Analysis
- max time kernel
148s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/07/2026, 06:44
Behavioral task
behavioral1
Sample
b743a63ea87a7318d0eb25a330fde5db703d7839176d0dd5a3d1217c93d4ae56.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
b743a63ea87a7318d0eb25a330fde5db703d7839176d0dd5a3d1217c93d4ae56.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target b743a63ea87a7318d0eb25a330fde5db703d7839176d0dd5a3d1217c93d4ae56.exe
- Size 560KB
- Sample260714-hhtmwsat3w
- SHA256 b743a63ea87a7318d0eb25a330fde5db703d7839176d0dd5a3d1217c93d4ae56
- MD5 9ca2c3daef6c84639e78ef7da114c356
- SHA1 c3a2d4d3e39c4bd16fb3d25419558d4a25ae866c
- SHA512 a1b2267b39adf834b49b83f10c2346bcc40eb98961c04f3e1bcf5915935a34884cf53aa2d44c63ca05c5737a7a2877d1439e3e9373324c924ffcfb365be998de
- SSDEEP 6144:Rgye71cE4poJTqvpQLXNKFyLWD1nFairGcEOkCybEaQRuy8K:RI7OE4kopQzNKFyLWDHsOkxHy
- TLSH T146C48C2AB690C076C4B7D534C5E197AAEAB17432372449CFA3D0075A1F237E2BA3570E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4852 1a2fcd40 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 11 114.114.114.114 3536 b743a63ea87a7318d0eb25a330fde5db703d7839176d0dd5a3d1217c93d4ae56.exe Destination IP 12 223.5.5.5 3536 b743a63ea87a7318d0eb25a330fde5db703d7839176d0dd5a3d1217c93d4ae56.exe Destination IP 1 114.114.114.114 3536 b743a63ea87a7318d0eb25a330fde5db703d7839176d0dd5a3d1217c93d4ae56.exe Destination IP 2 223.5.5.5 3536 b743a63ea87a7318d0eb25a330fde5db703d7839176d0dd5a3d1217c93d4ae56.exe - Drops file in System32 directory 19 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 1a2fcd40 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 1a2fcd40 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 1a2fcd40 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AAD646CB44373074ADE741C38400E7E1 1a2fcd40 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC845F33427F1C99AF855BE8930371C 1a2fcd40 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC845F33427F1C99AF855BE8930371C 1a2fcd40 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 1a2fcd40 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 1a2fcd40 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 1a2fcd40 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 1a2fcd40 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 1a2fcd40 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 1a2fcd40 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 1a2fcd40 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 1a2fcd40 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 1a2fcd40 File created C:\Windows\SysWOW64\1a2fcd40 b743a63ea87a7318d0eb25a330fde5db703d7839176d0dd5a3d1217c93d4ae56.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 1a2fcd40 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AAD646CB44373074ADE741C38400E7E1 1a2fcd40 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 1a2fcd40 -
resource yara_rule behavioral2/memory/3536-0-0x0000000000E10000-0x0000000000E9C000-memory.dmp upx behavioral2/files/0x0008000000019cc1-2.dat upx behavioral2/memory/4852-4-0x0000000000790000-0x000000000081C000-memory.dmp upx behavioral2/memory/3536-19-0x0000000000E10000-0x0000000000E9C000-memory.dmp upx behavioral2/memory/4852-20-0x0000000000790000-0x000000000081C000-memory.dmp upx behavioral2/memory/4852-51-0x0000000000790000-0x000000000081C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\531168 1a2fcd40 File opened for modification C:\Windows\3c89a0 b743a63ea87a7318d0eb25a330fde5db703d7839176d0dd5a3d1217c93d4ae56.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b743a63ea87a7318d0eb25a330fde5db703d7839176d0dd5a3d1217c93d4ae56.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1a2fcd40 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 1a2fcd40 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 1a2fcd40 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 1a2fcd40 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 1a2fcd40 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 1a2fcd40 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 1a2fcd40 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 1a2fcd40 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 1a2fcd40 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 1a2fcd40 - Modifies system certificate store 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1F24C630CDA418EF2069FFAD4FDD5F463A1B69AA 1a2fcd40 Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1F24C630CDA418EF2069FFAD4FDD5F463A1B69AA\Blob = 5c0000000100000004000000800100000f0000000100000030000000f019c7ba12795dacd6ef1a767657deb8e41060a2ad1a6c66900a6ec16870fc06eecbaffdd3e2c986659578e7e85e535a530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003800000047006c006f00620061006c005300690067006e002000450043004300200052006f006f00740020004300410020002d002000520035000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308620000000100000020000000179fbc148a3dd00fd24ea13458cc43bfa7f59c8182d783a513f6ebec100c89241400000001000000140000003de629489bea07ca21444a26de6eded283d09f591d0000000100000010000000b647dd2a9ccadee75e8905e256cc6b147f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d7010300000001000000140000001f24c630cda418ef2069ffad4fdd5f463a1b69aa190000000100000010000000e3087c0c81f60a2a2b466b8a3e70cce82000000001000000220200003082021e308201a4a0030201020211605949e0262ebb55f90a778a71f94ad86c300a06082a8648ce3d040303305031243022060355040b131b476c6f62616c5369676e2045434320526f6f74204341202d20523531133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3132313131333030303030305a170d3338303131393033313430375a305031243022060355040b131b476c6f62616c5369676e2045434320526f6f74204341202d20523531133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e3076301006072a8648ce3d020106052b810400220362000447450e96fb7d5dbfe939d121f89f0bb6d57b1e923a48591cf062312dc07a28fe1aa75cb3b6cc97e745d458fad1776d43a2c08765340a1f7addeb3c33a1c59d4da46f4195387fc91e84ebd19e49928794870c3a854a669f9d59934d976106864aa3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604143de629489bea07ca21444a26de6eded283d09f59300a06082a8648ce3d0403030368003065023100e56912c96edbc631ba0941e197f8fbfd9ae27d12c9ed7c64d3cb05258b56d9a0e75e5d4e0b839c5b7629a00926216a62023071d2b58f5cea3be1780985a875923bc85cfd48ef0d7422a808e26ec549cec70cbca76169f1f73be12acbf92bf3669037 1a2fcd40 - Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 4852 1a2fcd40 4852 1a2fcd40 4852 1a2fcd40 4852 1a2fcd40 4852 1a2fcd40 4852 1a2fcd40 4852 1a2fcd40 4852 1a2fcd40 4852 1a2fcd40 4852 1a2fcd40 4852 1a2fcd40 4852 1a2fcd40 4852 1a2fcd40 4852 1a2fcd40 4852 1a2fcd40 4852 1a2fcd40 4852 1a2fcd40 4852 1a2fcd40 4852 1a2fcd40 4852 1a2fcd40 3536 b743a63ea87a7318d0eb25a330fde5db703d7839176d0dd5a3d1217c93d4ae56.exe 3536 b743a63ea87a7318d0eb25a330fde5db703d7839176d0dd5a3d1217c93d4ae56.exe 3536 b743a63ea87a7318d0eb25a330fde5db703d7839176d0dd5a3d1217c93d4ae56.exe 3536 b743a63ea87a7318d0eb25a330fde5db703d7839176d0dd5a3d1217c93d4ae56.exe 3536 b743a63ea87a7318d0eb25a330fde5db703d7839176d0dd5a3d1217c93d4ae56.exe 3536 b743a63ea87a7318d0eb25a330fde5db703d7839176d0dd5a3d1217c93d4ae56.exe 3536 b743a63ea87a7318d0eb25a330fde5db703d7839176d0dd5a3d1217c93d4ae56.exe 3536 b743a63ea87a7318d0eb25a330fde5db703d7839176d0dd5a3d1217c93d4ae56.exe 3536 b743a63ea87a7318d0eb25a330fde5db703d7839176d0dd5a3d1217c93d4ae56.exe 3536 b743a63ea87a7318d0eb25a330fde5db703d7839176d0dd5a3d1217c93d4ae56.exe 3536 b743a63ea87a7318d0eb25a330fde5db703d7839176d0dd5a3d1217c93d4ae56.exe 3536 b743a63ea87a7318d0eb25a330fde5db703d7839176d0dd5a3d1217c93d4ae56.exe 3536 b743a63ea87a7318d0eb25a330fde5db703d7839176d0dd5a3d1217c93d4ae56.exe 3536 b743a63ea87a7318d0eb25a330fde5db703d7839176d0dd5a3d1217c93d4ae56.exe 3536 b743a63ea87a7318d0eb25a330fde5db703d7839176d0dd5a3d1217c93d4ae56.exe 3536 b743a63ea87a7318d0eb25a330fde5db703d7839176d0dd5a3d1217c93d4ae56.exe 3536 b743a63ea87a7318d0eb25a330fde5db703d7839176d0dd5a3d1217c93d4ae56.exe 3536 b743a63ea87a7318d0eb25a330fde5db703d7839176d0dd5a3d1217c93d4ae56.exe 3536 b743a63ea87a7318d0eb25a330fde5db703d7839176d0dd5a3d1217c93d4ae56.exe 3536 b743a63ea87a7318d0eb25a330fde5db703d7839176d0dd5a3d1217c93d4ae56.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3536 b743a63ea87a7318d0eb25a330fde5db703d7839176d0dd5a3d1217c93d4ae56.exe Token: SeTcbPrivilege 3536 b743a63ea87a7318d0eb25a330fde5db703d7839176d0dd5a3d1217c93d4ae56.exe Token: SeDebugPrivilege 4852 1a2fcd40 Token: SeTcbPrivilege 4852 1a2fcd40
Processes
-
C:\Users\Admin\AppData\Local\Temp\b743a63ea87a7318d0eb25a330fde5db703d7839176d0dd5a3d1217c93d4ae56.exe"C:\Users\Admin\AppData\Local\Temp\b743a63ea87a7318d0eb25a330fde5db703d7839176d0dd5a3d1217c93d4ae56.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3536
-
C:\Windows\Syswow64\1a2fcd40C:\Windows\Syswow64\1a2fcd401⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4852
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\531168
- Size 916B
- SHA256 b55acdf2976dcd217713d00d56184bb4f7fcec8b248d12524f658f215c204c29
- MD5 53a19b58f64fbd32892f4305a7767ce0
- SHA1 6e7e44a545f5563acff07bbfecd5e8b4480afebd
- SHA512 02879553a261e4e42c3886c2c644ad241ee159f37b7088ba911cebca73480e019e35bbe93a515970ab2acd652fcd1d99288b4ab2a4c3c3eec04e17b0f7c17760
- TLSH T1911132F7B499A2EA2CEC9724B8D15E9E377074DDC09E402B8196387228572A48D23167
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\1a2fcd40
- Size 560KB
- SHA256 9005b5ca826b0c8f632aeabec23e03fa3a750bf429e8b858fb02aa1951078bae
- MD5 4f3860cf17d9bc04d1a712420d1421e4
- SHA1 688412e3a6cd8794c6138fb7b1eecb8743acb609
- SHA512 3ed1911d825fd7cb46dc87f1d804ef187f491239be3eda559fcb528ae7e6b51e50ec8d8fcc48c7880fc2b86bbbea35707c05457d44da5569f90283df6d1e755f
- SSDEEP 6144:3gye71cE4poJTqvpQLXNKFyLWD1nFairGcEOkCybEaQRuy8K:3I7OE4kopQzNKFyLWDHsOkxHy
- TLSH T1DAC48C2AB690C076C4B7D534C5E197AAEAB17432372449CFA3D0075A1F237E2BA3570E
- MD5 SHA1 SHA512 SSDEEP TLSH