Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/05/2026, 01:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
17d33374b194d7804b76ac488e43ce99d9eb31a02955ca21dc379cd057337ce8.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
17d33374b194d7804b76ac488e43ce99d9eb31a02955ca21dc379cd057337ce8.exe
Resource
win11-20260130-en
windows11-21h2-x64
8 signatures
150 seconds
General
- Target 17d33374b194d7804b76ac488e43ce99d9eb31a02955ca21dc379cd057337ce8.exe
- Size 2.4MB
- Sample260510-b58l1af16w
- SHA256 17d33374b194d7804b76ac488e43ce99d9eb31a02955ca21dc379cd057337ce8
- MD5 06dc9c09d86fcf7b1cc6598eb1820984
- SHA1 be6b8ecca497915dd52a7780586a88a4dab8f51e
- SHA512 1e110b1d371d7877dbd5d3370ac4a53629e747f4d570bd4230ddec5a2c64b962f2c9f400a34410018b6d0221d7cc63a632e4c00c13dd339d29c76a35c4a54ada
- SSDEEP 49152:4HHKO29QG56/OJdJCXDrsOFZMjHfUTGkQy5QZuTtg:4nKdVkOhCXHHFZMjHfUKkVWsi
- TLSH T1ADB58E31E6818136D1B34671C6FA57BBA5287C221711A5CFA3C47A2A1F736D3AE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4684 fd8cf498 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 5 114.114.114.114 4636 17d33374b194d7804b76ac488e43ce99d9eb31a02955ca21dc379cd057337ce8.exe Destination IP 6 223.5.5.5 4636 17d33374b194d7804b76ac488e43ce99d9eb31a02955ca21dc379cd057337ce8.exe Destination IP 22 114.114.114.114 4636 17d33374b194d7804b76ac488e43ce99d9eb31a02955ca21dc379cd057337ce8.exe Destination IP 23 223.5.5.5 4636 17d33374b194d7804b76ac488e43ce99d9eb31a02955ca21dc379cd057337ce8.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AAD646CB44373074ADE741C38400E7E1 fd8cf498 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE fd8cf498 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 fd8cf498 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft fd8cf498 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData fd8cf498 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 fd8cf498 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AAD646CB44373074ADE741C38400E7E1 fd8cf498 File created C:\Windows\SysWOW64\fd8cf498 17d33374b194d7804b76ac488e43ce99d9eb31a02955ca21dc379cd057337ce8.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 fd8cf498 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies fd8cf498 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache fd8cf498 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content fd8cf498 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 fd8cf498 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\503118 fd8cf498 File opened for modification C:\Windows\4f5eb8 17d33374b194d7804b76ac488e43ce99d9eb31a02955ca21dc379cd057337ce8.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17d33374b194d7804b76ac488e43ce99d9eb31a02955ca21dc379cd057337ce8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fd8cf498 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" fd8cf498 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" fd8cf498 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" fd8cf498 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" fd8cf498 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" fd8cf498 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" fd8cf498 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing fd8cf498 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix fd8cf498 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ fd8cf498 - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 4684 fd8cf498 4684 fd8cf498 4684 fd8cf498 4684 fd8cf498 4684 fd8cf498 4684 fd8cf498 4684 fd8cf498 4684 fd8cf498 4684 fd8cf498 4684 fd8cf498 4684 fd8cf498 4684 fd8cf498 4636 17d33374b194d7804b76ac488e43ce99d9eb31a02955ca21dc379cd057337ce8.exe 4636 17d33374b194d7804b76ac488e43ce99d9eb31a02955ca21dc379cd057337ce8.exe 4636 17d33374b194d7804b76ac488e43ce99d9eb31a02955ca21dc379cd057337ce8.exe 4636 17d33374b194d7804b76ac488e43ce99d9eb31a02955ca21dc379cd057337ce8.exe 4636 17d33374b194d7804b76ac488e43ce99d9eb31a02955ca21dc379cd057337ce8.exe 4636 17d33374b194d7804b76ac488e43ce99d9eb31a02955ca21dc379cd057337ce8.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4636 17d33374b194d7804b76ac488e43ce99d9eb31a02955ca21dc379cd057337ce8.exe Token: SeTcbPrivilege 4636 17d33374b194d7804b76ac488e43ce99d9eb31a02955ca21dc379cd057337ce8.exe Token: SeDebugPrivilege 4684 fd8cf498 Token: SeTcbPrivilege 4684 fd8cf498
Processes
-
C:\Users\Admin\AppData\Local\Temp\17d33374b194d7804b76ac488e43ce99d9eb31a02955ca21dc379cd057337ce8.exe"C:\Users\Admin\AppData\Local\Temp\17d33374b194d7804b76ac488e43ce99d9eb31a02955ca21dc379cd057337ce8.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4636
-
C:\Windows\Syswow64\fd8cf498C:\Windows\Syswow64\fd8cf4981⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4684
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\503118
- Size 506B
- SHA256 822107c43d431b313d32cdfc0867b11c38d0f67b379f7ad33ea8117d256b453c
- MD5 92171b2c4004d52fb1c4bc5cbbb21cf2
- SHA1 b337374a22756b9d4a17de6da67ac3259ce72ba3
- SHA512 7807485d2656042da0ed1d52896e559ea74d4b0877681f8c2578b73be0018fb1e7e4d6fa9b3609aa03721e79f606e6bd4d54dab9f8423822eb3a18308c176bd4
- TLSH T156F0057A543861D12EFD4CF3BD07D8093D18512F814F7132E4B3796408F20075403879
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\fd8cf498
- Size 2.4MB
- SHA256 9f6bc7835fa0173c7db9569ea1c177e8c8d4adc3cd07711476bbd68a0785bf87
- MD5 482c080413272e246ebee533761d37a4
- SHA1 6a70dffcb79aa818b6777c3188ddd0f2ec2f7af3
- SHA512 c4b35e11385148104a18e719562bcd0d3846d93d94cf58412b7c859b6ad6d9ed96bb9de6ccf5879a2290e79e3e3a62a9d1d676d43e53e82f173255c6ba67a62c
- SSDEEP 49152:RHHKO29QG56/OJdJCXDrsOFZMjHfUTGkQy5QZuTtg:RnKdVkOhCXHHFZMjHfUKkVWsi
- TLSH T1BDB58E31E6818136D1B34671C6FA57BBA5287C221711A5CFA3C47A2A1F736D3AE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH