eb3252ad31cf868d3a919f.exe Destination IP 6 223.5.5.5 4364 14f676e750355c96053486fab219d61e15f8d5c8a7eb3252ad31cf868d3a919f.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 9825ce10 File created C:\Windows\SysWOW64\9825ce10 14f676e750355c96053486fab219d61e15f8d5c8a7eb3252ad31cf868d3a919f.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 9825ce10 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 9825ce10 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 9825ce10 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 9825ce10 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 9825ce10 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 9825ce10 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 9825ce10 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 9825ce10 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 9825ce10 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 9825ce10 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 9825ce10 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\490050 9825ce10 File opened for modification C:\Windows\4ab698 14f676e750355c96053486fab219d61e15f8d5c8a7eb3252ad31cf868d3a919f.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14f676e750355c96053486fab219d61e15f8d5c8a7eb3252ad31cf868d3a919f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9825ce10 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 9825ce10 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 9825ce10 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 9825ce10 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 9825ce10 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 9825ce10 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 9825ce10 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 9825ce10 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 9825ce10 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 9825ce10 - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 4264 9825ce10 4264 9825ce10 4264 9825ce10 4264 9825ce10 4264 9825ce10 4264 9825ce10 4264 9825ce10 4264 9825ce10 4264 9825ce10 4264 9825ce10 4264 9825ce10 4264 9825ce10 4364 14f676e750355c96053486fab219d61e15f8d5c8a7eb3252ad31cf868d3a919f.exe 4364 14f676e750355c96053486fab219d61e15f8d5c8a7eb3252ad31cf868d3a919f.exe 4364 14f676e750355c96053486fab219d61e15f8d5c8a7eb3252ad31cf868d3a919f.exe 4364 14f676e750355c96053486fab219d61e15f8d5c8a7eb3252ad31cf868d3a919f.exe 4364 14f676e750355c96053486fab219d61e15f8d5c8a7eb3252ad31cf868d3a919f.exe 4364 14f676e750355c96053486fab219d61e15f8d5c8a7eb3252ad31cf868d3a919f.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4364 14f676e750355c96053486fab219d61e15f8d5c8a7eb3252ad31cf868d3a919f.exe Token: SeTcbPrivilege 4364 14f676e750355c96053486fab219d61e15f8d5c8a7eb3252ad31cf868d3a919f.exe Token: SeDebugPrivilege 4264 9825ce10 Token: SeTcbPrivilege 4264 9825ce10
Processes
-
C:\Users\Admin\AppData\Local\Temp\14f676e750355c96053486fab219d61e15f8d5c8a7eb3252ad31cf868d3a919f.exe"C:\Users\Admin\AppData\Local\Temp\14f676e750355c96053486fab219d61e15f8d5c8a7eb3252ad31cf868d3a919f.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4364
-
C:\Windows\Syswow64\9825ce10C:\Windows\Syswow64\9825ce101⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4264
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\9825ce10
- Size 511KB
- SHA256 8e534a1edcdb085d11b896e6a7f7be79c6cbe89282749ee069be904d81ba81eb
- MD5 35cfa9e2bd8864ef6c5cb2e77e1d790b
- SHA1 2ad71e2298c897f144a58086f926ef8851cbd346
- SHA512 040e66a937ad52397f71fb701e997e2ce47895f5f9aa4f0dde3673b241ed8e5201489c631e04a40bf8202411e891c60bb17c6c4ed788e1618a2e925209ff1088
- SSDEEP 6144:VcTgav1cdCTuoPbgwmOLJvKRILSFvdFDcEOkCybEaQRXr9HNdvOax5Rv0:VSvO2x9mONvKRILSFnOkx2LIax5F0
- TLSH T152B45C26F6908036C4B34575C5F64BAAFAB4BC21631156CBA3943A6A1F737D2BD3130E
- MD5 SHA1 SHA512 SSDEEP TLSH