Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
28/04/2026, 19:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
47938af5b3dfd00cc6dbadeebf688179828ca1f29374fe3c1cd2832e1020569d.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
47938af5b3dfd00cc6dbadeebf688179828ca1f29374fe3c1cd2832e1020569d.exe
Resource
win11-20260130-en
windows11-21h2-x64
8 signatures
150 seconds
General
- Target 47938af5b3dfd00cc6dbadeebf688179828ca1f29374fe3c1cd2832e1020569d.exe
- Size 615KB
- Sample260428-yn7ppses2t
- SHA256 47938af5b3dfd00cc6dbadeebf688179828ca1f29374fe3c1cd2832e1020569d
- MD5 dc11a013956e8d5220d2e329bc9e3ce6
- SHA1 c64519060bf7b1da4af7df6d4b65b60d2de514ae
- SHA512 3e8dcb51c5cf6dc879a21b695830165407a6c1b44804a08a6f23cce80929df73ea0a8b05977f4b212e1c73460372a1bb5226fb0710f137c4c0b7e4a4d61f8dbc
- SSDEEP 12288:ZSvO2x9mONvKRILSFnOkx2LIax5FAQjU/Liw:gvO2xJKRI2FOkx2LFicUV
- TLSH T174D44A31E241C03AD4A74576C6FA0BAFE5647D25531165CBA3C43A2A2FB36D2BE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5472 2e919a1c - Unexpected DNS network traffic destination 12 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 187 223.5.5.5 2912 47938af5b3dfd00cc6dbadeebf688179828ca1f29374fe3c1cd2832e1020569d.exe Destination IP 1 114.114.114.114 2912 47938af5b3dfd00cc6dbadeebf688179828ca1f29374fe3c1cd2832e1020569d.exe Destination IP 36 223.5.5.5 2912 47938af5b3dfd00cc6dbadeebf688179828ca1f29374fe3c1cd2832e1020569d.exe Destination IP 57 114.114.114.114 2912 47938af5b3dfd00cc6dbadeebf688179828ca1f29374fe3c1cd2832e1020569d.exe Destination IP 58 223.5.5.5 2912 47938af5b3dfd00cc6dbadeebf688179828ca1f29374fe3c1cd2832e1020569d.exe Destination IP 127 114.114.114.114 5472 2e919a1c Destination IP 2 223.5.5.5 2912 47938af5b3dfd00cc6dbadeebf688179828ca1f29374fe3c1cd2832e1020569d.exe Destination IP 35 114.114.114.114 2912 47938af5b3dfd00cc6dbadeebf688179828ca1f29374fe3c1cd2832e1020569d.exe Destination IP 120 114.114.114.114 2912 47938af5b3dfd00cc6dbadeebf688179828ca1f29374fe3c1cd2832e1020569d.exe Destination IP 121 223.5.5.5 2912 47938af5b3dfd00cc6dbadeebf688179828ca1f29374fe3c1cd2832e1020569d.exe Destination IP 132 223.5.5.5 2912 47938af5b3dfd00cc6dbadeebf688179828ca1f29374fe3c1cd2832e1020569d.exe Destination IP 186 114.114.114.114 2912 47938af5b3dfd00cc6dbadeebf688179828ca1f29374fe3c1cd2832e1020569d.exe - Drops file in System32 directory 15 IoCs
description ioc Process File created C:\Windows\SysWOW64\2e919a1c 47938af5b3dfd00cc6dbadeebf688179828ca1f29374fe3c1cd2832e1020569d.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 2e919a1c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 2e919a1c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 2e919a1c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 2e919a1c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 2e919a1c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 2e919a1c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 2e919a1c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 2e919a1c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 2e919a1c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 2e919a1c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 2e919a1c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 2e919a1c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 2e919a1c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 2e919a1c - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\31dac0 47938af5b3dfd00cc6dbadeebf688179828ca1f29374fe3c1cd2832e1020569d.exe File opened for modification C:\Windows\5daec0 2e919a1c - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2e919a1c Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 47938af5b3dfd00cc6dbadeebf688179828ca1f29374fe3c1cd2832e1020569d.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 2e919a1c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 2e919a1c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 2e919a1c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 2e919a1c Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 2e919a1c Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 2e919a1c Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 2e919a1c Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 2e919a1c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 2e919a1c - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 5472 2e919a1c 5472 2e919a1c 5472 2e919a1c 5472 2e919a1c 5472 2e919a1c 5472 2e919a1c 5472 2e919a1c 5472 2e919a1c 2912 47938af5b3dfd00cc6dbadeebf688179828ca1f29374fe3c1cd2832e1020569d.exe 2912 47938af5b3dfd00cc6dbadeebf688179828ca1f29374fe3c1cd2832e1020569d.exe 2912 47938af5b3dfd00cc6dbadeebf688179828ca1f29374fe3c1cd2832e1020569d.exe 2912 47938af5b3dfd00cc6dbadeebf688179828ca1f29374fe3c1cd2832e1020569d.exe 2912 47938af5b3dfd00cc6dbadeebf688179828ca1f29374fe3c1cd2832e1020569d.exe 2912 47938af5b3dfd00cc6dbadeebf688179828ca1f29374fe3c1cd2832e1020569d.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2912 47938af5b3dfd00cc6dbadeebf688179828ca1f29374fe3c1cd2832e1020569d.exe Token: SeTcbPrivilege 2912 47938af5b3dfd00cc6dbadeebf688179828ca1f29374fe3c1cd2832e1020569d.exe Token: SeDebugPrivilege 5472 2e919a1c Token: SeTcbPrivilege 5472 2e919a1c
Processes
-
C:\Users\Admin\AppData\Local\Temp\47938af5b3dfd00cc6dbadeebf688179828ca1f29374fe3c1cd2832e1020569d.exe"C:\Users\Admin\AppData\Local\Temp\47938af5b3dfd00cc6dbadeebf688179828ca1f29374fe3c1cd2832e1020569d.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2912
-
C:\Windows\Syswow64\2e919a1cC:\Windows\Syswow64\2e919a1c1⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5472
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\2e919a1c
- Size 615KB
- SHA256 6a1ffc21281232930f2b6c86b72fbd188ab7b08ce765a07eb4a1e18623d8efb3
- MD5 0b415aa8fab2cf9571aedfc848e9998a
- SHA1 0170fe5241a4c46c019473bddfdcfba54ad89c3f
- SHA512 95b013d6aac3eec786426c7b57fd8b76d0f2834cb9d889fd4d14d91c009410e09e55b13db64ce62c8cb40207e79c8da1fa94ada47899268243cd6912a57f6fd4
- SSDEEP 12288:xSvO2x9mONvKRILSFnOkx2LIax5FAQjU/Liw:YvO2xJKRI2FOkx2LFicUV
- TLSH T108D44A31E241C03AD4A74576C6FA0BAFE5647D25531165CBA3C43A2A2FB36D2BE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH