Analysis
- max time kernel
149s - max time network
134s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
01/06/2026, 10:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
652d1433e2a70f261d2db062a27ec5fc68570393853dbf6c843956898be13eae.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
652d1433e2a70f261d2db062a27ec5fc68570393853dbf6c843956898be13eae.exe
Resource
win11-20260513-en
windows11-21h2-x64
8 signatures
150 seconds
General
- Target 652d1433e2a70f261d2db062a27ec5fc68570393853dbf6c843956898be13eae.exe
- Size 374KB
- Sample260601-men1fsbt2q
- SHA256 652d1433e2a70f261d2db062a27ec5fc68570393853dbf6c843956898be13eae
- MD5 3b47b8d1b90821c8dd0347d7ba5f0de3
- SHA1 f6b8f3fbe61b76e38843536f511a5c4f4f70dbc8
- SHA512 74e695c522717b6bf1320024a59b30246ceaea429547b04bcc9fefccf1aabd38747210cb6e1e0454e3f0edbeaef44868b2a6b82919da453ff1645a51ae138707
- SSDEEP 6144:zcTgav1cdCTuoPbgwmOLJvKRILSFvdFDcEOkCybEaQRXr9HNdvOa:zSvO2x9mONvKRILSFnOkx2LIa
- TLSH T109846D2AF6A0D076C4779579C4A247AAFBB1742137208ACFA390475A1F637E2BD3530D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1608 319a7ed4 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 1 114.114.114.114 952 652d1433e2a70f261d2db062a27ec5fc68570393853dbf6c843956898be13eae.exe Destination IP 2 223.5.5.5 952 652d1433e2a70f261d2db062a27ec5fc68570393853dbf6c843956898be13eae.exe Destination IP 5 114.114.114.114 952 652d1433e2a70f261d2db062a27ec5fc68570393853dbf6c843956898be13eae.exe Destination IP 6 223.5.5.5 952 652d1433e2a70f261d2db062a27ec5fc68570393853dbf6c843956898be13eae.exe - Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\319a7ed4 652d1433e2a70f261d2db062a27ec5fc68570393853dbf6c843956898be13eae.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 319a7ed4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 319a7ed4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 319a7ed4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 319a7ed4 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\1b8790 319a7ed4 File opened for modification C:\Windows\104c70 652d1433e2a70f261d2db062a27ec5fc68570393853dbf6c843956898be13eae.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 652d1433e2a70f261d2db062a27ec5fc68570393853dbf6c843956898be13eae.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 319a7ed4 - Modifies data under HKEY_USERS 8 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 319a7ed4 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 319a7ed4 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 319a7ed4 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 319a7ed4 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 319a7ed4 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 319a7ed4 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 319a7ed4 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 319a7ed4 - Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 1608 319a7ed4 1608 319a7ed4 1608 319a7ed4 1608 319a7ed4 1608 319a7ed4 1608 319a7ed4 1608 319a7ed4 1608 319a7ed4 1608 319a7ed4 1608 319a7ed4 1608 319a7ed4 1608 319a7ed4 1608 319a7ed4 1608 319a7ed4 1608 319a7ed4 1608 319a7ed4 1608 319a7ed4 1608 319a7ed4 1608 319a7ed4 1608 319a7ed4 952 652d1433e2a70f261d2db062a27ec5fc68570393853dbf6c843956898be13eae.exe 952 652d1433e2a70f261d2db062a27ec5fc68570393853dbf6c843956898be13eae.exe 952 652d1433e2a70f261d2db062a27ec5fc68570393853dbf6c843956898be13eae.exe 952 652d1433e2a70f261d2db062a27ec5fc68570393853dbf6c843956898be13eae.exe 952 652d1433e2a70f261d2db062a27ec5fc68570393853dbf6c843956898be13eae.exe 952 652d1433e2a70f261d2db062a27ec5fc68570393853dbf6c843956898be13eae.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 952 652d1433e2a70f261d2db062a27ec5fc68570393853dbf6c843956898be13eae.exe Token: SeTcbPrivilege 952 652d1433e2a70f261d2db062a27ec5fc68570393853dbf6c843956898be13eae.exe Token: SeDebugPrivilege 1608 319a7ed4 Token: SeTcbPrivilege 1608 319a7ed4
Processes
-
C:\Users\Admin\AppData\Local\Temp\652d1433e2a70f261d2db062a27ec5fc68570393853dbf6c843956898be13eae.exe"C:\Users\Admin\AppData\Local\Temp\652d1433e2a70f261d2db062a27ec5fc68570393853dbf6c843956898be13eae.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:952
-
C:\Windows\Syswow64\319a7ed4C:\Windows\Syswow64\319a7ed41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1608
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\1b8790
- Size 786B
- SHA256 7adfe3ba4f7a882e387a3e167f179a299104a5ddb077ab20a4a57e7bc514273b
- MD5 fc4f23fc6444d70be73f8881c82bb8b4
- SHA1 d937d9a7dccf32ce1c06d9a3a8243636e7229e40
- SHA512 efd499a09ea8c825afe1d3f62056515d410a098b5e7d76551e31d19c335da9c7b0a2b061a0112af15be5ba7e4157de9e4eedbed17d7c6539ea36f463d5577079
- TLSH T191014E3199B48642D58C5F9B3FFA9CDA2512BA04A877174B29F221C0246B3BE4947C5F
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\319a7ed4
- Size 374KB
- SHA256 a044cf996dde6ec785cd03d95331234e8296bab8ea8201754aee777ff3f63754
- MD5 0b8830b8241f31c8b99cc8a960ebf5ba
- SHA1 f8bdc94783f89b9e32331464b9b74f71df8e152e
- SHA512 2e0f941429ebe452d23473d1130acaf440a3aeb43c4d55f617fb06bed33db8d673e4075eb2eb9870197813a896386ad3162a941e2f9490a54212476f4d25477f
- SSDEEP 6144:7cTgav1cdCTuoPbgwmOLJvKRILSFvdFDcEOkCybEaQRXr9HNdvOa:7SvO2x9mONvKRILSFnOkx2LIa
- TLSH T16E846D2AF6A0D076C4779579C4A247AAFBB1742137208ACFA390475A1F637E2BD3530D
- MD5 SHA1 SHA512 SSDEEP TLSH