Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
11/05/2026, 21:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cab22337a1c2a11af74db4dd7f95700db58e37e766b94bea053229fd13d55168.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
cab22337a1c2a11af74db4dd7f95700db58e37e766b94bea053229fd13d55168.exe
Resource
win11-20260130-en
windows11-21h2-x64
9 signatures
150 seconds
General
- Target cab22337a1c2a11af74db4dd7f95700db58e37e766b94bea053229fd13d55168.exe
- Size 395KB
- Sample260511-z9rfaaay2w
- SHA256 cab22337a1c2a11af74db4dd7f95700db58e37e766b94bea053229fd13d55168
- MD5 e6c033e7f016a1b8dccbc10eeb9b3320
- SHA1 66300e66e9741b75f0b134c5b6fdf5fc5be464f5
- SHA512 5de62e3947f2ecebe534f8cfd58f857115fb969505c44e0c95e6e3de5042530e27ce383cd959e85ba27b02ba3d67cea737506093cd37f922d41d88c03b9e6dda
- SSDEEP 6144:qcbcTgav1cdCTuoPbgwmOLJvKRILSFvdFDcEOkCybEaQRXr9HNdvOa:qCSvO2x9mONvKRILSFnOkx2LIa
- TLSH T173846D2AB6A0D076C4B79579C4A247BAFBB1742137204ACFA390475A1F637E2BD3530D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 860 b02f58f3 - Unexpected DNS network traffic destination 6 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 114 114.114.114.114 3420 cab22337a1c2a11af74db4dd7f95700db58e37e766b94bea053229fd13d55168.exe Destination IP 115 223.5.5.5 3420 cab22337a1c2a11af74db4dd7f95700db58e37e766b94bea053229fd13d55168.exe Destination IP 3 114.114.114.114 3420 cab22337a1c2a11af74db4dd7f95700db58e37e766b94bea053229fd13d55168.exe Destination IP 4 223.5.5.5 3420 cab22337a1c2a11af74db4dd7f95700db58e37e766b94bea053229fd13d55168.exe Destination IP 44 114.114.114.114 3420 cab22337a1c2a11af74db4dd7f95700db58e37e766b94bea053229fd13d55168.exe Destination IP 47 223.5.5.5 3420 cab22337a1c2a11af74db4dd7f95700db58e37e766b94bea053229fd13d55168.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData b02f58f3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 b02f58f3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 b02f58f3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE b02f58f3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies b02f58f3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 b02f58f3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 b02f58f3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content b02f58f3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 b02f58f3 File created C:\Windows\SysWOW64\b02f58f3 cab22337a1c2a11af74db4dd7f95700db58e37e766b94bea053229fd13d55168.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 b02f58f3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft b02f58f3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache b02f58f3 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\eb938 b02f58f3 File opened for modification C:\Windows\3a8d38 cab22337a1c2a11af74db4dd7f95700db58e37e766b94bea053229fd13d55168.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cab22337a1c2a11af74db4dd7f95700db58e37e766b94bea053229fd13d55168.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b02f58f3 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix b02f58f3 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" b02f58f3 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ b02f58f3 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" b02f58f3 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" b02f58f3 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" b02f58f3 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" b02f58f3 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" b02f58f3 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing b02f58f3 - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 860 b02f58f3 860 b02f58f3 860 b02f58f3 860 b02f58f3 860 b02f58f3 860 b02f58f3 860 b02f58f3 860 b02f58f3 860 b02f58f3 860 b02f58f3 860 b02f58f3 860 b02f58f3 3420 cab22337a1c2a11af74db4dd7f95700db58e37e766b94bea053229fd13d55168.exe 3420 cab22337a1c2a11af74db4dd7f95700db58e37e766b94bea053229fd13d55168.exe 3420 cab22337a1c2a11af74db4dd7f95700db58e37e766b94bea053229fd13d55168.exe 3420 cab22337a1c2a11af74db4dd7f95700db58e37e766b94bea053229fd13d55168.exe 3420 cab22337a1c2a11af74db4dd7f95700db58e37e766b94bea053229fd13d55168.exe 3420 cab22337a1c2a11af74db4dd7f95700db58e37e766b94bea053229fd13d55168.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3420 cab22337a1c2a11af74db4dd7f95700db58e37e766b94bea053229fd13d55168.exe Token: SeTcbPrivilege 3420 cab22337a1c2a11af74db4dd7f95700db58e37e766b94bea053229fd13d55168.exe Token: SeDebugPrivilege 860 b02f58f3 Token: SeTcbPrivilege 860 b02f58f3
Processes
-
C:\Users\Admin\AppData\Local\Temp\cab22337a1c2a11af74db4dd7f95700db58e37e766b94bea053229fd13d55168.exe"C:\Users\Admin\AppData\Local\Temp\cab22337a1c2a11af74db4dd7f95700db58e37e766b94bea053229fd13d55168.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3420
-
C:\Windows\Syswow64\b02f58f3C:\Windows\Syswow64\b02f58f31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:860
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\b02f58f3
- Size 395KB
- SHA256 94fd0e8e630fb89e8d29b0cdd72f6fef733de363fdb4a837db074d3f8323c592
- MD5 3a69a3c7af34a63e2927ff58f8b0ff01
- SHA1 d1f2ff03c0994a3b038da627ef1eaabf0432430a
- SHA512 ffa43fb069ce7fd0dd3a8c755bde783e82c6dc1d8f20da024598cf9ded3d20ce05c3f9b15e040ac3084e742bcfebc1cd386dabc426d9e37fb3a1acff1ee2593b
- SSDEEP 6144:UcbcTgav1cdCTuoPbgwmOLJvKRILSFvdFDcEOkCybEaQRXr9HNdvOa:UCSvO2x9mONvKRILSFnOkx2LIa
- TLSH T182846D2AB6A0D076C4B79579C4A247BAFBB1742137204ACFA390475A1F637E2BD3530D
- MD5 SHA1 SHA512 SSDEEP TLSH