Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20250619-en - resource tags
arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system - submitted
07/05/2026, 20:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
42d0457355e4daabab3b3fd5e3eb8b845695a09273d697bf95aafb9d06b4de25.exe
Resource
win10v2004-20250619-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
42d0457355e4daabab3b3fd5e3eb8b845695a09273d697bf95aafb9d06b4de25.exe
Resource
win11-20260130-en
windows11-21h2-x64
8 signatures
150 seconds
General
- Target 42d0457355e4daabab3b3fd5e3eb8b845695a09273d697bf95aafb9d06b4de25.exe
- Size 511KB
- Sample260507-y869nsat21
- SHA256 42d0457355e4daabab3b3fd5e3eb8b845695a09273d697bf95aafb9d06b4de25
- MD5 2ec8b89338b05aac74f95c90382daa24
- SHA1 a02ba6a347df398ecc0bb19737574983cff226bf
- SHA512 9ff3d2755b437a3da500e8f84f703bd4429799937db5e2bfe6f83df4f54c625035baa8783f023f399d1792c96a524a13b59cccff588d5939ecf1587dcd0f51e8
- SSDEEP 6144:5cTgav1cdCTuoPbgwmOLJvKRILSFvdFDcEOkCybEaQRXr9HNdvOax5Rv0:5SvO2x9mONvKRILSFnOkx2LIax5F0
- TLSH T1BBB45C26F6908036C4B34575C5F64BAAFAB4BC21631156CBA3943A6A1F737D2BD3130E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1676 de262294 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 6 114.114.114.114 1528 42d0457355e4daabab3b3fd5e3eb8b845695a09273d697bf95aafb9d06b4de25.exe Destination IP 7 223.5.5.5 1528 42d0457355e4daabab3b3fd5e3eb8b845695a09273d697bf95aafb9d06b4de25.exe Destination IP 45 114.114.114.114 1528 42d0457355e4daabab3b3fd5e3eb8b845695a09273d697bf95aafb9d06b4de25.exe Destination IP 46 223.5.5.5 1528 42d0457355e4daabab3b3fd5e3eb8b845695a09273d697bf95aafb9d06b4de25.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 de262294 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content de262294 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 de262294 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 de262294 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 de262294 File created C:\Windows\SysWOW64\de262294 42d0457355e4daabab3b3fd5e3eb8b845695a09273d697bf95aafb9d06b4de25.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 de262294 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE de262294 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies de262294 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 de262294 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache de262294 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft de262294 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData de262294 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\1cb198 de262294 File opened for modification C:\Windows\1a28f0 42d0457355e4daabab3b3fd5e3eb8b845695a09273d697bf95aafb9d06b4de25.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42d0457355e4daabab3b3fd5e3eb8b845695a09273d697bf95aafb9d06b4de25.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language de262294 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix de262294 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" de262294 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" de262294 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" de262294 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ de262294 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" de262294 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" de262294 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" de262294 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing de262294 - Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 1676 de262294 1676 de262294 1676 de262294 1676 de262294 1676 de262294 1676 de262294 1676 de262294 1676 de262294 1676 de262294 1676 de262294 1676 de262294 1676 de262294 1676 de262294 1676 de262294 1676 de262294 1676 de262294 1676 de262294 1676 de262294 1676 de262294 1676 de262294 1528 42d0457355e4daabab3b3fd5e3eb8b845695a09273d697bf95aafb9d06b4de25.exe 1528 42d0457355e4daabab3b3fd5e3eb8b845695a09273d697bf95aafb9d06b4de25.exe 1528 42d0457355e4daabab3b3fd5e3eb8b845695a09273d697bf95aafb9d06b4de25.exe 1528 42d0457355e4daabab3b3fd5e3eb8b845695a09273d697bf95aafb9d06b4de25.exe 1528 42d0457355e4daabab3b3fd5e3eb8b845695a09273d697bf95aafb9d06b4de25.exe 1528 42d0457355e4daabab3b3fd5e3eb8b845695a09273d697bf95aafb9d06b4de25.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1528 42d0457355e4daabab3b3fd5e3eb8b845695a09273d697bf95aafb9d06b4de25.exe Token: SeTcbPrivilege 1528 42d0457355e4daabab3b3fd5e3eb8b845695a09273d697bf95aafb9d06b4de25.exe Token: SeDebugPrivilege 1676 de262294 Token: SeTcbPrivilege 1676 de262294
Processes
-
C:\Users\Admin\AppData\Local\Temp\42d0457355e4daabab3b3fd5e3eb8b845695a09273d697bf95aafb9d06b4de25.exe"C:\Users\Admin\AppData\Local\Temp\42d0457355e4daabab3b3fd5e3eb8b845695a09273d697bf95aafb9d06b4de25.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1528
-
C:\Windows\Syswow64\de262294C:\Windows\Syswow64\de2622941⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1676
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\de262294
- Size 511KB
- SHA256 136480e1cce8d126799172d6fe8bbb57aeda6d64e4ac6a233b5f72d92048a641
- MD5 30589246987453f8cdf6f460e9fd4c4e
- SHA1 77a3680a73f0911bdb4a1d46815e8d7817c89537
- SHA512 02174ab21bb1838773a49a6320e1dec72c66dcbc255524b336835a87783233a938dc5c1fa110eba7fdf3ca0cb484c794b597fc117952ac59a77b261dc4ec3e51
- SSDEEP 6144:gcTgav1cdCTuoPbgwmOLJvKRILSFvdFDcEOkCybEaQRXr9HNdvOax5Rv0:gSvO2x9mONvKRILSFnOkx2LIax5F0
- TLSH T1B8B45B26F6908036C4B34575C5F64BAAFAB4BC21631156CBA3943A6A1F737D2BD3130E
- MD5 SHA1 SHA512 SSDEEP TLSH