Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
29/05/2026, 05:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1c36224b3f8be2073efd69a57e394bec073725b693d6e486cc6236d1b7294cc3.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
1c36224b3f8be2073efd69a57e394bec073725b693d6e486cc6236d1b7294cc3.exe
Resource
win11-20260513-en
windows11-21h2-x64
8 signatures
150 seconds
General
- Target 1c36224b3f8be2073efd69a57e394bec073725b693d6e486cc6236d1b7294cc3.exe
- Size 2.0MB
- Sample260529-fpca3sds9t
- SHA256 1c36224b3f8be2073efd69a57e394bec073725b693d6e486cc6236d1b7294cc3
- MD5 b5b5972d35b4f4a37a9b3a3ba14283ef
- SHA1 6c07ebc405c509417489e0fda957ed55181a1ec4
- SHA512 ef2d19db360c4b8d5c0d2631a8dfa00f01173c570b6bab26a9d3b4189623275f56747f960505d461ac0846ca368d1b3d6783490ae10b47801fbeefe8886e8423
- SSDEEP 49152:LHHKO29QG56/OJdJCXDrsOFZMjHfUTGkQy58:LnKdVkOhCXHHFZMjHfUKkVi
- TLSH T1BCA57D31A6C18036E1B3867586FA56FAA5247C216311A5CF63C47A2A1F737D3EE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3796 e3aad940 - Unexpected DNS network traffic destination 6 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 61 114.114.114.114 3180 1c36224b3f8be2073efd69a57e394bec073725b693d6e486cc6236d1b7294cc3.exe Destination IP 62 223.5.5.5 3180 1c36224b3f8be2073efd69a57e394bec073725b693d6e486cc6236d1b7294cc3.exe Destination IP 129 114.114.114.114 3180 1c36224b3f8be2073efd69a57e394bec073725b693d6e486cc6236d1b7294cc3.exe Destination IP 130 223.5.5.5 3180 1c36224b3f8be2073efd69a57e394bec073725b693d6e486cc6236d1b7294cc3.exe Destination IP 3 114.114.114.114 3180 1c36224b3f8be2073efd69a57e394bec073725b693d6e486cc6236d1b7294cc3.exe Destination IP 4 223.5.5.5 3180 1c36224b3f8be2073efd69a57e394bec073725b693d6e486cc6236d1b7294cc3.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 e3aad940 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE e3aad940 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies e3aad940 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft e3aad940 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData e3aad940 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 e3aad940 File created C:\Windows\SysWOW64\e3aad940 1c36224b3f8be2073efd69a57e394bec073725b693d6e486cc6236d1b7294cc3.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content e3aad940 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 e3aad940 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 e3aad940 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 e3aad940 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 e3aad940 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache e3aad940 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 e3aad940 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 e3aad940 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\40fd28 e3aad940 File opened for modification C:\Windows\367158 1c36224b3f8be2073efd69a57e394bec073725b693d6e486cc6236d1b7294cc3.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1c36224b3f8be2073efd69a57e394bec073725b693d6e486cc6236d1b7294cc3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e3aad940 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing e3aad940 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" e3aad940 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" e3aad940 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix e3aad940 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" e3aad940 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" e3aad940 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ e3aad940 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" e3aad940 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" e3aad940 - Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 3796 e3aad940 3796 e3aad940 3796 e3aad940 3796 e3aad940 3796 e3aad940 3796 e3aad940 3796 e3aad940 3796 e3aad940 3796 e3aad940 3796 e3aad940 3796 e3aad940 3796 e3aad940 3796 e3aad940 3796 e3aad940 3796 e3aad940 3796 e3aad940 3796 e3aad940 3796 e3aad940 3796 e3aad940 3796 e3aad940 3180 1c36224b3f8be2073efd69a57e394bec073725b693d6e486cc6236d1b7294cc3.exe 3180 1c36224b3f8be2073efd69a57e394bec073725b693d6e486cc6236d1b7294cc3.exe 3180 1c36224b3f8be2073efd69a57e394bec073725b693d6e486cc6236d1b7294cc3.exe 3180 1c36224b3f8be2073efd69a57e394bec073725b693d6e486cc6236d1b7294cc3.exe 3180 1c36224b3f8be2073efd69a57e394bec073725b693d6e486cc6236d1b7294cc3.exe 3180 1c36224b3f8be2073efd69a57e394bec073725b693d6e486cc6236d1b7294cc3.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3180 1c36224b3f8be2073efd69a57e394bec073725b693d6e486cc6236d1b7294cc3.exe Token: SeTcbPrivilege 3180 1c36224b3f8be2073efd69a57e394bec073725b693d6e486cc6236d1b7294cc3.exe Token: SeDebugPrivilege 3796 e3aad940 Token: SeTcbPrivilege 3796 e3aad940
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c36224b3f8be2073efd69a57e394bec073725b693d6e486cc6236d1b7294cc3.exe"C:\Users\Admin\AppData\Local\Temp\1c36224b3f8be2073efd69a57e394bec073725b693d6e486cc6236d1b7294cc3.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3180
-
C:\Windows\Syswow64\e3aad940C:\Windows\Syswow64\e3aad9401⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3796
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\40fd28
- Size 1KB
- SHA256 35ec21079bc00f8ba7b873f40c2696a52ff2f837ed51f9e14f25eb8b4e4bc796
- MD5 0b3cd0141d5b05be9f761f77fde6a51e
- SHA1 419da4f91b44160c3f25420878f6c9a59f8643e5
- SHA512 3d9b96f7f46f0ace1839cbf3657af158147e3dd7246e25a2567e0346010a4091df8bb883ea014bdea7a77d0e9f904a36252bc529f04403544402cfad5a1493d2
- TLSH T11521CA3EB13868A91EF8952356D56ABD020C7B2D853953247783EF62054EF20BA87A43
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\e3aad940
- Size 2.0MB
- SHA256 82925db946161ffd79c87469bf07018e89948830569e3d2c78be8ab01cae9436
- MD5 7995409dcdf44089f8464ce3eb6074f6
- SHA1 d74cf42c4a6f81a73ef6cab71d549b13c99b39d2
- SHA512 84dafe553042af09455a7a5b15b410b7cd17717f0e4d5182116fc286d027d90d51c20234c4749bc33c11ecb57860ae9bd939987cee80281c2d31e6fd27ea5e58
- SSDEEP 49152:IHHKO29QG56/OJdJCXDrsOFZMjHfUTGkQy58:InKdVkOhCXHHFZMjHfUKkVi
- TLSH T15EA57D31A6C18036E1B3867586FA56FAA5247C216311A5CF63C47A2A1F737D3EE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH