Analysis
- max time kernel
148s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/07/2026, 23:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f3df007a566041033b0e9487876966425333a90157a18d0335e1a75d8010b06d.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
f3df007a566041033b0e9487876966425333a90157a18d0335e1a75d8010b06d.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target f3df007a566041033b0e9487876966425333a90157a18d0335e1a75d8010b06d.exe
- Size 395KB
- Sample260709-3atcdaby2y
- SHA256 f3df007a566041033b0e9487876966425333a90157a18d0335e1a75d8010b06d
- MD5 c27cef83026a3d80334be6440c3482b3
- SHA1 fc9ac1a03e3a60285e3239352cd773bc89452b3c
- SHA512 852c9e7f18a71b49fbc27637376f37d9caa572c60bd33a3bd8251814f8c5e74a4a7aec7e99215b39daf37b018072e8e7ffcad212e7d8822a800e0a8b6f757bef
- SSDEEP 6144:YcbcTgav1cdCTuoPbgwmOLJvKRILSFvdFDcEOkCybEaQRXr9HNdvOa:YCSvO2x9mONvKRILSFnOkx2LIa
- TLSH T15A846D2AB6A0D076C4B79579C4A247BAFBB1742137204ACFA390475A1F637E2BD3530D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4124 fe5347d3 - Unexpected DNS network traffic destination 6 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 44 114.114.114.114 4124 fe5347d3 Destination IP 45 223.5.5.5 2188 f3df007a566041033b0e9487876966425333a90157a18d0335e1a75d8010b06d.exe Destination IP 1 114.114.114.114 2188 f3df007a566041033b0e9487876966425333a90157a18d0335e1a75d8010b06d.exe Destination IP 2 223.5.5.5 2188 f3df007a566041033b0e9487876966425333a90157a18d0335e1a75d8010b06d.exe Destination IP 28 114.114.114.114 2188 f3df007a566041033b0e9487876966425333a90157a18d0335e1a75d8010b06d.exe Destination IP 29 223.5.5.5 2188 f3df007a566041033b0e9487876966425333a90157a18d0335e1a75d8010b06d.exe - Drops file in System32 directory 13 IoCs
description ioc Process File created C:\Windows\SysWOW64\fe5347d3 f3df007a566041033b0e9487876966425333a90157a18d0335e1a75d8010b06d.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 fe5347d3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies fe5347d3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 fe5347d3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache fe5347d3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData fe5347d3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 fe5347d3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content fe5347d3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE fe5347d3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft fe5347d3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 fe5347d3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 fe5347d3 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 fe5347d3 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\469ab8 fe5347d3 File opened for modification C:\Windows\257598 f3df007a566041033b0e9487876966425333a90157a18d0335e1a75d8010b06d.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f3df007a566041033b0e9487876966425333a90157a18d0335e1a75d8010b06d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fe5347d3 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" fe5347d3 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ fe5347d3 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" fe5347d3 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing fe5347d3 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix fe5347d3 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" fe5347d3 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" fe5347d3 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" fe5347d3 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" fe5347d3 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 4124 fe5347d3 4124 fe5347d3 4124 fe5347d3 4124 fe5347d3 4124 fe5347d3 4124 fe5347d3 4124 fe5347d3 4124 fe5347d3 2188 f3df007a566041033b0e9487876966425333a90157a18d0335e1a75d8010b06d.exe 2188 f3df007a566041033b0e9487876966425333a90157a18d0335e1a75d8010b06d.exe 2188 f3df007a566041033b0e9487876966425333a90157a18d0335e1a75d8010b06d.exe 2188 f3df007a566041033b0e9487876966425333a90157a18d0335e1a75d8010b06d.exe 2188 f3df007a566041033b0e9487876966425333a90157a18d0335e1a75d8010b06d.exe 2188 f3df007a566041033b0e9487876966425333a90157a18d0335e1a75d8010b06d.exe 2188 f3df007a566041033b0e9487876966425333a90157a18d0335e1a75d8010b06d.exe 2188 f3df007a566041033b0e9487876966425333a90157a18d0335e1a75d8010b06d.exe 2188 f3df007a566041033b0e9487876966425333a90157a18d0335e1a75d8010b06d.exe 2188 f3df007a566041033b0e9487876966425333a90157a18d0335e1a75d8010b06d.exe 2188 f3df007a566041033b0e9487876966425333a90157a18d0335e1a75d8010b06d.exe 2188 f3df007a566041033b0e9487876966425333a90157a18d0335e1a75d8010b06d.exe 2188 f3df007a566041033b0e9487876966425333a90157a18d0335e1a75d8010b06d.exe 2188 f3df007a566041033b0e9487876966425333a90157a18d0335e1a75d8010b06d.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2188 f3df007a566041033b0e9487876966425333a90157a18d0335e1a75d8010b06d.exe Token: SeTcbPrivilege 2188 f3df007a566041033b0e9487876966425333a90157a18d0335e1a75d8010b06d.exe Token: SeDebugPrivilege 4124 fe5347d3 Token: SeTcbPrivilege 4124 fe5347d3
Processes
-
C:\Users\Admin\AppData\Local\Temp\f3df007a566041033b0e9487876966425333a90157a18d0335e1a75d8010b06d.exe"C:\Users\Admin\AppData\Local\Temp\f3df007a566041033b0e9487876966425333a90157a18d0335e1a75d8010b06d.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2188
-
C:\Windows\Syswow64\fe5347d3C:\Windows\Syswow64\fe5347d31⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4124
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\fe5347d3
- Size 395KB
- SHA256 3d711871f2183e61d493115930b663ad40a73c203e03e08c3ba0dcddb1395739
- MD5 46337413663df4565332280048c9c553
- SHA1 d99fb0fd538cd980d1b3762af766969294e1137a
- SHA512 d0217a60019a2b4fc4e5ed2aafc054d8de6491ebcf6b985f3dfbfaa0b096d29efaa6acd655a3b1756de70f306fa750e145bd5a084e636e07fa1a16ed9a06016a
- SSDEEP 6144:mcbcTgav1cdCTuoPbgwmOLJvKRILSFvdFDcEOkCybEaQRXr9HNdvOa:mCSvO2x9mONvKRILSFnOkx2LIa
- TLSH T183846D2AB6A0D076C4B79579C4A247BAFBB1742137204ACFA390475A1F637E2BD3530D
- MD5 SHA1 SHA512 SSDEEP TLSH