Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
18/04/2026, 09:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5ff59309f6d932ba169b368cdac4b7fcf11da8423c45e903db1cdab49df03b7d.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
5ff59309f6d932ba169b368cdac4b7fcf11da8423c45e903db1cdab49df03b7d.exe
Resource
win11-20260130-en
windows11-21h2-x64
8 signatures
150 seconds
General
- Target 5ff59309f6d932ba169b368cdac4b7fcf11da8423c45e903db1cdab49df03b7d.exe
- Size 615KB
- Sample260418-llz6macv3m
- SHA256 5ff59309f6d932ba169b368cdac4b7fcf11da8423c45e903db1cdab49df03b7d
- MD5 3d5a12f58dde71ac5462eaa96bf37f16
- SHA1 4eb2ec45c3340fca3c48fc4729a7437618ec79de
- SHA512 e24e052981ecf7d5a3b34470f4a67ddae36e8e210a392e626844002fdc6a3c990ed8eb214c83d5db3e1d70e06536fa3ddcbd77ffd9ce14c3f0664e7774217882
- SSDEEP 12288:NSvO2x9mONvKRILSFnOkx2LIax5FAQjU/Liw:MvO2xJKRI2FOkx2LFicUV
- TLSH T116D44A31E241C03AD4A74576C6FA0BAFE5647D25531165CBA3C43A2A2FB36D2BE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5212 c319c208 - Unexpected DNS network traffic destination 10 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 3 114.114.114.114 4300 5ff59309f6d932ba169b368cdac4b7fcf11da8423c45e903db1cdab49df03b7d.exe Destination IP 4 223.5.5.5 4300 5ff59309f6d932ba169b368cdac4b7fcf11da8423c45e903db1cdab49df03b7d.exe Destination IP 51 223.5.5.5 4300 5ff59309f6d932ba169b368cdac4b7fcf11da8423c45e903db1cdab49df03b7d.exe Destination IP 79 114.114.114.114 4300 5ff59309f6d932ba169b368cdac4b7fcf11da8423c45e903db1cdab49df03b7d.exe Destination IP 81 223.5.5.5 4300 5ff59309f6d932ba169b368cdac4b7fcf11da8423c45e903db1cdab49df03b7d.exe Destination IP 126 114.114.114.114 4300 5ff59309f6d932ba169b368cdac4b7fcf11da8423c45e903db1cdab49df03b7d.exe Destination IP 127 223.5.5.5 4300 5ff59309f6d932ba169b368cdac4b7fcf11da8423c45e903db1cdab49df03b7d.exe Destination IP 50 114.114.114.114 4300 5ff59309f6d932ba169b368cdac4b7fcf11da8423c45e903db1cdab49df03b7d.exe Destination IP 195 114.114.114.114 4300 5ff59309f6d932ba169b368cdac4b7fcf11da8423c45e903db1cdab49df03b7d.exe Destination IP 196 223.5.5.5 4300 5ff59309f6d932ba169b368cdac4b7fcf11da8423c45e903db1cdab49df03b7d.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 c319c208 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 c319c208 File created C:\Windows\SysWOW64\c319c208 5ff59309f6d932ba169b368cdac4b7fcf11da8423c45e903db1cdab49df03b7d.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft c319c208 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache c319c208 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 c319c208 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 c319c208 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 c319c208 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE c319c208 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies c319c208 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 c319c208 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData c319c208 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content c319c208 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\593b38 c319c208 File opened for modification C:\Windows\499e18 5ff59309f6d932ba169b368cdac4b7fcf11da8423c45e903db1cdab49df03b7d.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ff59309f6d932ba169b368cdac4b7fcf11da8423c45e903db1cdab49df03b7d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c319c208 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix c319c208 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" c319c208 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" c319c208 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ c319c208 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" c319c208 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" c319c208 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" c319c208 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" c319c208 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing c319c208 - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 5212 c319c208 5212 c319c208 5212 c319c208 5212 c319c208 5212 c319c208 5212 c319c208 5212 c319c208 5212 c319c208 5212 c319c208 5212 c319c208 5212 c319c208 5212 c319c208 4300 5ff59309f6d932ba169b368cdac4b7fcf11da8423c45e903db1cdab49df03b7d.exe 4300 5ff59309f6d932ba169b368cdac4b7fcf11da8423c45e903db1cdab49df03b7d.exe 4300 5ff59309f6d932ba169b368cdac4b7fcf11da8423c45e903db1cdab49df03b7d.exe 4300 5ff59309f6d932ba169b368cdac4b7fcf11da8423c45e903db1cdab49df03b7d.exe 4300 5ff59309f6d932ba169b368cdac4b7fcf11da8423c45e903db1cdab49df03b7d.exe 4300 5ff59309f6d932ba169b368cdac4b7fcf11da8423c45e903db1cdab49df03b7d.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4300 5ff59309f6d932ba169b368cdac4b7fcf11da8423c45e903db1cdab49df03b7d.exe Token: SeTcbPrivilege 4300 5ff59309f6d932ba169b368cdac4b7fcf11da8423c45e903db1cdab49df03b7d.exe Token: SeDebugPrivilege 5212 c319c208 Token: SeTcbPrivilege 5212 c319c208
Processes
-
C:\Users\Admin\AppData\Local\Temp\5ff59309f6d932ba169b368cdac4b7fcf11da8423c45e903db1cdab49df03b7d.exe"C:\Users\Admin\AppData\Local\Temp\5ff59309f6d932ba169b368cdac4b7fcf11da8423c45e903db1cdab49df03b7d.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4300
-
C:\Windows\Syswow64\c319c208C:\Windows\Syswow64\c319c2081⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5212
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\c319c208
- Size 615KB
- SHA256 86818b478058c693d271e1ac29406cdb42d1f99260a484ed9aa070ecebb61a96
- MD5 aca184a30d745488f3602110f7760542
- SHA1 8248ffdd5fd2f18ce5ed213373b819a8b4639ab3
- SHA512 a57d7f2f0d463eec9c65753d2e90d1d6f5e3c0da0e715373f0e819a040b55cfbdebc440828f4ee298d5b136373cf6d033e31654862257278c60a0bda11aaacae
- SSDEEP 12288:cSvO2x9mONvKRILSFnOkx2LIax5FAQjU/Liw:vvO2xJKRI2FOkx2LFicUV
- TLSH T13CD44A31E241C03AD4A74576C6FA0BAFE5647D25531165CBA3C43A2A2FB36D2BE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH