Analysis
- max time kernel
149s - max time network
154s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
24/04/2026, 22:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d53038ceb2800cd1b7ab2e0ceb8ee0462cc0bfc5b9680242c99f2bbb60dfb4c7.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
d53038ceb2800cd1b7ab2e0ceb8ee0462cc0bfc5b9680242c99f2bbb60dfb4c7.exe
Resource
win11-20260130-en
windows11-21h2-x64
9 signatures
150 seconds
General
- Target d53038ceb2800cd1b7ab2e0ceb8ee0462cc0bfc5b9680242c99f2bbb60dfb4c7.exe
- Size 395KB
- Sample260424-2w382aez2m
- SHA256 d53038ceb2800cd1b7ab2e0ceb8ee0462cc0bfc5b9680242c99f2bbb60dfb4c7
- MD5 26843bb1f013bb7e9fe2962bbf2ec75a
- SHA1 b1ef671d58ce09bc035c43b9985827cb9abfb91b
- SHA512 198f12fc312e45541f06a5f8b14fc0c17c2cc5f6feb1ef4ec770b1e58f8c124b65179ff357ac9231a6ffc3c129d9cb4555aeae126bea69e7d900e0d049b93e1b
- SSDEEP 6144:RwdK91cVMoSTZu05LOY0ftLy+mgFScEOkCybEaQRXr9HNdvOaxy8K:Rn9OVKk05aY0ftLy+MOkx2LIaxy
- TLSH T1F0846D2AF6A0D076C4B79578C49257A6FBB1742137204ACFA390475A1F637E2BE3630D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4220 a46053c2 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 1 114.114.114.114 1720 d53038ceb2800cd1b7ab2e0ceb8ee0462cc0bfc5b9680242c99f2bbb60dfb4c7.exe Destination IP 2 223.5.5.5 1720 d53038ceb2800cd1b7ab2e0ceb8ee0462cc0bfc5b9680242c99f2bbb60dfb4c7.exe Destination IP 22 114.114.114.114 1720 d53038ceb2800cd1b7ab2e0ceb8ee0462cc0bfc5b9680242c99f2bbb60dfb4c7.exe Destination IP 23 223.5.5.5 1720 d53038ceb2800cd1b7ab2e0ceb8ee0462cc0bfc5b9680242c99f2bbb60dfb4c7.exe - Drops file in System32 directory 17 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 a46053c2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft a46053c2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache a46053c2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content a46053c2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AAD646CB44373074ADE741C38400E7E1 a46053c2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 a46053c2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 a46053c2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 a46053c2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 a46053c2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE a46053c2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies a46053c2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData a46053c2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 a46053c2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 a46053c2 File created C:\Windows\SysWOW64\a46053c2 d53038ceb2800cd1b7ab2e0ceb8ee0462cc0bfc5b9680242c99f2bbb60dfb4c7.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AAD646CB44373074ADE741C38400E7E1 a46053c2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 a46053c2 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\483f78 a46053c2 File opened for modification C:\Windows\1d7270 d53038ceb2800cd1b7ab2e0ceb8ee0462cc0bfc5b9680242c99f2bbb60dfb4c7.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d53038ceb2800cd1b7ab2e0ceb8ee0462cc0bfc5b9680242c99f2bbb60dfb4c7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a46053c2 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" a46053c2 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ a46053c2 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" a46053c2 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing a46053c2 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix a46053c2 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" a46053c2 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" a46053c2 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" a46053c2 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" a46053c2 - Modifies system certificate store 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1F24C630CDA418EF2069FFAD4FDD5F463A1B69AA a46053c2 Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1F24C630CDA418EF2069FFAD4FDD5F463A1B69AA\Blob = 5c000000010000000400000080010000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003800000047006c006f00620061006c005300690067006e002000450043004300200052006f006f00740020004300410020002d002000520035000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308620000000100000020000000179fbc148a3dd00fd24ea13458cc43bfa7f59c8182d783a513f6ebec100c89241400000001000000140000003de629489bea07ca21444a26de6eded283d09f591d0000000100000010000000b647dd2a9ccadee75e8905e256cc6b147f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d7010300000001000000140000001f24c630cda418ef2069ffad4fdd5f463a1b69aa2000000001000000220200003082021e308201a4a0030201020211605949e0262ebb55f90a778a71f94ad86c300a06082a8648ce3d040303305031243022060355040b131b476c6f62616c5369676e2045434320526f6f74204341202d20523531133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3132313131333030303030305a170d3338303131393033313430375a305031243022060355040b131b476c6f62616c5369676e2045434320526f6f74204341202d20523531133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e3076301006072a8648ce3d020106052b810400220362000447450e96fb7d5dbfe939d121f89f0bb6d57b1e923a48591cf062312dc07a28fe1aa75cb3b6cc97e745d458fad1776d43a2c08765340a1f7addeb3c33a1c59d4da46f4195387fc91e84ebd19e49928794870c3a854a669f9d59934d976106864aa3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604143de629489bea07ca21444a26de6eded283d09f59300a06082a8648ce3d0403030368003065023100e56912c96edbc631ba0941e197f8fbfd9ae27d12c9ed7c64d3cb05258b56d9a0e75e5d4e0b839c5b7629a00926216a62023071d2b58f5cea3be1780985a875923bc85cfd48ef0d7422a808e26ec549cec70cbca76169f1f73be12acbf92bf3669037 a46053c2 - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 4220 a46053c2 4220 a46053c2 4220 a46053c2 4220 a46053c2 4220 a46053c2 4220 a46053c2 4220 a46053c2 4220 a46053c2 4220 a46053c2 4220 a46053c2 4220 a46053c2 4220 a46053c2 1720 d53038ceb2800cd1b7ab2e0ceb8ee0462cc0bfc5b9680242c99f2bbb60dfb4c7.exe 1720 d53038ceb2800cd1b7ab2e0ceb8ee0462cc0bfc5b9680242c99f2bbb60dfb4c7.exe 1720 d53038ceb2800cd1b7ab2e0ceb8ee0462cc0bfc5b9680242c99f2bbb60dfb4c7.exe 1720 d53038ceb2800cd1b7ab2e0ceb8ee0462cc0bfc5b9680242c99f2bbb60dfb4c7.exe 1720 d53038ceb2800cd1b7ab2e0ceb8ee0462cc0bfc5b9680242c99f2bbb60dfb4c7.exe 1720 d53038ceb2800cd1b7ab2e0ceb8ee0462cc0bfc5b9680242c99f2bbb60dfb4c7.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1720 d53038ceb2800cd1b7ab2e0ceb8ee0462cc0bfc5b9680242c99f2bbb60dfb4c7.exe Token: SeTcbPrivilege 1720 d53038ceb2800cd1b7ab2e0ceb8ee0462cc0bfc5b9680242c99f2bbb60dfb4c7.exe Token: SeDebugPrivilege 4220 a46053c2 Token: SeTcbPrivilege 4220 a46053c2
Processes
-
C:\Users\Admin\AppData\Local\Temp\d53038ceb2800cd1b7ab2e0ceb8ee0462cc0bfc5b9680242c99f2bbb60dfb4c7.exe"C:\Users\Admin\AppData\Local\Temp\d53038ceb2800cd1b7ab2e0ceb8ee0462cc0bfc5b9680242c99f2bbb60dfb4c7.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1720
-
C:\Windows\Syswow64\a46053c2C:\Windows\Syswow64\a46053c21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4220
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\483f78
- Size 506B
- SHA256 65655ed0db56809c931013090778e11401c907e59c0e274e6887ab67ce9e3f77
- MD5 1508fe177a8824c9633fbe25f26432c4
- SHA1 893caa47e8a7872f6887a5e5b89ef00f73341bdd
- SHA512 3e23391cc31017d2df8b5ed9f5add0b09ff025cd4df9a7702a4746ed459ff1256b224c25ac7884cd91b5c3a5ba98dd144eee98ba2319724f9aaea53d198a1b8d
- TLSH T121F005B66B0326F20DFE64735E077C456901B3261D3B75B63FD3314401D2B511941744
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\a46053c2
- Size 395KB
- SHA256 40b4d7da4353535649b8f6ffd71059562c2cd14d02ffb9620789a9e7fb34b2a8
- MD5 9c517e7bb87017c2ef0c3fe3b83a55f6
- SHA1 3468047cde5ab0f55f1e8d6a45393e3bc73078d2
- SHA512 92e0d39a8cbf6c4f317f715adade561ac7005f3f2d2277f49d4fadb89edffd71a4ea2412792008126bad78af91195d7d60764f75ec3e1458e5a0aa2968c2e07f
- SSDEEP 6144:FwdK91cVMoSTZu05LOY0ftLy+mgFScEOkCybEaQRXr9HNdvOaxy8K:Fn9OVKk05aY0ftLy+MOkx2LIaxy
- TLSH T177846D2AF6A0D076C4B79578C49257A6FBB1742137204ACFA390475A1F637E2BE3630D
- MD5 SHA1 SHA512 SSDEEP TLSH