Analysis
- max time kernel
149s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/04/2026, 21:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c1ce2011242ec9e694af77c7c9019aa4e9eb3d31b5e2fdfcc9c1ad3a6aaa4687.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
c1ce2011242ec9e694af77c7c9019aa4e9eb3d31b5e2fdfcc9c1ad3a6aaa4687.exe
Resource
win11-20260130-en
windows11-21h2-x64
8 signatures
150 seconds
General
- Target c1ce2011242ec9e694af77c7c9019aa4e9eb3d31b5e2fdfcc9c1ad3a6aaa4687.exe
- Size 419KB
- Sample260424-1d2f2sds2n
- SHA256 c1ce2011242ec9e694af77c7c9019aa4e9eb3d31b5e2fdfcc9c1ad3a6aaa4687
- MD5 5d568a5b6ee5b8ec47a7591985aca585
- SHA1 842c8ef2cacf6232008ea6ca7aeb3d9c636ad61a
- SHA512 a246ba82ae5644fa5b9d0d3b4ef2257c17df48c9992d933d5798bf798faee8b13598ea745fe0c1ef654a59ef60a12445c593ec884d84fe06cecf1b18d410786e
- SSDEEP 6144:H8a+AjLd9fSZLC/umZjqDvjZFXcEOkCybEaQRXr9HNdvOa:ca+4EZe/uwqDvDOkx2LIa
- TLSH T119948D19FAA08036C5A38575C4A257A7FBB1752137209ACFA3A057561F237E3BD3630E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3460 88aac3e7 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 3 114.114.114.114 3380 c1ce2011242ec9e694af77c7c9019aa4e9eb3d31b5e2fdfcc9c1ad3a6aaa4687.exe Destination IP 4 223.5.5.5 3380 c1ce2011242ec9e694af77c7c9019aa4e9eb3d31b5e2fdfcc9c1ad3a6aaa4687.exe Destination IP 17 114.114.114.114 3380 c1ce2011242ec9e694af77c7c9019aa4e9eb3d31b5e2fdfcc9c1ad3a6aaa4687.exe Destination IP 18 223.5.5.5 3380 c1ce2011242ec9e694af77c7c9019aa4e9eb3d31b5e2fdfcc9c1ad3a6aaa4687.exe - Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\88aac3e7 c1ce2011242ec9e694af77c7c9019aa4e9eb3d31b5e2fdfcc9c1ad3a6aaa4687.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 88aac3e7 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 88aac3e7 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 88aac3e7 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 88aac3e7 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\3b3c88 88aac3e7 File opened for modification C:\Windows\39dde8 c1ce2011242ec9e694af77c7c9019aa4e9eb3d31b5e2fdfcc9c1ad3a6aaa4687.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c1ce2011242ec9e694af77c7c9019aa4e9eb3d31b5e2fdfcc9c1ad3a6aaa4687.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88aac3e7 - Modifies data under HKEY_USERS 8 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 88aac3e7 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 88aac3e7 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 88aac3e7 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 88aac3e7 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 88aac3e7 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 88aac3e7 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 88aac3e7 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 88aac3e7 - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 3460 88aac3e7 3460 88aac3e7 3460 88aac3e7 3460 88aac3e7 3460 88aac3e7 3460 88aac3e7 3460 88aac3e7 3460 88aac3e7 3460 88aac3e7 3460 88aac3e7 3460 88aac3e7 3460 88aac3e7 3380 c1ce2011242ec9e694af77c7c9019aa4e9eb3d31b5e2fdfcc9c1ad3a6aaa4687.exe 3380 c1ce2011242ec9e694af77c7c9019aa4e9eb3d31b5e2fdfcc9c1ad3a6aaa4687.exe 3380 c1ce2011242ec9e694af77c7c9019aa4e9eb3d31b5e2fdfcc9c1ad3a6aaa4687.exe 3380 c1ce2011242ec9e694af77c7c9019aa4e9eb3d31b5e2fdfcc9c1ad3a6aaa4687.exe 3380 c1ce2011242ec9e694af77c7c9019aa4e9eb3d31b5e2fdfcc9c1ad3a6aaa4687.exe 3380 c1ce2011242ec9e694af77c7c9019aa4e9eb3d31b5e2fdfcc9c1ad3a6aaa4687.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3380 c1ce2011242ec9e694af77c7c9019aa4e9eb3d31b5e2fdfcc9c1ad3a6aaa4687.exe Token: SeTcbPrivilege 3380 c1ce2011242ec9e694af77c7c9019aa4e9eb3d31b5e2fdfcc9c1ad3a6aaa4687.exe Token: SeDebugPrivilege 3460 88aac3e7 Token: SeTcbPrivilege 3460 88aac3e7
Processes
-
C:\Users\Admin\AppData\Local\Temp\c1ce2011242ec9e694af77c7c9019aa4e9eb3d31b5e2fdfcc9c1ad3a6aaa4687.exe"C:\Users\Admin\AppData\Local\Temp\c1ce2011242ec9e694af77c7c9019aa4e9eb3d31b5e2fdfcc9c1ad3a6aaa4687.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3380
-
C:\Windows\Syswow64\88aac3e7C:\Windows\Syswow64\88aac3e71⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3460
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\88aac3e7
- Size 419KB
- SHA256 eb268fdc0e3d0e1d46c3802a6ca902d89403b7038d68f621e01ce24f2e737fb3
- MD5 60df7ffcc6ef596b87ac531745c64ba0
- SHA1 e4b629c8efe169628fde1eaa160e267e6c5a738e
- SHA512 05c93688720bb402868d4ac5b75094bbe5f2d534b37ef6bd16d9d3813b98923456b10ecbb48580cb95b20d3dcb2867662a144235938a288e0fc8f5f005cbf527
- SSDEEP 6144:U8a+AjLd9fSZLC/umZjqDvjZFXcEOkCybEaQRXr9HNdvOa:5a+4EZe/uwqDvDOkx2LIa
- TLSH T1BB948D19FAA08036C5A38575C4A257A7FBB1752137209ACFA3A057561F237E3BD3630E
- MD5 SHA1 SHA512 SSDEEP TLSH