Analysis
- max time kernel
148s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/07/2026, 06:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
da3a689b42f859cd0307b3a0bcf8f26575352ee9af0e09ee839707b4e3d93c85.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
da3a689b42f859cd0307b3a0bcf8f26575352ee9af0e09ee839707b4e3d93c85.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target da3a689b42f859cd0307b3a0bcf8f26575352ee9af0e09ee839707b4e3d93c85.exe
- Size 419KB
- Sample260711-hatmxsc18q
- SHA256 da3a689b42f859cd0307b3a0bcf8f26575352ee9af0e09ee839707b4e3d93c85
- MD5 4e90eb8052b2e73a623544bce2377be5
- SHA1 e533c0f7b121c030f1e4b8a683ef8381b883cdd6
- SHA512 6dad3a9d84b49190119fd9ec9419db2a5d4b808553452982e5b38d38ef1265956d87f76112e5e26bc961690b36727375727f9605042700eaafb2d6c98fc65574
- SSDEEP 6144:iatygN+TkFSLZ+knaTDH76VFwcEOkCybEaQRXr9HNdvOa:iatG+S9+kaTDHrOkx2LIa
- TLSH T15D948C19FAA08076C563857AC4E257A6FBB1B5223B109ACF639007565F237E3BD3530E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5696 89d4f230 - Unexpected DNS network traffic destination 6 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 2 223.5.5.5 2804 da3a689b42f859cd0307b3a0bcf8f26575352ee9af0e09ee839707b4e3d93c85.exe Destination IP 36 114.114.114.114 2804 da3a689b42f859cd0307b3a0bcf8f26575352ee9af0e09ee839707b4e3d93c85.exe Destination IP 38 114.114.114.114 2804 da3a689b42f859cd0307b3a0bcf8f26575352ee9af0e09ee839707b4e3d93c85.exe Destination IP 40 223.5.5.5 2804 da3a689b42f859cd0307b3a0bcf8f26575352ee9af0e09ee839707b4e3d93c85.exe Destination IP 92 114.114.114.114 2804 da3a689b42f859cd0307b3a0bcf8f26575352ee9af0e09ee839707b4e3d93c85.exe Destination IP 1 114.114.114.114 2804 da3a689b42f859cd0307b3a0bcf8f26575352ee9af0e09ee839707b4e3d93c85.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 89d4f230 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 89d4f230 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 89d4f230 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 89d4f230 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 89d4f230 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 89d4f230 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 89d4f230 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 89d4f230 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 89d4f230 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 89d4f230 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 89d4f230 File created C:\Windows\SysWOW64\89d4f230 da3a689b42f859cd0307b3a0bcf8f26575352ee9af0e09ee839707b4e3d93c85.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 89d4f230 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 89d4f230 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 89d4f230 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\618480 89d4f230 File opened for modification C:\Windows\300168 da3a689b42f859cd0307b3a0bcf8f26575352ee9af0e09ee839707b4e3d93c85.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language da3a689b42f859cd0307b3a0bcf8f26575352ee9af0e09ee839707b4e3d93c85.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 89d4f230 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 89d4f230 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 89d4f230 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 89d4f230 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 89d4f230 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 89d4f230 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 89d4f230 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 89d4f230 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 89d4f230 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 89d4f230 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 5696 89d4f230 5696 89d4f230 5696 89d4f230 5696 89d4f230 5696 89d4f230 5696 89d4f230 5696 89d4f230 5696 89d4f230 2804 da3a689b42f859cd0307b3a0bcf8f26575352ee9af0e09ee839707b4e3d93c85.exe 2804 da3a689b42f859cd0307b3a0bcf8f26575352ee9af0e09ee839707b4e3d93c85.exe 2804 da3a689b42f859cd0307b3a0bcf8f26575352ee9af0e09ee839707b4e3d93c85.exe 2804 da3a689b42f859cd0307b3a0bcf8f26575352ee9af0e09ee839707b4e3d93c85.exe 2804 da3a689b42f859cd0307b3a0bcf8f26575352ee9af0e09ee839707b4e3d93c85.exe 2804 da3a689b42f859cd0307b3a0bcf8f26575352ee9af0e09ee839707b4e3d93c85.exe 2804 da3a689b42f859cd0307b3a0bcf8f26575352ee9af0e09ee839707b4e3d93c85.exe 2804 da3a689b42f859cd0307b3a0bcf8f26575352ee9af0e09ee839707b4e3d93c85.exe 2804 da3a689b42f859cd0307b3a0bcf8f26575352ee9af0e09ee839707b4e3d93c85.exe 2804 da3a689b42f859cd0307b3a0bcf8f26575352ee9af0e09ee839707b4e3d93c85.exe 2804 da3a689b42f859cd0307b3a0bcf8f26575352ee9af0e09ee839707b4e3d93c85.exe 2804 da3a689b42f859cd0307b3a0bcf8f26575352ee9af0e09ee839707b4e3d93c85.exe 2804 da3a689b42f859cd0307b3a0bcf8f26575352ee9af0e09ee839707b4e3d93c85.exe 2804 da3a689b42f859cd0307b3a0bcf8f26575352ee9af0e09ee839707b4e3d93c85.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2804 da3a689b42f859cd0307b3a0bcf8f26575352ee9af0e09ee839707b4e3d93c85.exe Token: SeTcbPrivilege 2804 da3a689b42f859cd0307b3a0bcf8f26575352ee9af0e09ee839707b4e3d93c85.exe Token: SeDebugPrivilege 5696 89d4f230 Token: SeTcbPrivilege 5696 89d4f230
Processes
-
C:\Users\Admin\AppData\Local\Temp\da3a689b42f859cd0307b3a0bcf8f26575352ee9af0e09ee839707b4e3d93c85.exe"C:\Users\Admin\AppData\Local\Temp\da3a689b42f859cd0307b3a0bcf8f26575352ee9af0e09ee839707b4e3d93c85.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2804
-
C:\Windows\Syswow64\89d4f230C:\Windows\Syswow64\89d4f2301⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5696
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\89d4f230
- Size 419KB
- SHA256 ba76c34ab74371e3980b5087ee97c845cd254db6260a8365d19987af9c0b99de
- MD5 a4f4a8c0f437c311522401aa674074d4
- SHA1 6591e7ff238c5c54e04cd6afc0bc5101a7c421c8
- SHA512 f8c87330d7ea0b65427feda51f6e89df335fb391ee5471ae7045acda506a7f8779c6843247c001a8affe7277c5205af790823680933a523ffb15513d47156ebc
- SSDEEP 6144:fatygN+TkFSLZ+knaTDH76VFwcEOkCybEaQRXr9HNdvOa:fatG+S9+kaTDHrOkx2LIa
- TLSH T1AB948C19FAA08076C563857AC4E257A6FBB1B5223B109ACF639007565F237E3BD3530E
- MD5 SHA1 SHA512 SSDEEP TLSH