Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
22/04/2026, 21:56
Behavioral task
behavioral1
Sample
8be05e222cfa10eb664dad759191bf10abe42397795c4f3491d329a2f618bc94.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 8be05e222cfa10eb664dad759191bf10abe42397795c4f3491d329a2f618bc94.exe
- Size 271KB
- Sample260422-1trlsae15l
- SHA256 8be05e222cfa10eb664dad759191bf10abe42397795c4f3491d329a2f618bc94
- MD5 7fff60552a8b341d118aa940ddbedb43
- SHA1 ca9d7e9b05756a05b9520ed3ab9ca48f7f40becd
- SHA512 0cfea3cad945fc72c41bb05ad68d6d8888ad45c143d3ba8871e2d80f2893c41caa9a8cc771911c20ed14a1fdbe3f673c9f0d4cbe39852d85fafe7236f868b744
- SSDEEP 6144:cl51orRJXlDixHkUXe35rGcEOkCybEaQRXr9HNdvOa:AqXUHkUXe39sOkx2LIa
- TLSH T11F44CF5BF27440B6C49AD678C9935A5AFBF1B815872143CF1320C25A1F737E2AE3A325
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 920 c7ea9672 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 1 114.114.114.114 3852 8be05e222cfa10eb664dad759191bf10abe42397795c4f3491d329a2f618bc94.exe Destination IP 2 223.5.5.5 3852 8be05e222cfa10eb664dad759191bf10abe42397795c4f3491d329a2f618bc94.exe Destination IP 24 114.114.114.114 3852 8be05e222cfa10eb664dad759191bf10abe42397795c4f3491d329a2f618bc94.exe Destination IP 25 223.5.5.5 3852 8be05e222cfa10eb664dad759191bf10abe42397795c4f3491d329a2f618bc94.exe - Drops file in System32 directory 15 IoCs
description ioc Process File created C:\Windows\SysWOW64\c7ea9672 8be05e222cfa10eb664dad759191bf10abe42397795c4f3491d329a2f618bc94.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft c7ea9672 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content c7ea9672 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 c7ea9672 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache c7ea9672 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData c7ea9672 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 c7ea9672 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 c7ea9672 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 c7ea9672 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 c7ea9672 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 c7ea9672 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE c7ea9672 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies c7ea9672 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 c7ea9672 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 c7ea9672 -
resource yara_rule behavioral2/memory/3852-0-0x0000000000CD0000-0x0000000000D59000-memory.dmp upx behavioral2/files/0x001a00000002b331-2.dat upx behavioral2/memory/920-3-0x0000000000630000-0x00000000006B9000-memory.dmp upx behavioral2/memory/3852-18-0x0000000000CD0000-0x0000000000D59000-memory.dmp upx behavioral2/memory/920-20-0x0000000000630000-0x00000000006B9000-memory.dmp upx behavioral2/memory/920-24-0x0000000000630000-0x00000000006B9000-memory.dmp upx behavioral2/memory/3852-35-0x0000000000CD0000-0x0000000000D59000-memory.dmp upx behavioral2/memory/920-36-0x0000000000630000-0x00000000006B9000-memory.dmp upx behavioral2/memory/920-40-0x0000000000630000-0x00000000006B9000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\fc030 c7ea9672 File opened for modification C:\Windows\41f298 8be05e222cfa10eb664dad759191bf10abe42397795c4f3491d329a2f618bc94.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8be05e222cfa10eb664dad759191bf10abe42397795c4f3491d329a2f618bc94.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c7ea9672 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" c7ea9672 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing c7ea9672 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" c7ea9672 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" c7ea9672 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" c7ea9672 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" c7ea9672 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix c7ea9672 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" c7ea9672 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ c7ea9672 - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 920 c7ea9672 920 c7ea9672 920 c7ea9672 920 c7ea9672 920 c7ea9672 920 c7ea9672 920 c7ea9672 920 c7ea9672 3852 8be05e222cfa10eb664dad759191bf10abe42397795c4f3491d329a2f618bc94.exe 3852 8be05e222cfa10eb664dad759191bf10abe42397795c4f3491d329a2f618bc94.exe 3852 8be05e222cfa10eb664dad759191bf10abe42397795c4f3491d329a2f618bc94.exe 3852 8be05e222cfa10eb664dad759191bf10abe42397795c4f3491d329a2f618bc94.exe 3852 8be05e222cfa10eb664dad759191bf10abe42397795c4f3491d329a2f618bc94.exe 3852 8be05e222cfa10eb664dad759191bf10abe42397795c4f3491d329a2f618bc94.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3852 8be05e222cfa10eb664dad759191bf10abe42397795c4f3491d329a2f618bc94.exe Token: SeTcbPrivilege 3852 8be05e222cfa10eb664dad759191bf10abe42397795c4f3491d329a2f618bc94.exe Token: SeDebugPrivilege 920 c7ea9672 Token: SeTcbPrivilege 920 c7ea9672
Processes
-
C:\Users\Admin\AppData\Local\Temp\8be05e222cfa10eb664dad759191bf10abe42397795c4f3491d329a2f618bc94.exe"C:\Users\Admin\AppData\Local\Temp\8be05e222cfa10eb664dad759191bf10abe42397795c4f3491d329a2f618bc94.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3852
-
C:\Windows\Syswow64\c7ea9672C:\Windows\Syswow64\c7ea96721⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:920
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\c7ea9672
- Size 271KB
- SHA256 c5bbeb3993f4fd45fdff92e85608e3ec94f4bd0fa74d95d24fffb1dad1a2c9b3
- MD5 3f0bb83e3d51e987aeb3edf195f362e7
- SHA1 97cbff948c23d40015412d7bdd32fc3b8bb46b05
- SHA512 76875f861edd3edbd40cdfd8e104d8a81c7081d1c7808ad754fe49a793c2cd98ff7b8ae975431fd6873c028d35f592353b8c16623addcddc76db77a6ba160b49
- SSDEEP 6144:nl51orRJXlDixHkUXe35rGcEOkCybEaQRXr9HNdvOa:JqXUHkUXe39sOkx2LIa
- TLSH T1B244CF5BF27440B6C49AD678C9935A5AFBF1B815872143CF1320C25A1F737E2AE3A325
- MD5 SHA1 SHA512 SSDEEP TLSH