Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
28/05/2026, 11:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
68c17ef04941d654e4190f338b829a671de84df4e27b2b5b2a10882863657d70.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
68c17ef04941d654e4190f338b829a671de84df4e27b2b5b2a10882863657d70.exe
Resource
win11-20260513-en
windows11-21h2-x64
8 signatures
150 seconds
General
- Target 68c17ef04941d654e4190f338b829a671de84df4e27b2b5b2a10882863657d70.exe
- Size 4.0MB
- Sample260528-m5rt2aez5t
- SHA256 68c17ef04941d654e4190f338b829a671de84df4e27b2b5b2a10882863657d70
- MD5 c3f1c1f57cfef8dec5c038966360cd59
- SHA1 1e3c211aa7eb15ddb3146612c8cd19fc878c9792
- SHA512 68c0420d25f1ce9e5162d57bc2a3952b22edf80a28908bdeecfc6962241848459642227138945bf77a7ad831765b0506aa08c41d1361fa8b0bc071657fc87923
- SSDEEP 98304:YnKl2qOb2lP8ssYoJxKkyWsM0r1QnfKHV0Fe7:YCNDtojKL2Kqo7
- TLSH T1BA16CF11F7A1C036C49701718D7A876EA678BD214B258AC7B3C47B6E5FB23D1AE3530A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 384 467aaadc - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 1 114.114.114.114 884 68c17ef04941d654e4190f338b829a671de84df4e27b2b5b2a10882863657d70.exe Destination IP 4 223.5.5.5 884 68c17ef04941d654e4190f338b829a671de84df4e27b2b5b2a10882863657d70.exe Destination IP 59 114.114.114.114 884 68c17ef04941d654e4190f338b829a671de84df4e27b2b5b2a10882863657d70.exe Destination IP 60 223.5.5.5 884 68c17ef04941d654e4190f338b829a671de84df4e27b2b5b2a10882863657d70.exe - Drops file in System32 directory 15 IoCs
description ioc Process File created C:\Windows\SysWOW64\467aaadc 68c17ef04941d654e4190f338b829a671de84df4e27b2b5b2a10882863657d70.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 467aaadc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 467aaadc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 467aaadc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 467aaadc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 467aaadc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 467aaadc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 467aaadc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 467aaadc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 467aaadc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 467aaadc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 467aaadc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 467aaadc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 467aaadc File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 467aaadc - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\69300 467aaadc File opened for modification C:\Windows\f2268 68c17ef04941d654e4190f338b829a671de84df4e27b2b5b2a10882863657d70.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68c17ef04941d654e4190f338b829a671de84df4e27b2b5b2a10882863657d70.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 467aaadc - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 467aaadc Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 467aaadc Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 467aaadc Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 467aaadc Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 467aaadc Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 467aaadc Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 467aaadc Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 467aaadc Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 467aaadc - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 384 467aaadc 384 467aaadc 384 467aaadc 384 467aaadc 384 467aaadc 384 467aaadc 384 467aaadc 384 467aaadc 884 68c17ef04941d654e4190f338b829a671de84df4e27b2b5b2a10882863657d70.exe 884 68c17ef04941d654e4190f338b829a671de84df4e27b2b5b2a10882863657d70.exe 884 68c17ef04941d654e4190f338b829a671de84df4e27b2b5b2a10882863657d70.exe 884 68c17ef04941d654e4190f338b829a671de84df4e27b2b5b2a10882863657d70.exe 884 68c17ef04941d654e4190f338b829a671de84df4e27b2b5b2a10882863657d70.exe 884 68c17ef04941d654e4190f338b829a671de84df4e27b2b5b2a10882863657d70.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 884 68c17ef04941d654e4190f338b829a671de84df4e27b2b5b2a10882863657d70.exe Token: SeTcbPrivilege 884 68c17ef04941d654e4190f338b829a671de84df4e27b2b5b2a10882863657d70.exe Token: SeDebugPrivilege 384 467aaadc Token: SeTcbPrivilege 384 467aaadc
Processes
-
C:\Users\Admin\AppData\Local\Temp\68c17ef04941d654e4190f338b829a671de84df4e27b2b5b2a10882863657d70.exe"C:\Users\Admin\AppData\Local\Temp\68c17ef04941d654e4190f338b829a671de84df4e27b2b5b2a10882863657d70.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:884
-
C:\Windows\Syswow64\467aaadcC:\Windows\Syswow64\467aaadc1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:384
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\467aaadc
- Size 4.0MB
- SHA256 4ec245313ea9ec5e86e3e61c70b31fa434c9be983a611c7d83e9366659f7976f
- MD5 42ed051109499e5c01f076573e826c8a
- SHA1 6b1387fca1df97f52004be199a63210c8b14bca9
- SHA512 ec7914d70a411c32931dda4c8bf99ce9c53accefcda9e5111450ae6941da9169d6faed2060b69af2df4f9bc1ef4d1c40787522edfd15d096fa5346ebb1456ccf
- SSDEEP 98304:AnKl2qOb2lP8ssYoJxKkyWsM0r1QnfKHV0Fe7:ACNDtojKL2Kqo7
- TLSH T1FB16CF11F7A1C036C49701718D7A876EA678BD214B258AC7B3C47B6E5FB23D1AE3530A
- MD5 SHA1 SHA512 SSDEEP TLSH