Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20250610-en - resource tags
arch:x64arch:x86image:win11-20250610-enlocale:en-usos:windows11-21h2-x64system - submitted
11/05/2026, 19:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d37d32295339e7cab35539009146cdf6b2a19fe5b7616bf7c98aab5e6fe3204d.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
d37d32295339e7cab35539009146cdf6b2a19fe5b7616bf7c98aab5e6fe3204d.exe
Resource
win11-20250610-en
windows11-21h2-x64
8 signatures
150 seconds
General
- Target d37d32295339e7cab35539009146cdf6b2a19fe5b7616bf7c98aab5e6fe3204d.exe
- Size 743KB
- Sample260511-yfk6qsht21
- SHA256 d37d32295339e7cab35539009146cdf6b2a19fe5b7616bf7c98aab5e6fe3204d
- MD5 3bf7324fcc5ee03c9ccaf8278bb36715
- SHA1 a25f3b2e7736a332cb01c5255568bd7aeb58fefd
- SHA512 46ab81bfe40f205d3243ab510b3e384f27176220143b20ca7f5a57cc7f052b2945c301a2709dd1932465d8ea8a8b90957c2c839a9e5f05aa87f0e0d05ab1cd2c
- SSDEEP 12288:lSvO2x9mONvKRILSFnOkx2LIaxya5FAQjU/LikG8:EvO2xJKRI2FOkx2LFEvcU68
- TLSH T1E2F45A31E2418036D5B34576C6FA0BBFB5647D25131165CBA3C8BA262FB36D2BA3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3992 5bf6d04c - Unexpected DNS network traffic destination 6 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 1 114.114.114.114 4688 d37d32295339e7cab35539009146cdf6b2a19fe5b7616bf7c98aab5e6fe3204d.exe Destination IP 3 223.5.5.5 4688 d37d32295339e7cab35539009146cdf6b2a19fe5b7616bf7c98aab5e6fe3204d.exe Destination IP 14 114.114.114.114 4688 d37d32295339e7cab35539009146cdf6b2a19fe5b7616bf7c98aab5e6fe3204d.exe Destination IP 15 223.5.5.5 4688 d37d32295339e7cab35539009146cdf6b2a19fe5b7616bf7c98aab5e6fe3204d.exe Destination IP 60 114.114.114.114 4688 d37d32295339e7cab35539009146cdf6b2a19fe5b7616bf7c98aab5e6fe3204d.exe Destination IP 61 223.5.5.5 4688 d37d32295339e7cab35539009146cdf6b2a19fe5b7616bf7c98aab5e6fe3204d.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 5bf6d04c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 5bf6d04c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 5bf6d04c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 5bf6d04c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 5bf6d04c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 5bf6d04c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 5bf6d04c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 5bf6d04c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 5bf6d04c File created C:\Windows\SysWOW64\5bf6d04c d37d32295339e7cab35539009146cdf6b2a19fe5b7616bf7c98aab5e6fe3204d.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 5bf6d04c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 5bf6d04c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 5bf6d04c - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\445830 5bf6d04c File opened for modification C:\Windows\5042a0 d37d32295339e7cab35539009146cdf6b2a19fe5b7616bf7c98aab5e6fe3204d.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d37d32295339e7cab35539009146cdf6b2a19fe5b7616bf7c98aab5e6fe3204d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bf6d04c - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 5bf6d04c Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 5bf6d04c Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 5bf6d04c Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 5bf6d04c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 5bf6d04c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 5bf6d04c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 5bf6d04c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 5bf6d04c Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 5bf6d04c - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 3992 5bf6d04c 3992 5bf6d04c 3992 5bf6d04c 3992 5bf6d04c 3992 5bf6d04c 3992 5bf6d04c 3992 5bf6d04c 3992 5bf6d04c 4688 d37d32295339e7cab35539009146cdf6b2a19fe5b7616bf7c98aab5e6fe3204d.exe 4688 d37d32295339e7cab35539009146cdf6b2a19fe5b7616bf7c98aab5e6fe3204d.exe 4688 d37d32295339e7cab35539009146cdf6b2a19fe5b7616bf7c98aab5e6fe3204d.exe 4688 d37d32295339e7cab35539009146cdf6b2a19fe5b7616bf7c98aab5e6fe3204d.exe 4688 d37d32295339e7cab35539009146cdf6b2a19fe5b7616bf7c98aab5e6fe3204d.exe 4688 d37d32295339e7cab35539009146cdf6b2a19fe5b7616bf7c98aab5e6fe3204d.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4688 d37d32295339e7cab35539009146cdf6b2a19fe5b7616bf7c98aab5e6fe3204d.exe Token: SeTcbPrivilege 4688 d37d32295339e7cab35539009146cdf6b2a19fe5b7616bf7c98aab5e6fe3204d.exe Token: SeDebugPrivilege 3992 5bf6d04c Token: SeTcbPrivilege 3992 5bf6d04c
Processes
-
C:\Users\Admin\AppData\Local\Temp\d37d32295339e7cab35539009146cdf6b2a19fe5b7616bf7c98aab5e6fe3204d.exe"C:\Users\Admin\AppData\Local\Temp\d37d32295339e7cab35539009146cdf6b2a19fe5b7616bf7c98aab5e6fe3204d.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4688
-
C:\Windows\Syswow64\5bf6d04cC:\Windows\Syswow64\5bf6d04c1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3992
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\5bf6d04c
- Size 743KB
- SHA256 83bc7a3e91dd1779e48d7fd1f8246973ca4a840ea0fc5f4167998ff9fd6e4d5b
- MD5 52aeece109c7e7e772e266923869dbc4
- SHA1 fc83a2d961031d39bd77e25a3cbbe0d1cbc1b4be
- SHA512 5a8fe174fa33d79f603ad3ba3aff63ce5dc34fb85bec3e5605bc3d86db81ae9028b8483cd75b22bc897f12c5c3a6fe6c7c89cbb76738eb7b2c73dd187fd40222
- SSDEEP 12288:9SvO2x9mONvKRILSFnOkx2LIaxya5FAQjU/LikG8:cvO2xJKRI2FOkx2LFEvcU68
- TLSH T1C0F45A31E2418036D5B34576C6FA0BBFB5647D25131165CBA3C8BA262FB36D2BA3170E
- MD5 SHA1 SHA512 SSDEEP TLSH