Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
20/04/2026, 23:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cd0812e7b733e4eb6a80586f5c5fc8d6fc1d96b5e67923bcc400ff2169e8b7a7.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
cd0812e7b733e4eb6a80586f5c5fc8d6fc1d96b5e67923bcc400ff2169e8b7a7.exe
Resource
win11-20260130-en
windows11-21h2-x64
8 signatures
150 seconds
General
- Target cd0812e7b733e4eb6a80586f5c5fc8d6fc1d96b5e67923bcc400ff2169e8b7a7.exe
- Size 419KB
- Sample260420-285ydsft2k
- SHA256 cd0812e7b733e4eb6a80586f5c5fc8d6fc1d96b5e67923bcc400ff2169e8b7a7
- MD5 0c6ab9c62b2898916dfe7b203ae51eaf
- SHA1 c51c7f72b568071881b28488845c7fdf02582466
- SHA512 02ba26cfc741442ab9acff5c1d58d30dbbee0776cdf6e67278f4d0a5dbb07a0d2ee43d9f579b52b8dbd0e40bb0b12244e1db6cfb9d42320e3942c45d2898bf2b
- SSDEEP 6144:E6DmGnV0H2LALrYcdwVDL+gqFCcEOkCybEaQRXr9HNdvOa:E6D/WiA3YcyVDLjOkx2LIa
- TLSH T128947C29BAE08073C5678576C4E257A6FBB1B52127108ACFA390475A1F237E3BD3531E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1648 d12b7e70 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 28 223.5.5.5 2728 cd0812e7b733e4eb6a80586f5c5fc8d6fc1d96b5e67923bcc400ff2169e8b7a7.exe Destination IP 4 114.114.114.114 2728 cd0812e7b733e4eb6a80586f5c5fc8d6fc1d96b5e67923bcc400ff2169e8b7a7.exe Destination IP 6 223.5.5.5 2728 cd0812e7b733e4eb6a80586f5c5fc8d6fc1d96b5e67923bcc400ff2169e8b7a7.exe Destination IP 27 114.114.114.114 2728 cd0812e7b733e4eb6a80586f5c5fc8d6fc1d96b5e67923bcc400ff2169e8b7a7.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies d12b7e70 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 d12b7e70 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content d12b7e70 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 d12b7e70 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 d12b7e70 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE d12b7e70 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 d12b7e70 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft d12b7e70 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache d12b7e70 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData d12b7e70 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 d12b7e70 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AAD646CB44373074ADE741C38400E7E1 d12b7e70 File created C:\Windows\SysWOW64\d12b7e70 cd0812e7b733e4eb6a80586f5c5fc8d6fc1d96b5e67923bcc400ff2169e8b7a7.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 d12b7e70 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AAD646CB44373074ADE741C38400E7E1 d12b7e70 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\1c36e0 d12b7e70 File opened for modification C:\Windows\2eb450 cd0812e7b733e4eb6a80586f5c5fc8d6fc1d96b5e67923bcc400ff2169e8b7a7.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cd0812e7b733e4eb6a80586f5c5fc8d6fc1d96b5e67923bcc400ff2169e8b7a7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d12b7e70 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" d12b7e70 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" d12b7e70 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix d12b7e70 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ d12b7e70 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" d12b7e70 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing d12b7e70 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" d12b7e70 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" d12b7e70 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" d12b7e70 - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 1648 d12b7e70 1648 d12b7e70 1648 d12b7e70 1648 d12b7e70 1648 d12b7e70 1648 d12b7e70 1648 d12b7e70 1648 d12b7e70 1648 d12b7e70 1648 d12b7e70 1648 d12b7e70 1648 d12b7e70 2728 cd0812e7b733e4eb6a80586f5c5fc8d6fc1d96b5e67923bcc400ff2169e8b7a7.exe 2728 cd0812e7b733e4eb6a80586f5c5fc8d6fc1d96b5e67923bcc400ff2169e8b7a7.exe 2728 cd0812e7b733e4eb6a80586f5c5fc8d6fc1d96b5e67923bcc400ff2169e8b7a7.exe 2728 cd0812e7b733e4eb6a80586f5c5fc8d6fc1d96b5e67923bcc400ff2169e8b7a7.exe 2728 cd0812e7b733e4eb6a80586f5c5fc8d6fc1d96b5e67923bcc400ff2169e8b7a7.exe 2728 cd0812e7b733e4eb6a80586f5c5fc8d6fc1d96b5e67923bcc400ff2169e8b7a7.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2728 cd0812e7b733e4eb6a80586f5c5fc8d6fc1d96b5e67923bcc400ff2169e8b7a7.exe Token: SeTcbPrivilege 2728 cd0812e7b733e4eb6a80586f5c5fc8d6fc1d96b5e67923bcc400ff2169e8b7a7.exe Token: SeDebugPrivilege 1648 d12b7e70 Token: SeTcbPrivilege 1648 d12b7e70
Processes
-
C:\Users\Admin\AppData\Local\Temp\cd0812e7b733e4eb6a80586f5c5fc8d6fc1d96b5e67923bcc400ff2169e8b7a7.exe"C:\Users\Admin\AppData\Local\Temp\cd0812e7b733e4eb6a80586f5c5fc8d6fc1d96b5e67923bcc400ff2169e8b7a7.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2728
-
C:\Windows\Syswow64\d12b7e70C:\Windows\Syswow64\d12b7e701⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1648
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\d12b7e70
- Size 419KB
- SHA256 4ac0e12c9299969ffc0ef3d07595e47540fa8a2b5253fe4f5a201a2b3bf80dac
- MD5 4fda080b4cac431486fc368073195388
- SHA1 c6d2f0a15d2888bddd903c60e5cbe94624a0b1bf
- SHA512 f4943111e1e64b793bcdae1eff4994dd33a9e5d1abf290f8f1d6d37325812a72a84229b0670d633ececcc41f41cb1fa0dd5d20af113acfd7bc7b72b97fc52a91
- SSDEEP 6144:66DmGnV0H2LALrYcdwVDL+gqFCcEOkCybEaQRXr9HNdvOa:66D/WiA3YcyVDLjOkx2LIa
- TLSH T1B1947C29BAE08073C5678576C4E257A6FBB1B52127108ACFA390475A1F237E3BD3531E
- MD5 SHA1 SHA512 SSDEEP TLSH