Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
26/04/2026, 02:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0ea27e9ded34a3b7844ee85e6547ec8763794fe91da40af23dbe22d1a42cd693.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
0ea27e9ded34a3b7844ee85e6547ec8763794fe91da40af23dbe22d1a42cd693.exe
Resource
win11-20260130-en
windows11-21h2-x64
8 signatures
150 seconds
General
- Target 0ea27e9ded34a3b7844ee85e6547ec8763794fe91da40af23dbe22d1a42cd693.exe
- Size 395KB
- Sample260426-cs9h7set2r
- SHA256 0ea27e9ded34a3b7844ee85e6547ec8763794fe91da40af23dbe22d1a42cd693
- MD5 99af24d874526708c7b2c9d56ec1051d
- SHA1 779d1f5db7dfd4f13ee89a098b6cd83cc63df477
- SHA512 bd3c446833e345a4c822817bb47a30397555bc912b0687044c123144660bc00625cf1fc6d58757a20e694c8c8fec250e858a1334cb6f246f4957b1ea6aa6c40f
- SSDEEP 6144:rQtK91cOo9qoiTpppLeIUfdLyO2QFicEOkCybEaQRXr9HNdvOaxy8K:r39OFaPpKIUfdLyO8Okx2LIaxy
- TLSH T1E0847D2AB7A0D076C4B79579C49247AAFEB1B42137204ACFA390475A1F237E2BD3570D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4816 89189444 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 4 114.114.114.114 4716 0ea27e9ded34a3b7844ee85e6547ec8763794fe91da40af23dbe22d1a42cd693.exe Destination IP 6 223.5.5.5 4716 0ea27e9ded34a3b7844ee85e6547ec8763794fe91da40af23dbe22d1a42cd693.exe Destination IP 34 114.114.114.114 4716 0ea27e9ded34a3b7844ee85e6547ec8763794fe91da40af23dbe22d1a42cd693.exe Destination IP 35 223.5.5.5 4716 0ea27e9ded34a3b7844ee85e6547ec8763794fe91da40af23dbe22d1a42cd693.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 89189444 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 89189444 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 89189444 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 89189444 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 89189444 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 89189444 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 89189444 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 89189444 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 89189444 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 89189444 File created C:\Windows\SysWOW64\89189444 0ea27e9ded34a3b7844ee85e6547ec8763794fe91da40af23dbe22d1a42cd693.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 89189444 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 89189444 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\5273a0 89189444 File opened for modification C:\Windows\50bd58 0ea27e9ded34a3b7844ee85e6547ec8763794fe91da40af23dbe22d1a42cd693.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0ea27e9ded34a3b7844ee85e6547ec8763794fe91da40af23dbe22d1a42cd693.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 89189444 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 89189444 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 89189444 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 89189444 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 89189444 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 89189444 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 89189444 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 89189444 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 89189444 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 89189444 - Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 4816 89189444 4816 89189444 4816 89189444 4816 89189444 4816 89189444 4816 89189444 4816 89189444 4816 89189444 4816 89189444 4816 89189444 4816 89189444 4816 89189444 4816 89189444 4816 89189444 4816 89189444 4816 89189444 4816 89189444 4816 89189444 4816 89189444 4816 89189444 4716 0ea27e9ded34a3b7844ee85e6547ec8763794fe91da40af23dbe22d1a42cd693.exe 4716 0ea27e9ded34a3b7844ee85e6547ec8763794fe91da40af23dbe22d1a42cd693.exe 4716 0ea27e9ded34a3b7844ee85e6547ec8763794fe91da40af23dbe22d1a42cd693.exe 4716 0ea27e9ded34a3b7844ee85e6547ec8763794fe91da40af23dbe22d1a42cd693.exe 4716 0ea27e9ded34a3b7844ee85e6547ec8763794fe91da40af23dbe22d1a42cd693.exe 4716 0ea27e9ded34a3b7844ee85e6547ec8763794fe91da40af23dbe22d1a42cd693.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4716 0ea27e9ded34a3b7844ee85e6547ec8763794fe91da40af23dbe22d1a42cd693.exe Token: SeTcbPrivilege 4716 0ea27e9ded34a3b7844ee85e6547ec8763794fe91da40af23dbe22d1a42cd693.exe Token: SeDebugPrivilege 4816 89189444 Token: SeTcbPrivilege 4816 89189444
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ea27e9ded34a3b7844ee85e6547ec8763794fe91da40af23dbe22d1a42cd693.exe"C:\Users\Admin\AppData\Local\Temp\0ea27e9ded34a3b7844ee85e6547ec8763794fe91da40af23dbe22d1a42cd693.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4716
-
C:\Windows\Syswow64\89189444C:\Windows\Syswow64\891894441⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4816
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\89189444
- Size 395KB
- SHA256 79adcaa6c3c8ea93742260af5b801db3d09931e8e07c868f1d5d5e71187321a0
- MD5 da21b490be9244822848a2e11bc3fa53
- SHA1 b741f2e41ac6c560e9028b626d1fd917cf3ca480
- SHA512 9846cd4d00a1146d7f832b4a359e1b6564cfe2364cc3ab9fa052390c83c59ded2f04a4ff084d47161f81c717b0f9c17bc78e310f551860bbda5c5ba80f353212
- SSDEEP 6144:aQtK91cOo9qoiTpppLeIUfdLyO2QFicEOkCybEaQRXr9HNdvOaxy8K:a39OFaPpKIUfdLyO8Okx2LIaxy
- TLSH T1BB847D2AB7A0D076C4B79579C49247AAFEB1B42137204ACFA390475A1F237E2BD3570D
- MD5 SHA1 SHA512 SSDEEP TLSH