Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
03/05/2026, 10:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
342b4427441c7f06f3e74bccfada65b18a13604303b4f6ee89c665ad063ccce2.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
342b4427441c7f06f3e74bccfada65b18a13604303b4f6ee89c665ad063ccce2.exe
Resource
win11-20260130-en
windows11-21h2-x64
8 signatures
150 seconds
General
- Target 342b4427441c7f06f3e74bccfada65b18a13604303b4f6ee89c665ad063ccce2.exe
- Size 704KB
- Sample260503-mtaflsfv9w
- SHA256 342b4427441c7f06f3e74bccfada65b18a13604303b4f6ee89c665ad063ccce2
- MD5 da287adef81fad6deb42f15e43e7d6b5
- SHA1 19fe4cda9ea2ce92635e2cf22cd13ff8ddc8feb7
- SHA512 d931fe623926079c1a67e71630f02f7211b9f92fe7eaaedb5c8397b9b85b82f5b4d0bd89fc014f690432f364c79a0bd3d270d11b82b19567f2227ec1152fb37c
- SSDEEP 12288:gSvO2x9mONvKRILSF/Okx2LIatyVuX13kdB4YSYVWd:7vO2xJKRI2dOkx2LFAAX1oOYSY8d
- TLSH T172E48B12F791C172C86746B488A7476EAA75BD1523204BCBE7907E5A8EB33D1BC3930D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3540 b8c9ef4c - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 24 223.5.5.5 4820 342b4427441c7f06f3e74bccfada65b18a13604303b4f6ee89c665ad063ccce2.exe Destination IP 3 114.114.114.114 4820 342b4427441c7f06f3e74bccfada65b18a13604303b4f6ee89c665ad063ccce2.exe Destination IP 4 223.5.5.5 4820 342b4427441c7f06f3e74bccfada65b18a13604303b4f6ee89c665ad063ccce2.exe Destination IP 23 114.114.114.114 4820 342b4427441c7f06f3e74bccfada65b18a13604303b4f6ee89c665ad063ccce2.exe - Drops file in System32 directory 11 IoCs
description ioc Process File created C:\Windows\SysWOW64\b8c9ef4c 342b4427441c7f06f3e74bccfada65b18a13604303b4f6ee89c665ad063ccce2.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 b8c9ef4c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 b8c9ef4c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft b8c9ef4c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache b8c9ef4c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData b8c9ef4c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE b8c9ef4c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies b8c9ef4c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AAD646CB44373074ADE741C38400E7E1 b8c9ef4c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content b8c9ef4c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AAD646CB44373074ADE741C38400E7E1 b8c9ef4c - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\3c9b28 b8c9ef4c File opened for modification C:\Windows\528528 342b4427441c7f06f3e74bccfada65b18a13604303b4f6ee89c665ad063ccce2.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 342b4427441c7f06f3e74bccfada65b18a13604303b4f6ee89c665ad063ccce2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b8c9ef4c - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" b8c9ef4c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" b8c9ef4c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" b8c9ef4c Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing b8c9ef4c Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix b8c9ef4c Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" b8c9ef4c Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ b8c9ef4c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" b8c9ef4c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" b8c9ef4c - Modifies system certificate store 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1F24C630CDA418EF2069FFAD4FDD5F463A1B69AA b8c9ef4c Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1F24C630CDA418EF2069FFAD4FDD5F463A1B69AA\Blob = 5c0000000100000004000000800100000400000001000000100000009fad3b1c021e8aba177438810ca2bc080f0000000100000030000000f019c7ba12795dacd6ef1a767657deb8e41060a2ad1a6c66900a6ec16870fc06eecbaffdd3e2c986659578e7e85e535a530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003800000047006c006f00620061006c005300690067006e002000450043004300200052006f006f00740020004300410020002d002000520035000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308620000000100000020000000179fbc148a3dd00fd24ea13458cc43bfa7f59c8182d783a513f6ebec100c89241400000001000000140000003de629489bea07ca21444a26de6eded283d09f591d0000000100000010000000b647dd2a9ccadee75e8905e256cc6b147f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d7010300000001000000140000001f24c630cda418ef2069ffad4fdd5f463a1b69aa190000000100000010000000e3087c0c81f60a2a2b466b8a3e70cce82000000001000000220200003082021e308201a4a0030201020211605949e0262ebb55f90a778a71f94ad86c300a06082a8648ce3d040303305031243022060355040b131b476c6f62616c5369676e2045434320526f6f74204341202d20523531133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3132313131333030303030305a170d3338303131393033313430375a305031243022060355040b131b476c6f62616c5369676e2045434320526f6f74204341202d20523531133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e3076301006072a8648ce3d020106052b810400220362000447450e96fb7d5dbfe939d121f89f0bb6d57b1e923a48591cf062312dc07a28fe1aa75cb3b6cc97e745d458fad1776d43a2c08765340a1f7addeb3c33a1c59d4da46f4195387fc91e84ebd19e49928794870c3a854a669f9d59934d976106864aa3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604143de629489bea07ca21444a26de6eded283d09f59300a06082a8648ce3d0403030368003065023100e56912c96edbc631ba0941e197f8fbfd9ae27d12c9ed7c64d3cb05258b56d9a0e75e5d4e0b839c5b7629a00926216a62023071d2b58f5cea3be1780985a875923bc85cfd48ef0d7422a808e26ec549cec70cbca76169f1f73be12acbf92bf3669037 b8c9ef4c - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 3540 b8c9ef4c 3540 b8c9ef4c 3540 b8c9ef4c 3540 b8c9ef4c 3540 b8c9ef4c 3540 b8c9ef4c 3540 b8c9ef4c 3540 b8c9ef4c 3540 b8c9ef4c 3540 b8c9ef4c 3540 b8c9ef4c 3540 b8c9ef4c 4820 342b4427441c7f06f3e74bccfada65b18a13604303b4f6ee89c665ad063ccce2.exe 4820 342b4427441c7f06f3e74bccfada65b18a13604303b4f6ee89c665ad063ccce2.exe 4820 342b4427441c7f06f3e74bccfada65b18a13604303b4f6ee89c665ad063ccce2.exe 4820 342b4427441c7f06f3e74bccfada65b18a13604303b4f6ee89c665ad063ccce2.exe 4820 342b4427441c7f06f3e74bccfada65b18a13604303b4f6ee89c665ad063ccce2.exe 4820 342b4427441c7f06f3e74bccfada65b18a13604303b4f6ee89c665ad063ccce2.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4820 342b4427441c7f06f3e74bccfada65b18a13604303b4f6ee89c665ad063ccce2.exe Token: SeTcbPrivilege 4820 342b4427441c7f06f3e74bccfada65b18a13604303b4f6ee89c665ad063ccce2.exe Token: SeDebugPrivilege 3540 b8c9ef4c Token: SeTcbPrivilege 3540 b8c9ef4c
Processes
-
C:\Users\Admin\AppData\Local\Temp\342b4427441c7f06f3e74bccfada65b18a13604303b4f6ee89c665ad063ccce2.exe"C:\Users\Admin\AppData\Local\Temp\342b4427441c7f06f3e74bccfada65b18a13604303b4f6ee89c665ad063ccce2.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4820
-
C:\Windows\Syswow64\b8c9ef4cC:\Windows\Syswow64\b8c9ef4c1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3540
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\b8c9ef4c
- Size 704KB
- SHA256 9c53a30c3b297d4624d8243c0cd6d9282a8553048fcb555c1d6286a54b897bc0
- MD5 0402dcbc293b630732948095bcf8e079
- SHA1 f8ad5e26076953948198039af936d81c382dc7ea
- SHA512 0a1a6213b03f6328d54c245c98b36d2c22077ccb97692dd4e2febd30b7210f91ebace6d5bd0b540b7735aa9348225864e05d35478a201862cb9874ec6a1607d0
- SSDEEP 12288:9SvO2x9mONvKRILSF/Okx2LIatyVuX13kdB4YSYVWd:cvO2xJKRI2dOkx2LFAAX1oOYSY8d
- TLSH T19FE48B12F791C172C86746B488A7476EAA75BD1523204BCBE7907E5A8EB33D1BC3930D
- MD5 SHA1 SHA512 SSDEEP TLSH