Analysis
- max time kernel
148s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/07/2026, 21:07
Behavioral task
behavioral1
Sample
5904fb4617fb6177b580f7f72c756ec88966ac096d572e228397826957de18d0.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 5904fb4617fb6177b580f7f72c756ec88966ac096d572e228397826957de18d0.exe
- Size 560KB
- Sample260716-zyjlashw2x
- SHA256 5904fb4617fb6177b580f7f72c756ec88966ac096d572e228397826957de18d0
- MD5 7041293aa13a2eed2c163e4c431c1c0f
- SHA1 49359fe3c33a2bc3bdf3a8dbf5532edff6bf58db
- SHA512 9741b89f888f6253020a6c3547b9ca449f23f04722fbf6444188619a6b36a65b89df0704c5fac3c66755dd8b2f4bc347f7888fce454f8111f6f4e622b3d86a66
- SSDEEP 6144:8gye71cE4poJTqvpQLXNKFyLWD1nFairGcEOkCybEaQRuy8K:8I7OE4kopQzNKFyLWDHsOkxHy
- TLSH T170C48C2AB690C076C4B7D534C5E197AAEAB17432372449CFA3D0075A1F237E2BA3570E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4448 a34e6ade - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 2 223.5.5.5 3224 5904fb4617fb6177b580f7f72c756ec88966ac096d572e228397826957de18d0.exe Destination IP 16 114.114.114.114 3224 5904fb4617fb6177b580f7f72c756ec88966ac096d572e228397826957de18d0.exe Destination IP 17 223.5.5.5 3224 5904fb4617fb6177b580f7f72c756ec88966ac096d572e228397826957de18d0.exe Destination IP 1 114.114.114.114 3224 5904fb4617fb6177b580f7f72c756ec88966ac096d572e228397826957de18d0.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData a34e6ade File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 a34e6ade File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 a34e6ade File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 a34e6ade File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE a34e6ade File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 a34e6ade File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft a34e6ade File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 a34e6ade File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content a34e6ade File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 a34e6ade File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies a34e6ade File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache a34e6ade File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 a34e6ade File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 a34e6ade File created C:\Windows\SysWOW64\a34e6ade 5904fb4617fb6177b580f7f72c756ec88966ac096d572e228397826957de18d0.exe -
resource yara_rule behavioral2/memory/3224-0-0x00000000009C0000-0x0000000000A4C000-memory.dmp upx behavioral2/files/0x000c000000016cdc-2.dat upx behavioral2/memory/4448-3-0x00000000003E0000-0x000000000046C000-memory.dmp upx behavioral2/memory/3224-10-0x00000000009C0000-0x0000000000A4C000-memory.dmp upx behavioral2/memory/4448-11-0x00000000003E0000-0x000000000046C000-memory.dmp upx behavioral2/memory/4448-34-0x00000000003E0000-0x000000000046C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\4c26c0 a34e6ade File opened for modification C:\Windows\373230 5904fb4617fb6177b580f7f72c756ec88966ac096d572e228397826957de18d0.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a34e6ade Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5904fb4617fb6177b580f7f72c756ec88966ac096d572e228397826957de18d0.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix a34e6ade Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" a34e6ade Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ a34e6ade Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" a34e6ade Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" a34e6ade Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" a34e6ade Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" a34e6ade Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" a34e6ade Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing a34e6ade - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 4448 a34e6ade 4448 a34e6ade 4448 a34e6ade 4448 a34e6ade 4448 a34e6ade 4448 a34e6ade 4448 a34e6ade 4448 a34e6ade 3224 5904fb4617fb6177b580f7f72c756ec88966ac096d572e228397826957de18d0.exe 3224 5904fb4617fb6177b580f7f72c756ec88966ac096d572e228397826957de18d0.exe 3224 5904fb4617fb6177b580f7f72c756ec88966ac096d572e228397826957de18d0.exe 3224 5904fb4617fb6177b580f7f72c756ec88966ac096d572e228397826957de18d0.exe 3224 5904fb4617fb6177b580f7f72c756ec88966ac096d572e228397826957de18d0.exe 3224 5904fb4617fb6177b580f7f72c756ec88966ac096d572e228397826957de18d0.exe 3224 5904fb4617fb6177b580f7f72c756ec88966ac096d572e228397826957de18d0.exe 3224 5904fb4617fb6177b580f7f72c756ec88966ac096d572e228397826957de18d0.exe 3224 5904fb4617fb6177b580f7f72c756ec88966ac096d572e228397826957de18d0.exe 3224 5904fb4617fb6177b580f7f72c756ec88966ac096d572e228397826957de18d0.exe 3224 5904fb4617fb6177b580f7f72c756ec88966ac096d572e228397826957de18d0.exe 3224 5904fb4617fb6177b580f7f72c756ec88966ac096d572e228397826957de18d0.exe 3224 5904fb4617fb6177b580f7f72c756ec88966ac096d572e228397826957de18d0.exe 3224 5904fb4617fb6177b580f7f72c756ec88966ac096d572e228397826957de18d0.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3224 5904fb4617fb6177b580f7f72c756ec88966ac096d572e228397826957de18d0.exe Token: SeTcbPrivilege 3224 5904fb4617fb6177b580f7f72c756ec88966ac096d572e228397826957de18d0.exe Token: SeDebugPrivilege 4448 a34e6ade Token: SeTcbPrivilege 4448 a34e6ade
Processes
-
C:\Users\Admin\AppData\Local\Temp\5904fb4617fb6177b580f7f72c756ec88966ac096d572e228397826957de18d0.exe"C:\Users\Admin\AppData\Local\Temp\5904fb4617fb6177b580f7f72c756ec88966ac096d572e228397826957de18d0.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3224
-
C:\Windows\Syswow64\a34e6adeC:\Windows\Syswow64\a34e6ade1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4448
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\a34e6ade
- Size 560KB
- SHA256 1c1330fee1a0b5b522ba6485df8e3473d15fd827300e7742758cf534f8a32cd9
- MD5 5b0d5be60d9d2dcce8e794800408b5e6
- SHA1 a7561e5d289c23e4ab59eb43cdbb5e2d2a803bef
- SHA512 f0a4db39b7c183b21a1c48d8c7f3cde7acf2a7c5cf6c6674e13b09668e5e6f122ec7d7668d01cb519a418d7f6bb9ac987d5d037a884caec3f8668f9e452ddc28
- SSDEEP 6144:sgye71cE4poJTqvpQLXNKFyLWD1nFairGcEOkCybEaQRuy8K:sI7OE4kopQzNKFyLWDHsOkxHy
- TLSH T138C48C2AB690C076C4B7D534C5E197AAEAB17432372449CFA3D0075A1F237E2BA3570E
- MD5 SHA1 SHA512 SSDEEP TLSH