Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
07/05/2026, 02:49
Behavioral task
behavioral1
Sample
7b875eac8229cf219250f2c7ae4dc197a211e19c8f4d3f57e3c19933e8f555c1.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 7b875eac8229cf219250f2c7ae4dc197a211e19c8f4d3f57e3c19933e8f555c1.exe
- Size 766KB
- Sample260507-dbb22sat8m
- SHA256 7b875eac8229cf219250f2c7ae4dc197a211e19c8f4d3f57e3c19933e8f555c1
- MD5 19fd1eef0c4e265735a6b8c6e93c5c69
- SHA1 b2a24f612b2d6da39317b0e8e3a9f844048f75f2
- SHA512 0c3c6d9fded9ecc0aad92cf116034357c99d8a523766842f0c0317fd3c3f6442420c815bd224f9de7d3955cb34ceee5cb1bd1e435ae4684e0fa115fe7e0ddcf3
- SSDEEP 12288:cSvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/Liw:vvO2xJKRw2kOkx2LFRvcUV
- TLSH T1D1F45A31E241C03AD0A74576C6FA0BAFE564BD25531155CBA3C43A6A2FB36D2BE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1492 d68b1e28 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 3 114.114.114.114 4432 7b875eac8229cf219250f2c7ae4dc197a211e19c8f4d3f57e3c19933e8f555c1.exe Destination IP 4 223.5.5.5 4432 7b875eac8229cf219250f2c7ae4dc197a211e19c8f4d3f57e3c19933e8f555c1.exe Destination IP 32 114.114.114.114 4432 7b875eac8229cf219250f2c7ae4dc197a211e19c8f4d3f57e3c19933e8f555c1.exe Destination IP 34 223.5.5.5 4432 7b875eac8229cf219250f2c7ae4dc197a211e19c8f4d3f57e3c19933e8f555c1.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData d68b1e28 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE d68b1e28 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft d68b1e28 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache d68b1e28 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 d68b1e28 File created C:\Windows\SysWOW64\d68b1e28 7b875eac8229cf219250f2c7ae4dc197a211e19c8f4d3f57e3c19933e8f555c1.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 d68b1e28 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content d68b1e28 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 d68b1e28 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 d68b1e28 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 d68b1e28 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies d68b1e28 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 d68b1e28 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 d68b1e28 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 d68b1e28 -
resource yara_rule behavioral1/memory/4432-0-0x00000000008C0000-0x000000000094C000-memory.dmp upx behavioral1/files/0x000a000000021655-3.dat upx behavioral1/memory/1492-4-0x0000000000030000-0x00000000000BC000-memory.dmp upx behavioral1/memory/4432-20-0x00000000008C0000-0x000000000094C000-memory.dmp upx behavioral1/memory/1492-22-0x0000000000030000-0x00000000000BC000-memory.dmp upx behavioral1/memory/1492-36-0x0000000000030000-0x00000000000BC000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\198b28 d68b1e28 File opened for modification C:\Windows\4be0a0 7b875eac8229cf219250f2c7ae4dc197a211e19c8f4d3f57e3c19933e8f555c1.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7b875eac8229cf219250f2c7ae4dc197a211e19c8f4d3f57e3c19933e8f555c1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d68b1e28 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" d68b1e28 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" d68b1e28 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" d68b1e28 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" d68b1e28 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" d68b1e28 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix d68b1e28 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ d68b1e28 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" d68b1e28 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing d68b1e28 - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 1492 d68b1e28 1492 d68b1e28 1492 d68b1e28 1492 d68b1e28 1492 d68b1e28 1492 d68b1e28 1492 d68b1e28 1492 d68b1e28 1492 d68b1e28 1492 d68b1e28 1492 d68b1e28 1492 d68b1e28 4432 7b875eac8229cf219250f2c7ae4dc197a211e19c8f4d3f57e3c19933e8f555c1.exe 4432 7b875eac8229cf219250f2c7ae4dc197a211e19c8f4d3f57e3c19933e8f555c1.exe 4432 7b875eac8229cf219250f2c7ae4dc197a211e19c8f4d3f57e3c19933e8f555c1.exe 4432 7b875eac8229cf219250f2c7ae4dc197a211e19c8f4d3f57e3c19933e8f555c1.exe 4432 7b875eac8229cf219250f2c7ae4dc197a211e19c8f4d3f57e3c19933e8f555c1.exe 4432 7b875eac8229cf219250f2c7ae4dc197a211e19c8f4d3f57e3c19933e8f555c1.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4432 7b875eac8229cf219250f2c7ae4dc197a211e19c8f4d3f57e3c19933e8f555c1.exe Token: SeTcbPrivilege 4432 7b875eac8229cf219250f2c7ae4dc197a211e19c8f4d3f57e3c19933e8f555c1.exe Token: SeDebugPrivilege 1492 d68b1e28 Token: SeTcbPrivilege 1492 d68b1e28
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b875eac8229cf219250f2c7ae4dc197a211e19c8f4d3f57e3c19933e8f555c1.exe"C:\Users\Admin\AppData\Local\Temp\7b875eac8229cf219250f2c7ae4dc197a211e19c8f4d3f57e3c19933e8f555c1.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4432
-
C:\Windows\Syswow64\d68b1e28C:\Windows\Syswow64\d68b1e281⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1492
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\198b28
- Size 506B
- SHA256 350206e642999af3d25ead87eb47384d1599b35067cafb1de4ae1a1a722ce76b
- MD5 970d163d307cbeb6d8fb9798527d2cf6
- SHA1 9b3c7a401373555aecdd95944ccce94ae06af2db
- SHA512 ec57b144401e6cbc06111abca5a67920b585a1a9ef10d5bb4e3d9f5795587f5d98686b558cb1a90d049bbd45b2d6159ce8d8e93f3417259ca861b7d9df508944
- TLSH T1A6F0C93AAD2793BD09BF28220533E8445142B3A24023D1ACBDA1328505E2BF1A903885
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\d68b1e28
- Size 766KB
- SHA256 7d9596a05f8094ae8eefaaf7aa641578e589620b1435b2b48ff744fdbdfaa7d5
- MD5 e77edcbe4e343ef6a12653d1f3e7adb7
- SHA1 e1f3272c4fd10eed0a71fd92807b6d51917a2501
- SHA512 ba51a48e054eb488747a65dccbf1164d6c5ad6785baeae6557117abcc85f6410bc56ac9c5a43d50f900677f0888d52aaaffb09372ae08e89fe758b0a6d6d1d3a
- SSDEEP 12288:KSvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/Liw:RvO2xJKRw2kOkx2LFRvcUV
- TLSH T113F45A31E241C03AD0A74576C6FA0BAFE564BD25531155CBA3C43A6A2FB36D2BE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH