Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
17/04/2026, 23:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cd5afb1313dd257ea46ff488baa75f84b42bbdd37177c1eeaf0367fe612a7d63.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
cd5afb1313dd257ea46ff488baa75f84b42bbdd37177c1eeaf0367fe612a7d63.exe
Resource
win11-20260130-en
windows11-21h2-x64
8 signatures
150 seconds
General
- Target cd5afb1313dd257ea46ff488baa75f84b42bbdd37177c1eeaf0367fe612a7d63.exe
- Size 395KB
- Sample260417-232zjsds4w
- SHA256 cd5afb1313dd257ea46ff488baa75f84b42bbdd37177c1eeaf0367fe612a7d63
- MD5 47e3775cd30705750252023d3d70965a
- SHA1 e14a10068537dc65ebbb8dc4b34a4af55542e84f
- SHA512 72277d646bbaea74270165c538416753bad63cf7d84f75690f1b37eb1a19dca73d590e562b90755486312948b929cb60ee63fcd03f0f811599a1aee0a25e4d5b
- SSDEEP 6144:XcbcTgav1cdCTuoPbgwmOLJvKRILSFvdFDcEOkCybEaQRXr9HNdvOa:XCSvO2x9mONvKRILSFnOkx2LIa
- TLSH T147846D2AB6A0D076C4B79579C4A247BAFBB1742137204ACFA390475A1F637E2BD3530D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5768 8c1f05ae - Unexpected DNS network traffic destination 6 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 76 223.5.5.5 5348 cd5afb1313dd257ea46ff488baa75f84b42bbdd37177c1eeaf0367fe612a7d63.exe Destination IP 3 114.114.114.114 5348 cd5afb1313dd257ea46ff488baa75f84b42bbdd37177c1eeaf0367fe612a7d63.exe Destination IP 4 223.5.5.5 5348 cd5afb1313dd257ea46ff488baa75f84b42bbdd37177c1eeaf0367fe612a7d63.exe Destination IP 50 114.114.114.114 5768 8c1f05ae Destination IP 51 223.5.5.5 5348 cd5afb1313dd257ea46ff488baa75f84b42bbdd37177c1eeaf0367fe612a7d63.exe Destination IP 75 114.114.114.114 5348 cd5afb1313dd257ea46ff488baa75f84b42bbdd37177c1eeaf0367fe612a7d63.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 8c1f05ae File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 8c1f05ae File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 8c1f05ae File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 8c1f05ae File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 8c1f05ae File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 8c1f05ae File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 8c1f05ae File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 8c1f05ae File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 8c1f05ae File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 8c1f05ae File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 8c1f05ae File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 8c1f05ae File created C:\Windows\SysWOW64\8c1f05ae cd5afb1313dd257ea46ff488baa75f84b42bbdd37177c1eeaf0367fe612a7d63.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 8c1f05ae File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 8c1f05ae - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\62c010 8c1f05ae File opened for modification C:\Windows\5b8f48 cd5afb1313dd257ea46ff488baa75f84b42bbdd37177c1eeaf0367fe612a7d63.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cd5afb1313dd257ea46ff488baa75f84b42bbdd37177c1eeaf0367fe612a7d63.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c1f05ae - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 8c1f05ae Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 8c1f05ae Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 8c1f05ae Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 8c1f05ae Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 8c1f05ae Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 8c1f05ae Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 8c1f05ae Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 8c1f05ae Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 8c1f05ae - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 5768 8c1f05ae 5768 8c1f05ae 5768 8c1f05ae 5768 8c1f05ae 5768 8c1f05ae 5768 8c1f05ae 5768 8c1f05ae 5768 8c1f05ae 5768 8c1f05ae 5768 8c1f05ae 5768 8c1f05ae 5768 8c1f05ae 5348 cd5afb1313dd257ea46ff488baa75f84b42bbdd37177c1eeaf0367fe612a7d63.exe 5348 cd5afb1313dd257ea46ff488baa75f84b42bbdd37177c1eeaf0367fe612a7d63.exe 5348 cd5afb1313dd257ea46ff488baa75f84b42bbdd37177c1eeaf0367fe612a7d63.exe 5348 cd5afb1313dd257ea46ff488baa75f84b42bbdd37177c1eeaf0367fe612a7d63.exe 5348 cd5afb1313dd257ea46ff488baa75f84b42bbdd37177c1eeaf0367fe612a7d63.exe 5348 cd5afb1313dd257ea46ff488baa75f84b42bbdd37177c1eeaf0367fe612a7d63.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 5348 cd5afb1313dd257ea46ff488baa75f84b42bbdd37177c1eeaf0367fe612a7d63.exe Token: SeTcbPrivilege 5348 cd5afb1313dd257ea46ff488baa75f84b42bbdd37177c1eeaf0367fe612a7d63.exe Token: SeDebugPrivilege 5768 8c1f05ae Token: SeTcbPrivilege 5768 8c1f05ae
Processes
-
C:\Users\Admin\AppData\Local\Temp\cd5afb1313dd257ea46ff488baa75f84b42bbdd37177c1eeaf0367fe612a7d63.exe"C:\Users\Admin\AppData\Local\Temp\cd5afb1313dd257ea46ff488baa75f84b42bbdd37177c1eeaf0367fe612a7d63.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5348
-
C:\Windows\Syswow64\8c1f05aeC:\Windows\Syswow64\8c1f05ae1⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5768
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\8c1f05ae
- Size 395KB
- SHA256 8bcf78d64bbddccaa6be391a75f9215b45747392890391ca79d00d4256d49f21
- MD5 b1c46dbdcc42225da4d6c56af15ccdf1
- SHA1 e122b8f4bbf386615fe08932e268342a4318776a
- SHA512 5cbe4dfcb86d73d3afc7c3fc0177b5a2f23d8346ebe304132b1316ce7ee31b4fe75c19da72421a8ae546c8ec115cae5aedfe83e1d70fead4cced990617d3ff09
- SSDEEP 6144:jcbcTgav1cdCTuoPbgwmOLJvKRILSFvdFDcEOkCybEaQRXr9HNdvOa:jCSvO2x9mONvKRILSFnOkx2LIa
- TLSH T1F6846D2AB6A0D076C4B79579C4A247BAFBB1742137204ACFA390475A1F637E2BD3530D
- MD5 SHA1 SHA512 SSDEEP TLSH