Analysis
- max time kernel
148s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/07/2026, 22:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2e287e69cd222f3c706401f734690f3a52057a251f9c44277f0652a77ca858e0.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2e287e69cd222f3c706401f734690f3a52057a251f9c44277f0652a77ca858e0.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2e287e69cd222f3c706401f734690f3a52057a251f9c44277f0652a77ca858e0.exe
- Size 511KB
- Sample260709-2c3s6abv71
- SHA256 2e287e69cd222f3c706401f734690f3a52057a251f9c44277f0652a77ca858e0
- MD5 e4dbc3e929a28f1665b4fde56691ac97
- SHA1 9a378386fb8abc96231aff2bbb3cbe383e5f6e62
- SHA512 950733564416165e4799635c4c99e37a36111b75cbeae5e91682fa59154fd52fde0d3307d514bb03a846b891cbd8ba078c5211e4e6a83be39dd911a5f752cee7
- SSDEEP 6144:7cTgav1cdCTuoPbgwmOLJvKRILSFvdFDcEOkCybEaQRXr9HNdvOax5Rv0:7SvO2x9mONvKRILSFnOkx2LIax5F0
- TLSH T1FFB45C26F6908036C4B34575C5F64BAAFAB4BC21631156CBA3943A6A1F737D2BD3130E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4976 3dae3d1e - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 1 114.114.114.114 5124 2e287e69cd222f3c706401f734690f3a52057a251f9c44277f0652a77ca858e0.exe Destination IP 2 223.5.5.5 5124 2e287e69cd222f3c706401f734690f3a52057a251f9c44277f0652a77ca858e0.exe Destination IP 12 114.114.114.114 5124 2e287e69cd222f3c706401f734690f3a52057a251f9c44277f0652a77ca858e0.exe Destination IP 13 223.5.5.5 5124 2e287e69cd222f3c706401f734690f3a52057a251f9c44277f0652a77ca858e0.exe - Drops file in System32 directory 15 IoCs
description ioc Process File created C:\Windows\SysWOW64\3dae3d1e 2e287e69cd222f3c706401f734690f3a52057a251f9c44277f0652a77ca858e0.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 3dae3d1e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 3dae3d1e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 3dae3d1e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 3dae3d1e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 3dae3d1e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC845F33427F1C99AF855BE8930371C 3dae3d1e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 3dae3d1e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 3dae3d1e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 3dae3d1e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 3dae3d1e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 3dae3d1e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 3dae3d1e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 3dae3d1e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC845F33427F1C99AF855BE8930371C 3dae3d1e - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\5530e0 3dae3d1e File opened for modification C:\Windows\57b988 2e287e69cd222f3c706401f734690f3a52057a251f9c44277f0652a77ca858e0.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dae3d1e Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2e287e69cd222f3c706401f734690f3a52057a251f9c44277f0652a77ca858e0.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 3dae3d1e Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 3dae3d1e Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 3dae3d1e Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 3dae3d1e Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 3dae3d1e Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 3dae3d1e Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 3dae3d1e Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 3dae3d1e Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 3dae3d1e - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 4976 3dae3d1e 4976 3dae3d1e 4976 3dae3d1e 4976 3dae3d1e 4976 3dae3d1e 4976 3dae3d1e 4976 3dae3d1e 4976 3dae3d1e 5124 2e287e69cd222f3c706401f734690f3a52057a251f9c44277f0652a77ca858e0.exe 5124 2e287e69cd222f3c706401f734690f3a52057a251f9c44277f0652a77ca858e0.exe 5124 2e287e69cd222f3c706401f734690f3a52057a251f9c44277f0652a77ca858e0.exe 5124 2e287e69cd222f3c706401f734690f3a52057a251f9c44277f0652a77ca858e0.exe 5124 2e287e69cd222f3c706401f734690f3a52057a251f9c44277f0652a77ca858e0.exe 5124 2e287e69cd222f3c706401f734690f3a52057a251f9c44277f0652a77ca858e0.exe 5124 2e287e69cd222f3c706401f734690f3a52057a251f9c44277f0652a77ca858e0.exe 5124 2e287e69cd222f3c706401f734690f3a52057a251f9c44277f0652a77ca858e0.exe 5124 2e287e69cd222f3c706401f734690f3a52057a251f9c44277f0652a77ca858e0.exe 5124 2e287e69cd222f3c706401f734690f3a52057a251f9c44277f0652a77ca858e0.exe 5124 2e287e69cd222f3c706401f734690f3a52057a251f9c44277f0652a77ca858e0.exe 5124 2e287e69cd222f3c706401f734690f3a52057a251f9c44277f0652a77ca858e0.exe 5124 2e287e69cd222f3c706401f734690f3a52057a251f9c44277f0652a77ca858e0.exe 5124 2e287e69cd222f3c706401f734690f3a52057a251f9c44277f0652a77ca858e0.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 5124 2e287e69cd222f3c706401f734690f3a52057a251f9c44277f0652a77ca858e0.exe Token: SeTcbPrivilege 5124 2e287e69cd222f3c706401f734690f3a52057a251f9c44277f0652a77ca858e0.exe Token: SeDebugPrivilege 4976 3dae3d1e Token: SeTcbPrivilege 4976 3dae3d1e
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e287e69cd222f3c706401f734690f3a52057a251f9c44277f0652a77ca858e0.exe"C:\Users\Admin\AppData\Local\Temp\2e287e69cd222f3c706401f734690f3a52057a251f9c44277f0652a77ca858e0.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5124
-
C:\Windows\Syswow64\3dae3d1eC:\Windows\Syswow64\3dae3d1e1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4976
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\3dae3d1e
- Size 511KB
- SHA256 ce7406f34e3c6f6046c9d012d6609102d2401a68c6932e34f25fabe6fa536fe6
- MD5 10972be5a3140fa6112966b0616687ed
- SHA1 75aa044faf0bbce1e402725fd2a70d6b1217b59d
- SHA512 45e5619eff4012994960ae86fb731b1b8bdc5d7207176cc141e06d8a7e0d5c9eddbb6a3f3360647119b4de78c7b4fdaa4b6df2f38560437cb74e130438d6e2b5
- SSDEEP 6144:XcTgav1cdCTuoPbgwmOLJvKRILSFvdFDcEOkCybEaQRXr9HNdvOax5Rv0:XSvO2x9mONvKRILSFnOkx2LIax5F0
- TLSH T14CB45C26F6908036C4B34575C5F64BAAFAB4BC21631156CBA3943A6A1F737D2BD3130E
- MD5 SHA1 SHA512 SSDEEP TLSH