Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
26/04/2026, 08:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
eec343b3fc0af26e88eae09c4c9605c63d320b06650ef04ea34abf7f2b2cb9ea.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
eec343b3fc0af26e88eae09c4c9605c63d320b06650ef04ea34abf7f2b2cb9ea.exe
Resource
win11-20260130-en
windows11-21h2-x64
8 signatures
150 seconds
General
- Target eec343b3fc0af26e88eae09c4c9605c63d320b06650ef04ea34abf7f2b2cb9ea.exe
- Size 960KB
- Sample260426-kee2faa181
- SHA256 eec343b3fc0af26e88eae09c4c9605c63d320b06650ef04ea34abf7f2b2cb9ea
- MD5 1e298f3cf5fb8ce0029a0b2fa093e561
- SHA1 2bf9530d01fef0703c68e04795e5204a4fd19d0b
- SHA512 7cc38197b7cc9ca15607966f97002ef0e595a9a12524e69cbaadaf508527a17d22166e0c042d72f71b256739ce86c847579293bb90bf9ac98a23ff664871eaac
- SSDEEP 12288:SSvO2x9mONvKRILSFnOkx2LIaxy4n5FAQjU/u:5vO2xJKRI2FOkx2LFE4scU2
- TLSH T1F7253B21F6508135C4B74536C5FA0BEAAA747D21671067CBA3C07B5B2FB36D2A931B0E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4888 8a8f7b56 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 3 114.114.114.114 4740 eec343b3fc0af26e88eae09c4c9605c63d320b06650ef04ea34abf7f2b2cb9ea.exe Destination IP 4 223.5.5.5 4740 eec343b3fc0af26e88eae09c4c9605c63d320b06650ef04ea34abf7f2b2cb9ea.exe Destination IP 36 114.114.114.114 4740 eec343b3fc0af26e88eae09c4c9605c63d320b06650ef04ea34abf7f2b2cb9ea.exe Destination IP 37 223.5.5.5 4740 eec343b3fc0af26e88eae09c4c9605c63d320b06650ef04ea34abf7f2b2cb9ea.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 8a8f7b56 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 8a8f7b56 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 8a8f7b56 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 8a8f7b56 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 8a8f7b56 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 8a8f7b56 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 8a8f7b56 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 8a8f7b56 File created C:\Windows\SysWOW64\8a8f7b56 eec343b3fc0af26e88eae09c4c9605c63d320b06650ef04ea34abf7f2b2cb9ea.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 8a8f7b56 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 8a8f7b56 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 8a8f7b56 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 8a8f7b56 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\512688 eec343b3fc0af26e88eae09c4c9605c63d320b06650ef04ea34abf7f2b2cb9ea.exe File opened for modification C:\Windows\53af30 8a8f7b56 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eec343b3fc0af26e88eae09c4c9605c63d320b06650ef04ea34abf7f2b2cb9ea.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8a8f7b56 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 8a8f7b56 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 8a8f7b56 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 8a8f7b56 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 8a8f7b56 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 8a8f7b56 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 8a8f7b56 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 8a8f7b56 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 8a8f7b56 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 8a8f7b56 - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 4888 8a8f7b56 4888 8a8f7b56 4888 8a8f7b56 4888 8a8f7b56 4888 8a8f7b56 4888 8a8f7b56 4888 8a8f7b56 4888 8a8f7b56 4888 8a8f7b56 4888 8a8f7b56 4888 8a8f7b56 4888 8a8f7b56 4740 eec343b3fc0af26e88eae09c4c9605c63d320b06650ef04ea34abf7f2b2cb9ea.exe 4740 eec343b3fc0af26e88eae09c4c9605c63d320b06650ef04ea34abf7f2b2cb9ea.exe 4740 eec343b3fc0af26e88eae09c4c9605c63d320b06650ef04ea34abf7f2b2cb9ea.exe 4740 eec343b3fc0af26e88eae09c4c9605c63d320b06650ef04ea34abf7f2b2cb9ea.exe 4740 eec343b3fc0af26e88eae09c4c9605c63d320b06650ef04ea34abf7f2b2cb9ea.exe 4740 eec343b3fc0af26e88eae09c4c9605c63d320b06650ef04ea34abf7f2b2cb9ea.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4740 eec343b3fc0af26e88eae09c4c9605c63d320b06650ef04ea34abf7f2b2cb9ea.exe Token: SeTcbPrivilege 4740 eec343b3fc0af26e88eae09c4c9605c63d320b06650ef04ea34abf7f2b2cb9ea.exe Token: SeDebugPrivilege 4888 8a8f7b56 Token: SeTcbPrivilege 4888 8a8f7b56
Processes
-
C:\Users\Admin\AppData\Local\Temp\eec343b3fc0af26e88eae09c4c9605c63d320b06650ef04ea34abf7f2b2cb9ea.exe"C:\Users\Admin\AppData\Local\Temp\eec343b3fc0af26e88eae09c4c9605c63d320b06650ef04ea34abf7f2b2cb9ea.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4740
-
C:\Windows\Syswow64\8a8f7b56C:\Windows\Syswow64\8a8f7b561⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4888
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\8a8f7b56
- Size 960KB
- SHA256 aa8e3ce5a99c60f41bce4b01f149634944904307c2f8e20a89f78bb74f6b4cda
- MD5 3aa338abc99c439990fc25489b408837
- SHA1 5220e99b3eec2b3215a5df7602d602f44f428f88
- SHA512 21ce624845c9c6c441be759818ac18a87f9ca21cc9ea8f1447f2eb872d2b2830864c21a84151196dfd82a8678d81a5ae42c0003b7e6ea6f31122a9ddc985bb2e
- SSDEEP 12288:VSvO2x9mONvKRILSFnOkx2LIaxy4n5FAQjU/u:UvO2xJKRI2FOkx2LFE4scU2
- TLSH T123253B21F6508135C4B74536C5FA0BEAAA747D21671067CBA3C07B5B2FB36D2A931B0E
- MD5 SHA1 SHA512 SSDEEP TLSH