Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/07/2026, 20:04
Behavioral task
behavioral1
Sample
84457f977be0139f170bbd77b32e0fd87984470b78e3e0925088b6545b67941d.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 84457f977be0139f170bbd77b32e0fd87984470b78e3e0925088b6545b67941d.exe
- Size 1024KB
- Sample260702-ythb1ady9x
- SHA256 84457f977be0139f170bbd77b32e0fd87984470b78e3e0925088b6545b67941d
- MD5 9d55693cdc16c0d9785a9cd2a3bdecb1
- SHA1 1d956496ebc799f926cd2dfd0f470f06274ff94d
- SHA512 07425ff705c2160fa22a7bde2d052b1c67b8304c9ef31a2fdc0ece7632d77e0b1681099f6ef79a76ab60b0b09047e73569982d6771b61afa600dcd9e88155539
- SSDEEP 24576:7jHPOSOkx2LFscUQPxuZ98Es8k3OH3C0rQ6+y:7TGkQy5QZuTtS0rQi
- TLSH T17F259E31E242C03AD5A70172C6BE4BAF95687D25432961C7E3D43D762FB62D2AA3170F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4308 83a29d68 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 3 114.114.114.114 4632 84457f977be0139f170bbd77b32e0fd87984470b78e3e0925088b6545b67941d.exe Destination IP 6 223.5.5.5 4632 84457f977be0139f170bbd77b32e0fd87984470b78e3e0925088b6545b67941d.exe Destination IP 31 114.114.114.114 4632 84457f977be0139f170bbd77b32e0fd87984470b78e3e0925088b6545b67941d.exe Destination IP 32 223.5.5.5 4632 84457f977be0139f170bbd77b32e0fd87984470b78e3e0925088b6545b67941d.exe - Drops file in System32 directory 15 IoCs
description ioc Process File created C:\Windows\SysWOW64\83a29d68 84457f977be0139f170bbd77b32e0fd87984470b78e3e0925088b6545b67941d.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 83a29d68 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AAD646CB44373074ADE741C38400E7E1 83a29d68 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AAD646CB44373074ADE741C38400E7E1 83a29d68 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 83a29d68 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC845F33427F1C99AF855BE8930371C 83a29d68 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC845F33427F1C99AF855BE8930371C 83a29d68 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 83a29d68 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 83a29d68 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 83a29d68 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 83a29d68 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 83a29d68 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 83a29d68 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 83a29d68 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 83a29d68 -
resource yara_rule behavioral1/memory/4632-0-0x00000000006D0000-0x0000000000759000-memory.dmp upx behavioral1/files/0x000b0000000242ff-3.dat upx behavioral1/memory/4308-4-0x0000000000B60000-0x0000000000BE9000-memory.dmp upx behavioral1/memory/4632-12-0x00000000006D0000-0x0000000000759000-memory.dmp upx behavioral1/memory/4308-14-0x0000000000B60000-0x0000000000BE9000-memory.dmp upx behavioral1/memory/4632-26-0x00000000006D0000-0x0000000000759000-memory.dmp upx behavioral1/memory/4308-27-0x0000000000B60000-0x0000000000BE9000-memory.dmp upx behavioral1/memory/4632-53-0x00000000006D0000-0x0000000000759000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\49c128 83a29d68 File opened for modification C:\Windows\4f4d30 84457f977be0139f170bbd77b32e0fd87984470b78e3e0925088b6545b67941d.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84457f977be0139f170bbd77b32e0fd87984470b78e3e0925088b6545b67941d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83a29d68 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 83a29d68 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 83a29d68 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 83a29d68 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 83a29d68 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 83a29d68 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 83a29d68 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 83a29d68 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 83a29d68 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 83a29d68 - Modifies system certificate store 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1F24C630CDA418EF2069FFAD4FDD5F463A1B69AA 83a29d68 Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1F24C630CDA418EF2069FFAD4FDD5F463A1B69AA\Blob = 5c0000000100000004000000800100000f0000000100000030000000f019c7ba12795dacd6ef1a767657deb8e41060a2ad1a6c66900a6ec16870fc06eecbaffdd3e2c986659578e7e85e535a530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003800000047006c006f00620061006c005300690067006e002000450043004300200052006f006f00740020004300410020002d002000520035000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308620000000100000020000000179fbc148a3dd00fd24ea13458cc43bfa7f59c8182d783a513f6ebec100c89241400000001000000140000003de629489bea07ca21444a26de6eded283d09f591d0000000100000010000000b647dd2a9ccadee75e8905e256cc6b147f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d7010300000001000000140000001f24c630cda418ef2069ffad4fdd5f463a1b69aa190000000100000010000000e3087c0c81f60a2a2b466b8a3e70cce82000000001000000220200003082021e308201a4a0030201020211605949e0262ebb55f90a778a71f94ad86c300a06082a8648ce3d040303305031243022060355040b131b476c6f62616c5369676e2045434320526f6f74204341202d20523531133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3132313131333030303030305a170d3338303131393033313430375a305031243022060355040b131b476c6f62616c5369676e2045434320526f6f74204341202d20523531133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e3076301006072a8648ce3d020106052b810400220362000447450e96fb7d5dbfe939d121f89f0bb6d57b1e923a48591cf062312dc07a28fe1aa75cb3b6cc97e745d458fad1776d43a2c08765340a1f7addeb3c33a1c59d4da46f4195387fc91e84ebd19e49928794870c3a854a669f9d59934d976106864aa3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604143de629489bea07ca21444a26de6eded283d09f59300a06082a8648ce3d0403030368003065023100e56912c96edbc631ba0941e197f8fbfd9ae27d12c9ed7c64d3cb05258b56d9a0e75e5d4e0b839c5b7629a00926216a62023071d2b58f5cea3be1780985a875923bc85cfd48ef0d7422a808e26ec549cec70cbca76169f1f73be12acbf92bf3669037 83a29d68 - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 4308 83a29d68 4308 83a29d68 4308 83a29d68 4308 83a29d68 4308 83a29d68 4308 83a29d68 4308 83a29d68 4308 83a29d68 4308 83a29d68 4308 83a29d68 4308 83a29d68 4308 83a29d68 4632 84457f977be0139f170bbd77b32e0fd87984470b78e3e0925088b6545b67941d.exe 4632 84457f977be0139f170bbd77b32e0fd87984470b78e3e0925088b6545b67941d.exe 4632 84457f977be0139f170bbd77b32e0fd87984470b78e3e0925088b6545b67941d.exe 4632 84457f977be0139f170bbd77b32e0fd87984470b78e3e0925088b6545b67941d.exe 4632 84457f977be0139f170bbd77b32e0fd87984470b78e3e0925088b6545b67941d.exe 4632 84457f977be0139f170bbd77b32e0fd87984470b78e3e0925088b6545b67941d.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4632 84457f977be0139f170bbd77b32e0fd87984470b78e3e0925088b6545b67941d.exe Token: SeTcbPrivilege 4632 84457f977be0139f170bbd77b32e0fd87984470b78e3e0925088b6545b67941d.exe Token: SeDebugPrivilege 4308 83a29d68 Token: SeTcbPrivilege 4308 83a29d68
Processes
-
C:\Users\Admin\AppData\Local\Temp\84457f977be0139f170bbd77b32e0fd87984470b78e3e0925088b6545b67941d.exe"C:\Users\Admin\AppData\Local\Temp\84457f977be0139f170bbd77b32e0fd87984470b78e3e0925088b6545b67941d.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4632
-
C:\Windows\Syswow64\83a29d68C:\Windows\Syswow64\83a29d681⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4308
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\49c128
- Size 506B
- SHA256 3d3c49f93e0e28113c6cc976c5a012431268a7c7edfe35a3fdc999a520f791f4
- MD5 52393beb42110eac0cd7fd50f4cc89fa
- SHA1 eed124a076f9e613a38c3b5a78c281bd3dc777ee
- SHA512 c09e51a83234a032fb9fc9f746b10ebe4d438de3cebf82fbdfc55f1f8241e1c6276aeb75feab081e16a4a79a015f06d8c11b87d8833cbc7bb72d011b155f2f2f
- TLSH T14CF00E3E962E36F38BFE8C7A890EB8ADB81E502E428B711119F9705842E309E9C03404
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\83a29d68
- Size 1024KB
- SHA256 407033b9d5de0125507f392a060d5e08956ac4bf3a4998f5623f42ca6afdeb7e
- MD5 eca2cf8191060773734356c5a33189cb
- SHA1 3f333c1fa0d67395bfedd492a5b87587eb7b608e
- SHA512 00246bc87c3ef3d5b1018c5ecae25ca1ec0a3d950a1b8d3e8a69c882430e2e16ae302aaf4039701e65c2911987978fe0cb6a5382f608d3c166c2730fc5962bb4
- SSDEEP 24576:mjHPOSOkx2LFscUQPxuZ98Es8k3OH3C0rQ6+y:mTGkQy5QZuTtS0rQi
- TLSH T12B259E31E242C03AD5A70172C6BE4BAF95687D25432961C7A3D43D762FB62D2AA3170F
- MD5 SHA1 SHA512 SSDEEP TLSH