Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
11/05/2026, 20:03
Behavioral task
behavioral1
Sample
7101f10aa1ee868ebbfe8ea8f9f1b7edd7ee4f3c46f8c5eb65f9fe0f576b17e0.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 7101f10aa1ee868ebbfe8ea8f9f1b7edd7ee4f3c46f8c5eb65f9fe0f576b17e0.exe
- Size 1024KB
- Sample260511-ys69qsds4q
- SHA256 7101f10aa1ee868ebbfe8ea8f9f1b7edd7ee4f3c46f8c5eb65f9fe0f576b17e0
- MD5 c688aed7276810b263ae73a8739d1bcd
- SHA1 c9420177e26dc9d7659c09ab58adba2b2146e831
- SHA512 0b8febea929e00a9b1b9bfd11c13b3df46dc9c35a7935c1856062047494bf9433e896d2595154dff03a4f2c5ad66d406c1c740e08ff8f10c3e7cbd8fad332917
- SSDEEP 24576:sjHPOSOkx2LFshuZ98Es8k3OH3C0rQ6+y:sTGkQyhuTtS0rQi
- TLSH T1C025AF31E242C03AD5A70172C6BE0BAF95787D25472951C7A3D43D6A2FB22D2AE3570F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4300 327f2049 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 4 223.5.5.5 1696 7101f10aa1ee868ebbfe8ea8f9f1b7edd7ee4f3c46f8c5eb65f9fe0f576b17e0.exe Destination IP 33 114.114.114.114 1696 7101f10aa1ee868ebbfe8ea8f9f1b7edd7ee4f3c46f8c5eb65f9fe0f576b17e0.exe Destination IP 36 223.5.5.5 1696 7101f10aa1ee868ebbfe8ea8f9f1b7edd7ee4f3c46f8c5eb65f9fe0f576b17e0.exe Destination IP 3 114.114.114.114 1696 7101f10aa1ee868ebbfe8ea8f9f1b7edd7ee4f3c46f8c5eb65f9fe0f576b17e0.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 327f2049 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 327f2049 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 327f2049 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 327f2049 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 327f2049 File created C:\Windows\SysWOW64\327f2049 7101f10aa1ee868ebbfe8ea8f9f1b7edd7ee4f3c46f8c5eb65f9fe0f576b17e0.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 327f2049 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 327f2049 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AAD646CB44373074ADE741C38400E7E1 327f2049 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 327f2049 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 327f2049 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 327f2049 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 327f2049 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 327f2049 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AAD646CB44373074ADE741C38400E7E1 327f2049 -
resource yara_rule behavioral1/memory/1696-0-0x0000000000D60000-0x0000000000DE9000-memory.dmp upx behavioral1/files/0x0008000000024399-2.dat upx behavioral1/memory/4300-3-0x0000000000250000-0x00000000002D9000-memory.dmp upx behavioral1/memory/1696-19-0x0000000000D60000-0x0000000000DE9000-memory.dmp upx behavioral1/memory/4300-22-0x0000000000250000-0x00000000002D9000-memory.dmp upx behavioral1/memory/1696-34-0x0000000000D60000-0x0000000000DE9000-memory.dmp upx behavioral1/memory/4300-35-0x0000000000250000-0x00000000002D9000-memory.dmp upx behavioral1/memory/4300-49-0x0000000000250000-0x00000000002D9000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\499e18 327f2049 File opened for modification C:\Windows\1d0940 7101f10aa1ee868ebbfe8ea8f9f1b7edd7ee4f3c46f8c5eb65f9fe0f576b17e0.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7101f10aa1ee868ebbfe8ea8f9f1b7edd7ee4f3c46f8c5eb65f9fe0f576b17e0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 327f2049 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 327f2049 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 327f2049 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 327f2049 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 327f2049 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 327f2049 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 327f2049 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 327f2049 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 327f2049 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 327f2049 - Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 4300 327f2049 4300 327f2049 4300 327f2049 4300 327f2049 4300 327f2049 4300 327f2049 4300 327f2049 4300 327f2049 4300 327f2049 4300 327f2049 4300 327f2049 4300 327f2049 4300 327f2049 4300 327f2049 4300 327f2049 4300 327f2049 4300 327f2049 4300 327f2049 4300 327f2049 4300 327f2049 1696 7101f10aa1ee868ebbfe8ea8f9f1b7edd7ee4f3c46f8c5eb65f9fe0f576b17e0.exe 1696 7101f10aa1ee868ebbfe8ea8f9f1b7edd7ee4f3c46f8c5eb65f9fe0f576b17e0.exe 1696 7101f10aa1ee868ebbfe8ea8f9f1b7edd7ee4f3c46f8c5eb65f9fe0f576b17e0.exe 1696 7101f10aa1ee868ebbfe8ea8f9f1b7edd7ee4f3c46f8c5eb65f9fe0f576b17e0.exe 1696 7101f10aa1ee868ebbfe8ea8f9f1b7edd7ee4f3c46f8c5eb65f9fe0f576b17e0.exe 1696 7101f10aa1ee868ebbfe8ea8f9f1b7edd7ee4f3c46f8c5eb65f9fe0f576b17e0.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1696 7101f10aa1ee868ebbfe8ea8f9f1b7edd7ee4f3c46f8c5eb65f9fe0f576b17e0.exe Token: SeTcbPrivilege 1696 7101f10aa1ee868ebbfe8ea8f9f1b7edd7ee4f3c46f8c5eb65f9fe0f576b17e0.exe Token: SeDebugPrivilege 4300 327f2049 Token: SeTcbPrivilege 4300 327f2049
Processes
-
C:\Users\Admin\AppData\Local\Temp\7101f10aa1ee868ebbfe8ea8f9f1b7edd7ee4f3c46f8c5eb65f9fe0f576b17e0.exe"C:\Users\Admin\AppData\Local\Temp\7101f10aa1ee868ebbfe8ea8f9f1b7edd7ee4f3c46f8c5eb65f9fe0f576b17e0.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1696
-
C:\Windows\Syswow64\327f2049C:\Windows\Syswow64\327f20491⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4300
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\499e18
- Size 702B
- SHA256 ac269d26cd9970c07b3267741b017ab1212535571d97a8e43a8837dbe647dabf
- MD5 bdd494bcf4f437453dbb7f0c503dd367
- SHA1 5f905a00f815ad0e0aed3d152e84a16ddf87c261
- SHA512 3341bd466633d65cda4445e454236f0f08a3124d92d566ee0055e1c127276789138c329d211dec4bc940ffd64950dfe57da4de44303438817407164210271810
- TLSH T1AF01F4BFEE5663D50CFD0D136813D8813292D26B6493C1857A63334D0163E775912847
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\327f2049
- Size 1024KB
- SHA256 fa3e5181bd8e41f944a487fb508288ab67bd45fa326654c4653b2307dc2761cb
- MD5 141b113cbe56679a0ab7613fff1a4d4d
- SHA1 4314c785fd1f4f5601db1dfb9f14a1c46ac8fce4
- SHA512 544db1a12b67db3ca08f37550e773de8437e8d89b73a9216ccc77d671f1d7a1e2e0b06c1edb43f9298a9943ea7df999cdcead3347fc72ddb658e019cf2b44a68
- SSDEEP 24576:mjHPOSOkx2LFshuZ98Es8k3OH3C0rQ6+y:mTGkQyhuTtS0rQi
- TLSH T1A625AF31E242C03AD5A70172C6BE0BAF95787D25472951C7A3D43D6A2FB22D2AE3570F
- MD5 SHA1 SHA512 SSDEEP TLSH