Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/04/2026, 22:23
Behavioral task
behavioral1
Sample
3dfe2af7a29ec4e7d162904bdabc0b4cf07e06392611740479d3b35051234063.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 3dfe2af7a29ec4e7d162904bdabc0b4cf07e06392611740479d3b35051234063.exe
- Size 271KB
- Sample260424-2axt5aes6l
- SHA256 3dfe2af7a29ec4e7d162904bdabc0b4cf07e06392611740479d3b35051234063
- MD5 9905e1a207c255733bca0cf1442c97ad
- SHA1 dbf7967336983fcedb127a45b7daed4978b82e96
- SHA512 563dd9827054ae2d2bf5441b56d9e4e0840a6a06d00e01a5c8148e885cf27dc4e343e16feb93d86dd31b0a978897bd86bc6dd9235022688ca9165712099df13c
- SSDEEP 6144:2l51orRJXlDixHkUXe35rGcEOkCybEaQRXr9HNdvOa:+qXUHkUXe39sOkx2LIa
- TLSH T10D44CF5BF27440B6C49AD678C9935A5AFBF1B815872143CF1320C25A1F737E2AE3A325
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4148 540faa49 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 4 223.5.5.5 3800 3dfe2af7a29ec4e7d162904bdabc0b4cf07e06392611740479d3b35051234063.exe Destination IP 20 114.114.114.114 3800 3dfe2af7a29ec4e7d162904bdabc0b4cf07e06392611740479d3b35051234063.exe Destination IP 22 223.5.5.5 3800 3dfe2af7a29ec4e7d162904bdabc0b4cf07e06392611740479d3b35051234063.exe Destination IP 3 114.114.114.114 3800 3dfe2af7a29ec4e7d162904bdabc0b4cf07e06392611740479d3b35051234063.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 540faa49 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 540faa49 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 540faa49 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 540faa49 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 540faa49 File created C:\Windows\SysWOW64\540faa49 3dfe2af7a29ec4e7d162904bdabc0b4cf07e06392611740479d3b35051234063.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 540faa49 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 540faa49 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 540faa49 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 540faa49 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 540faa49 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 540faa49 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 540faa49 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 540faa49 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 540faa49 -
resource yara_rule behavioral1/memory/3800-0-0x0000000000580000-0x0000000000609000-memory.dmp upx behavioral1/files/0x000800000002448b-2.dat upx behavioral1/memory/4148-4-0x0000000000880000-0x0000000000909000-memory.dmp upx behavioral1/memory/3800-10-0x0000000000580000-0x0000000000609000-memory.dmp upx behavioral1/memory/4148-12-0x0000000000880000-0x0000000000909000-memory.dmp upx behavioral1/memory/3800-24-0x0000000000580000-0x0000000000609000-memory.dmp upx behavioral1/memory/4148-26-0x0000000000880000-0x0000000000909000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\4703e8 540faa49 File opened for modification C:\Windows\410eb0 3dfe2af7a29ec4e7d162904bdabc0b4cf07e06392611740479d3b35051234063.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dfe2af7a29ec4e7d162904bdabc0b4cf07e06392611740479d3b35051234063.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 540faa49 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 540faa49 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 540faa49 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 540faa49 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 540faa49 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 540faa49 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 540faa49 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 540faa49 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 540faa49 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 540faa49 - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 4148 540faa49 4148 540faa49 4148 540faa49 4148 540faa49 4148 540faa49 4148 540faa49 4148 540faa49 4148 540faa49 3800 3dfe2af7a29ec4e7d162904bdabc0b4cf07e06392611740479d3b35051234063.exe 3800 3dfe2af7a29ec4e7d162904bdabc0b4cf07e06392611740479d3b35051234063.exe 3800 3dfe2af7a29ec4e7d162904bdabc0b4cf07e06392611740479d3b35051234063.exe 3800 3dfe2af7a29ec4e7d162904bdabc0b4cf07e06392611740479d3b35051234063.exe 3800 3dfe2af7a29ec4e7d162904bdabc0b4cf07e06392611740479d3b35051234063.exe 3800 3dfe2af7a29ec4e7d162904bdabc0b4cf07e06392611740479d3b35051234063.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3800 3dfe2af7a29ec4e7d162904bdabc0b4cf07e06392611740479d3b35051234063.exe Token: SeTcbPrivilege 3800 3dfe2af7a29ec4e7d162904bdabc0b4cf07e06392611740479d3b35051234063.exe Token: SeDebugPrivilege 4148 540faa49 Token: SeTcbPrivilege 4148 540faa49
Processes
-
C:\Users\Admin\AppData\Local\Temp\3dfe2af7a29ec4e7d162904bdabc0b4cf07e06392611740479d3b35051234063.exe"C:\Users\Admin\AppData\Local\Temp\3dfe2af7a29ec4e7d162904bdabc0b4cf07e06392611740479d3b35051234063.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3800
-
C:\Windows\Syswow64\540faa49C:\Windows\Syswow64\540faa491⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4148
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\540faa49
- Size 271KB
- SHA256 8e65cc832382a0a6d4d3d65d0fa0d8d601e342b6249f5ba79b54611a9a5aadf1
- MD5 0de3c53b2d628412c0ecea2cea53e8e4
- SHA1 b392e43b9a280e7db54d330f8db1eab2622cb36f
- SHA512 1af8c183566561ebe99659c9beba379a9b6b8716135bf61b03cc5bfbe8bc563cf92f2ea551cac209ac149228bfa62028d66e6c6411aaf0144107af3b4269671c
- SSDEEP 6144:3l51orRJXlDixHkUXe35rGcEOkCybEaQRXr9HNdvOa:ZqXUHkUXe39sOkx2LIa
- TLSH T1F244CF5BF27440B6C49AD678C9935A5AFBF1B815872143CF1320C25A1F737E2AE3A325
- MD5 SHA1 SHA512 SSDEEP TLSH