Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
18/07/2026, 20:43
Behavioral task
behavioral1
Sample
ef21dfd8917faf73c7da827f551b52273822f50d20c2f62a7dafb6811a3ae1a9.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
ef21dfd8917faf73c7da827f551b52273822f50d20c2f62a7dafb6811a3ae1a9.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target ef21dfd8917faf73c7da827f551b52273822f50d20c2f62a7dafb6811a3ae1a9.exe
- Size 2.5MB
- Sample260718-zhst2act2m
- SHA256 ef21dfd8917faf73c7da827f551b52273822f50d20c2f62a7dafb6811a3ae1a9
- MD5 7d53bb8082119ba40c93beb465b3538c
- SHA1 15802034e9eb429671a8b7acaaba05c0c8417f9d
- SHA512 9e17f87daf0b3f411d85e51cebca8d65a881beb1196b5ef01a32db329c77b47405dede814f3367d7a9711195715812fe916bcbd6dcfac257b6fbceffd6300d3c
- SSDEEP 49152:mHHKe2WQX56/OJdJCXDrsOFZMjHfUTGkQy5QZuTtN:mnKGEkOhCXHHFZMjHfUKkVWsT
- TLSH T156C58E31E6818136D1B34671C6FA57BBA5247C211721A5CFA3C87A2A1F736D3AE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1580 f7b48b26 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 3 114.114.114.114 1928 ef21dfd8917faf73c7da827f551b52273822f50d20c2f62a7dafb6811a3ae1a9.exe Destination IP 4 223.5.5.5 1928 ef21dfd8917faf73c7da827f551b52273822f50d20c2f62a7dafb6811a3ae1a9.exe Destination IP 42 114.114.114.114 1928 ef21dfd8917faf73c7da827f551b52273822f50d20c2f62a7dafb6811a3ae1a9.exe Destination IP 45 223.5.5.5 1928 ef21dfd8917faf73c7da827f551b52273822f50d20c2f62a7dafb6811a3ae1a9.exe - Drops file in System32 directory 17 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData f7b48b26 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AAD646CB44373074ADE741C38400E7E1 f7b48b26 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC845F33427F1C99AF855BE8930371C f7b48b26 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 f7b48b26 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 f7b48b26 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE f7b48b26 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AAD646CB44373074ADE741C38400E7E1 f7b48b26 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 f7b48b26 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies f7b48b26 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft f7b48b26 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 f7b48b26 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 f7b48b26 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content f7b48b26 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC845F33427F1C99AF855BE8930371C f7b48b26 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 f7b48b26 File created C:\Windows\SysWOW64\f7b48b26 ef21dfd8917faf73c7da827f551b52273822f50d20c2f62a7dafb6811a3ae1a9.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache f7b48b26 -
resource yara_rule behavioral1/memory/1928-0-0x00000000008C0000-0x000000000094C000-memory.dmp upx behavioral1/files/0x000a00000002430a-2.dat upx behavioral1/memory/1580-3-0x00000000005D0000-0x000000000065C000-memory.dmp upx behavioral1/memory/1928-12-0x00000000008C0000-0x000000000094C000-memory.dmp upx behavioral1/memory/1580-13-0x00000000005D0000-0x000000000065C000-memory.dmp upx behavioral1/memory/1580-34-0x00000000005D0000-0x000000000065C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\210210 ef21dfd8917faf73c7da827f551b52273822f50d20c2f62a7dafb6811a3ae1a9.exe File opened for modification C:\Windows\1b0cd8 f7b48b26 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ef21dfd8917faf73c7da827f551b52273822f50d20c2f62a7dafb6811a3ae1a9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f7b48b26 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" f7b48b26 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing f7b48b26 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix f7b48b26 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" f7b48b26 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" f7b48b26 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" f7b48b26 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ f7b48b26 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" f7b48b26 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" f7b48b26 - Modifies system certificate store 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1F24C630CDA418EF2069FFAD4FDD5F463A1B69AA f7b48b26 Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1F24C630CDA418EF2069FFAD4FDD5F463A1B69AA\Blob = 5c0000000100000004000000800100000f0000000100000030000000f019c7ba12795dacd6ef1a767657deb8e41060a2ad1a6c66900a6ec16870fc06eecbaffdd3e2c986659578e7e85e535a530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003800000047006c006f00620061006c005300690067006e002000450043004300200052006f006f00740020004300410020002d002000520035000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308620000000100000020000000179fbc148a3dd00fd24ea13458cc43bfa7f59c8182d783a513f6ebec100c89241400000001000000140000003de629489bea07ca21444a26de6eded283d09f591d0000000100000010000000b647dd2a9ccadee75e8905e256cc6b147f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d7010300000001000000140000001f24c630cda418ef2069ffad4fdd5f463a1b69aa190000000100000010000000e3087c0c81f60a2a2b466b8a3e70cce82000000001000000220200003082021e308201a4a0030201020211605949e0262ebb55f90a778a71f94ad86c300a06082a8648ce3d040303305031243022060355040b131b476c6f62616c5369676e2045434320526f6f74204341202d20523531133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3132313131333030303030305a170d3338303131393033313430375a305031243022060355040b131b476c6f62616c5369676e2045434320526f6f74204341202d20523531133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e3076301006072a8648ce3d020106052b810400220362000447450e96fb7d5dbfe939d121f89f0bb6d57b1e923a48591cf062312dc07a28fe1aa75cb3b6cc97e745d458fad1776d43a2c08765340a1f7addeb3c33a1c59d4da46f4195387fc91e84ebd19e49928794870c3a854a669f9d59934d976106864aa3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604143de629489bea07ca21444a26de6eded283d09f59300a06082a8648ce3d0403030368003065023100e56912c96edbc631ba0941e197f8fbfd9ae27d12c9ed7c64d3cb05258b56d9a0e75e5d4e0b839c5b7629a00926216a62023071d2b58f5cea3be1780985a875923bc85cfd48ef0d7422a808e26ec549cec70cbca76169f1f73be12acbf92bf3669037 f7b48b26 - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 1580 f7b48b26 1580 f7b48b26 1580 f7b48b26 1580 f7b48b26 1580 f7b48b26 1580 f7b48b26 1580 f7b48b26 1580 f7b48b26 1580 f7b48b26 1580 f7b48b26 1580 f7b48b26 1580 f7b48b26 1928 ef21dfd8917faf73c7da827f551b52273822f50d20c2f62a7dafb6811a3ae1a9.exe 1928 ef21dfd8917faf73c7da827f551b52273822f50d20c2f62a7dafb6811a3ae1a9.exe 1928 ef21dfd8917faf73c7da827f551b52273822f50d20c2f62a7dafb6811a3ae1a9.exe 1928 ef21dfd8917faf73c7da827f551b52273822f50d20c2f62a7dafb6811a3ae1a9.exe 1928 ef21dfd8917faf73c7da827f551b52273822f50d20c2f62a7dafb6811a3ae1a9.exe 1928 ef21dfd8917faf73c7da827f551b52273822f50d20c2f62a7dafb6811a3ae1a9.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1928 ef21dfd8917faf73c7da827f551b52273822f50d20c2f62a7dafb6811a3ae1a9.exe Token: SeTcbPrivilege 1928 ef21dfd8917faf73c7da827f551b52273822f50d20c2f62a7dafb6811a3ae1a9.exe Token: SeDebugPrivilege 1580 f7b48b26 Token: SeTcbPrivilege 1580 f7b48b26
Processes
-
C:\Users\Admin\AppData\Local\Temp\ef21dfd8917faf73c7da827f551b52273822f50d20c2f62a7dafb6811a3ae1a9.exe"C:\Users\Admin\AppData\Local\Temp\ef21dfd8917faf73c7da827f551b52273822f50d20c2f62a7dafb6811a3ae1a9.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1928
-
C:\Windows\Syswow64\f7b48b26C:\Windows\Syswow64\f7b48b261⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1580
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\1b0cd8
- Size 506B
- SHA256 43097cbd4c2ad853a69b74ad10c5f9124ff2b6ba8af703df5a65f6fd37e0101b
- MD5 40b5ee15de4e915223b6e69971b4de4b
- SHA1 9b04ff7c46eb1d0407a01c9c25dcd1667fe0548a
- SHA512 09e683a68fd82ed698ff08fc8d48452e6dbb208666949d55211756b256e537cf24534d148a6e6c5152d557aa0df0cabcc5a0fa4bbef00f04d0a794eb9a40619c
- TLSH T13FF095B7AE1855B009BE5FF295227C8423A5A02D4793614678D1F747D6B32547CC3414
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\f7b48b26
- Size 2.5MB
- SHA256 10e22fa296e556d4fe81a00b211be3dd6b0e7e49719ae3f19677db670ed2fc4d
- MD5 60e5c6f2fdb88334c7b8382febcd18a3
- SHA1 b1fdbd2692137afad9f5402079233c2ac2eea81c
- SHA512 4f13ec5ee091275464204f3096f465715fa8b433e01d6bf92bcc772f550f02cebdd069251002eb4336d2f4c6f22272e77fc27f792d8e9b41be0e3695500e9cfc
- SSDEEP 49152:kHHKe2WQX56/OJdJCXDrsOFZMjHfUTGkQy5QZuTtN:knKGEkOhCXHHFZMjHfUKkVWsT
- TLSH T134C58E31E6818136D1B34671C6FA57BBA5247C211721A5CFA3C87A2A1F736D3AE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH