Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
28/05/2026, 10:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a5ebdfe020483fb63c2aeae9a8ae4a80653993ba79aa2cc4f84269ef37da28f8.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
a5ebdfe020483fb63c2aeae9a8ae4a80653993ba79aa2cc4f84269ef37da28f8.exe
Resource
win11-20260513-en
windows11-21h2-x64
8 signatures
150 seconds
General
- Target a5ebdfe020483fb63c2aeae9a8ae4a80653993ba79aa2cc4f84269ef37da28f8.exe
- Size 4.0MB
- Sample260528-m26tsaez2v
- SHA256 a5ebdfe020483fb63c2aeae9a8ae4a80653993ba79aa2cc4f84269ef37da28f8
- MD5 16ec39643cedad93c4dc55663638aace
- SHA1 1028e91ea72260a6cbaa10eb6347b6823f82a7f5
- SHA512 4ffec39d32318bf4455fece2859ce3bcaee03b0663be2c3a606fa60e1209f9fd4023a8e6e4950a16804b166be1502c303f368398f80ca42a2851ca6a37f08e75
- SSDEEP 98304:7nKl2qOb2lP8ssYoJxKkyWsM0r1QnfKHV0Fe7:7CNDtojKL2Kqo7
- TLSH T1F316CF11F7A1C036C49701718D7A876EA678BD214B258AC7B3C47B6E5FB23D1AE3530A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4356 c55a1bdc - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 3 114.114.114.114 4580 a5ebdfe020483fb63c2aeae9a8ae4a80653993ba79aa2cc4f84269ef37da28f8.exe Destination IP 4 223.5.5.5 4580 a5ebdfe020483fb63c2aeae9a8ae4a80653993ba79aa2cc4f84269ef37da28f8.exe Destination IP 62 114.114.114.114 4580 a5ebdfe020483fb63c2aeae9a8ae4a80653993ba79aa2cc4f84269ef37da28f8.exe Destination IP 63 223.5.5.5 4580 a5ebdfe020483fb63c2aeae9a8ae4a80653993ba79aa2cc4f84269ef37da28f8.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE c55a1bdc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies c55a1bdc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 c55a1bdc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content c55a1bdc File created C:\Windows\SysWOW64\c55a1bdc a5ebdfe020483fb63c2aeae9a8ae4a80653993ba79aa2cc4f84269ef37da28f8.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 c55a1bdc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft c55a1bdc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache c55a1bdc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData c55a1bdc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 c55a1bdc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC845F33427F1C99AF855BE8930371C c55a1bdc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC845F33427F1C99AF855BE8930371C c55a1bdc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 c55a1bdc - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\4e6948 a5ebdfe020483fb63c2aeae9a8ae4a80653993ba79aa2cc4f84269ef37da28f8.exe File opened for modification C:\Windows\4a9388 c55a1bdc - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c55a1bdc Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a5ebdfe020483fb63c2aeae9a8ae4a80653993ba79aa2cc4f84269ef37da28f8.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" c55a1bdc Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing c55a1bdc Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" c55a1bdc Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" c55a1bdc Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" c55a1bdc Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" c55a1bdc Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix c55a1bdc Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ c55a1bdc Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" c55a1bdc - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 4356 c55a1bdc 4356 c55a1bdc 4356 c55a1bdc 4356 c55a1bdc 4356 c55a1bdc 4356 c55a1bdc 4356 c55a1bdc 4356 c55a1bdc 4356 c55a1bdc 4356 c55a1bdc 4356 c55a1bdc 4356 c55a1bdc 4580 a5ebdfe020483fb63c2aeae9a8ae4a80653993ba79aa2cc4f84269ef37da28f8.exe 4580 a5ebdfe020483fb63c2aeae9a8ae4a80653993ba79aa2cc4f84269ef37da28f8.exe 4580 a5ebdfe020483fb63c2aeae9a8ae4a80653993ba79aa2cc4f84269ef37da28f8.exe 4580 a5ebdfe020483fb63c2aeae9a8ae4a80653993ba79aa2cc4f84269ef37da28f8.exe 4580 a5ebdfe020483fb63c2aeae9a8ae4a80653993ba79aa2cc4f84269ef37da28f8.exe 4580 a5ebdfe020483fb63c2aeae9a8ae4a80653993ba79aa2cc4f84269ef37da28f8.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4580 a5ebdfe020483fb63c2aeae9a8ae4a80653993ba79aa2cc4f84269ef37da28f8.exe Token: SeTcbPrivilege 4580 a5ebdfe020483fb63c2aeae9a8ae4a80653993ba79aa2cc4f84269ef37da28f8.exe Token: SeDebugPrivilege 4356 c55a1bdc Token: SeTcbPrivilege 4356 c55a1bdc
Processes
-
C:\Users\Admin\AppData\Local\Temp\a5ebdfe020483fb63c2aeae9a8ae4a80653993ba79aa2cc4f84269ef37da28f8.exe"C:\Users\Admin\AppData\Local\Temp\a5ebdfe020483fb63c2aeae9a8ae4a80653993ba79aa2cc4f84269ef37da28f8.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4580
-
C:\Windows\Syswow64\c55a1bdcC:\Windows\Syswow64\c55a1bdc1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4356
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\c55a1bdc
- Size 4.0MB
- SHA256 60b85c5435c8a654fca77cca7451555bcc949d4c5120eaa83598769d943818b0
- MD5 bff3210463b414bd610e5530e06e8ea4
- SHA1 440b83835ed9cf455a95ec52140ec81a67fe0b57
- SHA512 3c9f13ebe166709cbc48ed5b8c935df94c2e7df40aa34ba460cfbb7090eeca9a0d53329931d0ffa5aa6dbe3d76f8d59df73e8bac6b3b065c14b8e60dd4fb1fbf
- SSDEEP 98304:/nKl2qOb2lP8ssYoJxKkyWsM0r1QnfKHV0Fe7:/CNDtojKL2Kqo7
- TLSH T1C316CF11F7A1C036C49701718D7A876EA678BD214B258AC7B3C47B6E5FB23D1AE3530A
- MD5 SHA1 SHA512 SSDEEP TLSH