Analysis
- max time kernel
149s - max time network
153s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
15/04/2026, 11:20
Behavioral task
behavioral1
Sample
ff64a850df7377ea60179e6a3139afc7ab3760dbe5c9c0e231e2bf5b9ff98061.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
ff64a850df7377ea60179e6a3139afc7ab3760dbe5c9c0e231e2bf5b9ff98061.exe
Resource
win11-20260130-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target ff64a850df7377ea60179e6a3139afc7ab3760dbe5c9c0e231e2bf5b9ff98061.exe
- Size 548KB
- Sample260415-nfezlsft71
- SHA256 ff64a850df7377ea60179e6a3139afc7ab3760dbe5c9c0e231e2bf5b9ff98061
- MD5 fe85ad4cd1280a5f4ffca6d9b02996a5
- SHA1 79d3f2495d2573c8bdc9ee1e600610bcc34ce1ad
- SHA512 c06e1333029c9400bac9121a5872138dfc74836295fa519a3f6a3e61e4fae29eb0e5922e84ce2582080544b67b6a93ed785fad05b167a1ecc3c598abfe3b1fbc
- SSDEEP 6144:Hl51orRJXlDixHkUXe35rlcEOkCybEaQRXr9HNdvOa:pqXUHkUXe39VOkx2LIa
- TLSH T1B6C4BF5BF2744076C49BD678C9935A9AFBF1B815872143CF1320825A1F737E2AE3A325
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4892 f9db4295 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 9 223.5.5.5 2660 ff64a850df7377ea60179e6a3139afc7ab3760dbe5c9c0e231e2bf5b9ff98061.exe Destination IP 1 114.114.114.114 2660 ff64a850df7377ea60179e6a3139afc7ab3760dbe5c9c0e231e2bf5b9ff98061.exe Destination IP 2 223.5.5.5 2660 ff64a850df7377ea60179e6a3139afc7ab3760dbe5c9c0e231e2bf5b9ff98061.exe Destination IP 8 114.114.114.114 2660 ff64a850df7377ea60179e6a3139afc7ab3760dbe5c9c0e231e2bf5b9ff98061.exe - Drops file in System32 directory 17 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 f9db4295 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies f9db4295 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache f9db4295 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData f9db4295 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 f9db4295 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AAD646CB44373074ADE741C38400E7E1 f9db4295 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC845F33427F1C99AF855BE8930371C f9db4295 File created C:\Windows\SysWOW64\f9db4295 ff64a850df7377ea60179e6a3139afc7ab3760dbe5c9c0e231e2bf5b9ff98061.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft f9db4295 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content f9db4295 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC845F33427F1C99AF855BE8930371C f9db4295 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 f9db4295 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 f9db4295 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 f9db4295 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AAD646CB44373074ADE741C38400E7E1 f9db4295 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE f9db4295 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 f9db4295 -
resource yara_rule behavioral2/memory/2660-0-0x0000000000D20000-0x0000000000DA9000-memory.dmp upx behavioral2/files/0x002100000002b1ae-3.dat upx behavioral2/memory/4892-4-0x0000000000CA0000-0x0000000000D29000-memory.dmp upx behavioral2/memory/2660-17-0x0000000000D20000-0x0000000000DA9000-memory.dmp upx behavioral2/memory/4892-19-0x0000000000CA0000-0x0000000000D29000-memory.dmp upx behavioral2/memory/2660-36-0x0000000000D20000-0x0000000000DA9000-memory.dmp upx behavioral2/memory/4892-38-0x0000000000CA0000-0x0000000000D29000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\53c0b8 f9db4295 File opened for modification C:\Windows\2d8a48 ff64a850df7377ea60179e6a3139afc7ab3760dbe5c9c0e231e2bf5b9ff98061.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f9db4295 Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ff64a850df7377ea60179e6a3139afc7ab3760dbe5c9c0e231e2bf5b9ff98061.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ f9db4295 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix f9db4295 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" f9db4295 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" f9db4295 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" f9db4295 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" f9db4295 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" f9db4295 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" f9db4295 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing f9db4295 - Modifies system certificate store 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1F24C630CDA418EF2069FFAD4FDD5F463A1B69AA f9db4295 Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1F24C630CDA418EF2069FFAD4FDD5F463A1B69AA\Blob = 5c000000010000000400000080010000190000000100000010000000e3087c0c81f60a2a2b466b8a3e70cce80f0000000100000030000000f019c7ba12795dacd6ef1a767657deb8e41060a2ad1a6c66900a6ec16870fc06eecbaffdd3e2c986659578e7e85e535a530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003800000047006c006f00620061006c005300690067006e002000450043004300200052006f006f00740020004300410020002d002000520035000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308620000000100000020000000179fbc148a3dd00fd24ea13458cc43bfa7f59c8182d783a513f6ebec100c89241400000001000000140000003de629489bea07ca21444a26de6eded283d09f591d0000000100000010000000b647dd2a9ccadee75e8905e256cc6b147f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d7010300000001000000140000001f24c630cda418ef2069ffad4fdd5f463a1b69aa0400000001000000100000009fad3b1c021e8aba177438810ca2bc082000000001000000220200003082021e308201a4a0030201020211605949e0262ebb55f90a778a71f94ad86c300a06082a8648ce3d040303305031243022060355040b131b476c6f62616c5369676e2045434320526f6f74204341202d20523531133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3132313131333030303030305a170d3338303131393033313430375a305031243022060355040b131b476c6f62616c5369676e2045434320526f6f74204341202d20523531133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e3076301006072a8648ce3d020106052b810400220362000447450e96fb7d5dbfe939d121f89f0bb6d57b1e923a48591cf062312dc07a28fe1aa75cb3b6cc97e745d458fad1776d43a2c08765340a1f7addeb3c33a1c59d4da46f4195387fc91e84ebd19e49928794870c3a854a669f9d59934d976106864aa3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604143de629489bea07ca21444a26de6eded283d09f59300a06082a8648ce3d0403030368003065023100e56912c96edbc631ba0941e197f8fbfd9ae27d12c9ed7c64d3cb05258b56d9a0e75e5d4e0b839c5b7629a00926216a62023071d2b58f5cea3be1780985a875923bc85cfd48ef0d7422a808e26ec549cec70cbca76169f1f73be12acbf92bf3669037 f9db4295 - Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 4892 f9db4295 4892 f9db4295 4892 f9db4295 4892 f9db4295 4892 f9db4295 4892 f9db4295 4892 f9db4295 4892 f9db4295 4892 f9db4295 4892 f9db4295 4892 f9db4295 4892 f9db4295 4892 f9db4295 4892 f9db4295 4892 f9db4295 4892 f9db4295 4892 f9db4295 4892 f9db4295 4892 f9db4295 4892 f9db4295 2660 ff64a850df7377ea60179e6a3139afc7ab3760dbe5c9c0e231e2bf5b9ff98061.exe 2660 ff64a850df7377ea60179e6a3139afc7ab3760dbe5c9c0e231e2bf5b9ff98061.exe 2660 ff64a850df7377ea60179e6a3139afc7ab3760dbe5c9c0e231e2bf5b9ff98061.exe 2660 ff64a850df7377ea60179e6a3139afc7ab3760dbe5c9c0e231e2bf5b9ff98061.exe 2660 ff64a850df7377ea60179e6a3139afc7ab3760dbe5c9c0e231e2bf5b9ff98061.exe 2660 ff64a850df7377ea60179e6a3139afc7ab3760dbe5c9c0e231e2bf5b9ff98061.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2660 ff64a850df7377ea60179e6a3139afc7ab3760dbe5c9c0e231e2bf5b9ff98061.exe Token: SeTcbPrivilege 2660 ff64a850df7377ea60179e6a3139afc7ab3760dbe5c9c0e231e2bf5b9ff98061.exe Token: SeDebugPrivilege 4892 f9db4295 Token: SeTcbPrivilege 4892 f9db4295
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff64a850df7377ea60179e6a3139afc7ab3760dbe5c9c0e231e2bf5b9ff98061.exe"C:\Users\Admin\AppData\Local\Temp\ff64a850df7377ea60179e6a3139afc7ab3760dbe5c9c0e231e2bf5b9ff98061.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2660
-
C:\Windows\Syswow64\f9db4295C:\Windows\Syswow64\f9db42951⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4892
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\53c0b8
- Size 916B
- SHA256 ca7fe1341854aa84125cb365ca9cb3fa7db5e630120cd3a6684c5b4bef35fc61
- MD5 4c8d503975dd8eb26f23637d74895cce
- SHA1 4b04607d82216d4590bf66b792e71e7821e182d3
- SHA512 d0df1dee04218946a9ef448a9079da2f9c94b5835a64f9756efd4b23bdd70af6a03edf3c7114287060bbe1ff44ab1d5cc0224c9f6902e43f248a468c4677626c
- TLSH T1481180B7B44366F31DED8D0F564425D7B564D052B46A24D53E563AC61AF3CE03B13209
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\f9db4295
- Size 548KB
- SHA256 d6e25b72eed645e642d87d86eb94ea0b7cb17d71f43dec27807b03571ebc29a6
- MD5 e345f4c0ded717c8f03f80a5cb14af76
- SHA1 ed21c4959754e26a7db83ddc39f090263f8bef2a
- SHA512 850badd415ba44b2ba2b0cff14c3ec91ba2dfc6658ca85964d50761c88636a32df7846838be2424c0fad8ad41476398f4c3c4daa39ec341a94e7b7242b63617f
- SSDEEP 6144:xl51orRJXlDixHkUXe35rlcEOkCybEaQRXr9HNdvOa:PqXUHkUXe39VOkx2LIa
- TLSH T170C4BF5BF2744076C49BD678C9935A9AFBF1B815872143CF1320825A1F737E2AE3A325
- MD5 SHA1 SHA512 SSDEEP TLSH