Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
27/05/2026, 13:31
Behavioral task
behavioral1
Sample
b14f954c59fd428c82061e49e87a4d157c98b2c1656b87c70276ce40d6cf1e71.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target b14f954c59fd428c82061e49e87a4d157c98b2c1656b87c70276ce40d6cf1e71.exe
- Size 638KB
- Sample260527-qsdcnaex5r
- SHA256 b14f954c59fd428c82061e49e87a4d157c98b2c1656b87c70276ce40d6cf1e71
- MD5 7dba278376ce6548ca2ccd4c0b9cc81d
- SHA1 e276bf94ea0f6a8c1d721300f594fa381612c198
- SHA512 c94bfe0936923ab3370cacb266f1b658716dcfe46ff100254e53c443d0a3c01a003416416c7395715672d3c944e576eff086d767957bce8d50a5d094b9fd5dfc
- SSDEEP 6144:AcTgav1cdCTuoPbgwmOLJvKRwLSFXdFwirGcEOkCybEaQRXr9HNdvOa+y8KU5R2:ASvO2x9mONvKRwLSFtsOkx2LIa+ya5g
- TLSH T101D46B26B6908037C0B74675C5B64BAAFAB5BC21631186CFA380761A1F737D2BE3570D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 896 9a46ff4d - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 3 114.114.114.114 2572 b14f954c59fd428c82061e49e87a4d157c98b2c1656b87c70276ce40d6cf1e71.exe Destination IP 4 223.5.5.5 2572 b14f954c59fd428c82061e49e87a4d157c98b2c1656b87c70276ce40d6cf1e71.exe Destination IP 55 114.114.114.114 2572 b14f954c59fd428c82061e49e87a4d157c98b2c1656b87c70276ce40d6cf1e71.exe Destination IP 58 223.5.5.5 2572 b14f954c59fd428c82061e49e87a4d157c98b2c1656b87c70276ce40d6cf1e71.exe - Drops file in System32 directory 17 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 9a46ff4d File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 9a46ff4d File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 9a46ff4d File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 9a46ff4d File created C:\Windows\SysWOW64\9a46ff4d b14f954c59fd428c82061e49e87a4d157c98b2c1656b87c70276ce40d6cf1e71.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 9a46ff4d File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 9a46ff4d File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 9a46ff4d File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC845F33427F1C99AF855BE8930371C 9a46ff4d File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 9a46ff4d File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC845F33427F1C99AF855BE8930371C 9a46ff4d File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 9a46ff4d File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 9a46ff4d File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 9a46ff4d File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 9a46ff4d File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 9a46ff4d File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 9a46ff4d -
resource yara_rule behavioral1/memory/2572-0-0x0000000000950000-0x00000000009DC000-memory.dmp upx behavioral1/files/0x000a0000000004e9-2.dat upx behavioral1/memory/896-4-0x0000000000890000-0x000000000091C000-memory.dmp upx behavioral1/memory/2572-12-0x0000000000950000-0x00000000009DC000-memory.dmp upx behavioral1/memory/896-13-0x0000000000890000-0x000000000091C000-memory.dmp upx behavioral1/memory/896-34-0x0000000000890000-0x000000000091C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\f5700 9a46ff4d File opened for modification C:\Windows\2c0898 b14f954c59fd428c82061e49e87a4d157c98b2c1656b87c70276ce40d6cf1e71.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9a46ff4d Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b14f954c59fd428c82061e49e87a4d157c98b2c1656b87c70276ce40d6cf1e71.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 9a46ff4d Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 9a46ff4d Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 9a46ff4d Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 9a46ff4d Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 9a46ff4d Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 9a46ff4d Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 9a46ff4d Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 9a46ff4d Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 9a46ff4d - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 896 9a46ff4d 896 9a46ff4d 896 9a46ff4d 896 9a46ff4d 896 9a46ff4d 896 9a46ff4d 896 9a46ff4d 896 9a46ff4d 896 9a46ff4d 896 9a46ff4d 896 9a46ff4d 896 9a46ff4d 2572 b14f954c59fd428c82061e49e87a4d157c98b2c1656b87c70276ce40d6cf1e71.exe 2572 b14f954c59fd428c82061e49e87a4d157c98b2c1656b87c70276ce40d6cf1e71.exe 2572 b14f954c59fd428c82061e49e87a4d157c98b2c1656b87c70276ce40d6cf1e71.exe 2572 b14f954c59fd428c82061e49e87a4d157c98b2c1656b87c70276ce40d6cf1e71.exe 2572 b14f954c59fd428c82061e49e87a4d157c98b2c1656b87c70276ce40d6cf1e71.exe 2572 b14f954c59fd428c82061e49e87a4d157c98b2c1656b87c70276ce40d6cf1e71.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2572 b14f954c59fd428c82061e49e87a4d157c98b2c1656b87c70276ce40d6cf1e71.exe Token: SeTcbPrivilege 2572 b14f954c59fd428c82061e49e87a4d157c98b2c1656b87c70276ce40d6cf1e71.exe Token: SeDebugPrivilege 896 9a46ff4d Token: SeTcbPrivilege 896 9a46ff4d
Processes
-
C:\Users\Admin\AppData\Local\Temp\b14f954c59fd428c82061e49e87a4d157c98b2c1656b87c70276ce40d6cf1e71.exe"C:\Users\Admin\AppData\Local\Temp\b14f954c59fd428c82061e49e87a4d157c98b2c1656b87c70276ce40d6cf1e71.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2572
-
C:\Windows\Syswow64\9a46ff4dC:\Windows\Syswow64\9a46ff4d1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:896
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\9a46ff4d
- Size 638KB
- SHA256 4aff464c3530986d9c732f311988d034eebfec892ae03c91b29367a44cfd5fa2
- MD5 38a91a3283ec77040a696e7df244af5c
- SHA1 ff7d419ac6d38cc1fd85dda93184a3e14ddef856
- SHA512 9b2bc4754f02aaff3e4068b3c2d2d7879c6edfc32c91adb9bf7ce5bc32fe5996f0a4dd61b96b84520838683296d9dd836e3e61dda86a1f4a9efc2c56f1be9d69
- SSDEEP 6144:WcTgav1cdCTuoPbgwmOLJvKRwLSFXdFwirGcEOkCybEaQRXr9HNdvOa+y8KU5R2:WSvO2x9mONvKRwLSFtsOkx2LIa+ya5g
- TLSH T13AD46B26B6908037C0B74675C5B64BAAFAB5BC21631186CFA380761A1F737D2BE3570D
- MD5 SHA1 SHA512 SSDEEP TLSH