Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
26/04/2026, 22:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0d9fb424ef324fcf840915ca9adebbbb4fdb70be2cbda74389f018db1f6c79c6.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
0d9fb424ef324fcf840915ca9adebbbb4fdb70be2cbda74389f018db1f6c79c6.exe
Resource
win11-20260130-en
windows11-21h2-x64
8 signatures
150 seconds
General
- Target 0d9fb424ef324fcf840915ca9adebbbb4fdb70be2cbda74389f018db1f6c79c6.exe
- Size 896KB
- Sample260426-2mfflsbz2r
- SHA256 0d9fb424ef324fcf840915ca9adebbbb4fdb70be2cbda74389f018db1f6c79c6
- MD5 6659558630e419b4c5bb57b2839f57cf
- SHA1 6d2c9a8d3693a13aee7ecd01799bbb5fea5e3cc1
- SHA512 7d757d244416def6ea2d16d61a32f237815ad8588d2c73a691909361489855828327445148735228bd8894e22759b6e0ea7d27a8e194b14f5d8b1ad2d88a5eca
- SSDEEP 12288:NSvO2x9mONvKRILSFnOkx2LIaxya5FAQjU/Lik8CQ3uEuYyybAsLAk1:MvO2xJKRI2FOkx2LFEvcUQPxu6Es8k1
- TLSH T16E157C31E641C03AD4A7457686BA0BBFA5787D22131565C7E3D43E662FB32D2BA3130E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3512 1d2d2300 - Unexpected DNS network traffic destination 6 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 28 114.114.114.114 4124 0d9fb424ef324fcf840915ca9adebbbb4fdb70be2cbda74389f018db1f6c79c6.exe Destination IP 31 223.5.5.5 4124 0d9fb424ef324fcf840915ca9adebbbb4fdb70be2cbda74389f018db1f6c79c6.exe Destination IP 100 114.114.114.114 4124 0d9fb424ef324fcf840915ca9adebbbb4fdb70be2cbda74389f018db1f6c79c6.exe Destination IP 101 223.5.5.5 4124 0d9fb424ef324fcf840915ca9adebbbb4fdb70be2cbda74389f018db1f6c79c6.exe Destination IP 3 114.114.114.114 4124 0d9fb424ef324fcf840915ca9adebbbb4fdb70be2cbda74389f018db1f6c79c6.exe Destination IP 5 223.5.5.5 4124 0d9fb424ef324fcf840915ca9adebbbb4fdb70be2cbda74389f018db1f6c79c6.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 1d2d2300 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 1d2d2300 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 1d2d2300 File created C:\Windows\SysWOW64\1d2d2300 0d9fb424ef324fcf840915ca9adebbbb4fdb70be2cbda74389f018db1f6c79c6.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 1d2d2300 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 1d2d2300 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 1d2d2300 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 1d2d2300 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 1d2d2300 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 1d2d2300 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 1d2d2300 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 1d2d2300 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 1d2d2300 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\3c2070 1d2d2300 File opened for modification C:\Windows\469ab8 0d9fb424ef324fcf840915ca9adebbbb4fdb70be2cbda74389f018db1f6c79c6.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0d9fb424ef324fcf840915ca9adebbbb4fdb70be2cbda74389f018db1f6c79c6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1d2d2300 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 1d2d2300 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 1d2d2300 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 1d2d2300 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 1d2d2300 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 1d2d2300 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 1d2d2300 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 1d2d2300 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 1d2d2300 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 1d2d2300 - Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 3512 1d2d2300 3512 1d2d2300 3512 1d2d2300 3512 1d2d2300 3512 1d2d2300 3512 1d2d2300 3512 1d2d2300 3512 1d2d2300 3512 1d2d2300 3512 1d2d2300 3512 1d2d2300 3512 1d2d2300 3512 1d2d2300 3512 1d2d2300 3512 1d2d2300 3512 1d2d2300 3512 1d2d2300 3512 1d2d2300 3512 1d2d2300 3512 1d2d2300 4124 0d9fb424ef324fcf840915ca9adebbbb4fdb70be2cbda74389f018db1f6c79c6.exe 4124 0d9fb424ef324fcf840915ca9adebbbb4fdb70be2cbda74389f018db1f6c79c6.exe 4124 0d9fb424ef324fcf840915ca9adebbbb4fdb70be2cbda74389f018db1f6c79c6.exe 4124 0d9fb424ef324fcf840915ca9adebbbb4fdb70be2cbda74389f018db1f6c79c6.exe 4124 0d9fb424ef324fcf840915ca9adebbbb4fdb70be2cbda74389f018db1f6c79c6.exe 4124 0d9fb424ef324fcf840915ca9adebbbb4fdb70be2cbda74389f018db1f6c79c6.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4124 0d9fb424ef324fcf840915ca9adebbbb4fdb70be2cbda74389f018db1f6c79c6.exe Token: SeTcbPrivilege 4124 0d9fb424ef324fcf840915ca9adebbbb4fdb70be2cbda74389f018db1f6c79c6.exe Token: SeDebugPrivilege 3512 1d2d2300 Token: SeTcbPrivilege 3512 1d2d2300
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d9fb424ef324fcf840915ca9adebbbb4fdb70be2cbda74389f018db1f6c79c6.exe"C:\Users\Admin\AppData\Local\Temp\0d9fb424ef324fcf840915ca9adebbbb4fdb70be2cbda74389f018db1f6c79c6.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4124
-
C:\Windows\Syswow64\1d2d2300C:\Windows\Syswow64\1d2d23001⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3512
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\1d2d2300
- Size 896KB
- SHA256 f152c8da4439b6663cf58134e2d1c5221dd7638c60a45fe4244515ddf1861ad2
- MD5 3b2719ce037efb9cc94f84ea78c00da6
- SHA1 fea43d0fdfe68e9251e5afa6251fdd2ac8120ab4
- SHA512 540fabf3617e32456da760ef2799af4c4f7183f92f6c45356896fd81fbc083386e41671b8954dda48cc53b1f13928fbd25db60c76ee28263520ebdac78a17e70
- SSDEEP 12288:5SvO2x9mONvKRILSFnOkx2LIaxya5FAQjU/Lik8CQ3uEuYyybAsLAk1:AvO2xJKRI2FOkx2LFEvcUQPxu6Es8k1
- TLSH T11F157C31E641C03AD4A7457686BA0BBFA5787D22131565C7E3D43E662FB32D2BA3130E
- MD5 SHA1 SHA512 SSDEEP TLSH