Analysis
- max time kernel
150s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/07/2026, 02:45
Behavioral task
behavioral1
Sample
b69565caae088b7a2fa19218c228c702d7aa49646ee5ca94e0eceaf3a7854810.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
b69565caae088b7a2fa19218c228c702d7aa49646ee5ca94e0eceaf3a7854810.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target b69565caae088b7a2fa19218c228c702d7aa49646ee5ca94e0eceaf3a7854810.exe
- Size 640KB
- Sample260720-c8w8tafw8x
- SHA256 b69565caae088b7a2fa19218c228c702d7aa49646ee5ca94e0eceaf3a7854810
- MD5 f8e52b6a295df031ae2b26bafa9e3790
- SHA1 45b238a21835f725253ada671ce741d8038c36ab
- SHA512 1514e92a50f4c082219ba69c9a2b75f17c055c287ba9c74c042508ddcdd91893a8d97aeb70f9f77732beac11786827bfca2c3b8f2c906508173aaa1d6c7ebd7f
- SSDEEP 6144:8cTgav1cdCTuoPbgwmOLJvKRwLSFXdFwirGcEOkCybEaQRuy8KU5Rc:8SvO2x9mONvKRwLSFtsOkxHya5+
- TLSH T1C0D45B35A6808036C0B74631C6F64BAAF9B5BC25631195CFA384376A1F737D2BA3570E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5040 64fc57da - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 13 114.114.114.114 5532 b69565caae088b7a2fa19218c228c702d7aa49646ee5ca94e0eceaf3a7854810.exe Destination IP 14 223.5.5.5 5532 b69565caae088b7a2fa19218c228c702d7aa49646ee5ca94e0eceaf3a7854810.exe Destination IP 3 114.114.114.114 5532 b69565caae088b7a2fa19218c228c702d7aa49646ee5ca94e0eceaf3a7854810.exe Destination IP 5 223.5.5.5 5532 b69565caae088b7a2fa19218c228c702d7aa49646ee5ca94e0eceaf3a7854810.exe - Drops file in System32 directory 11 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 64fc57da File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 64fc57da File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 64fc57da File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 64fc57da File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 64fc57da File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AAD646CB44373074ADE741C38400E7E1 64fc57da File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AAD646CB44373074ADE741C38400E7E1 64fc57da File created C:\Windows\SysWOW64\64fc57da b69565caae088b7a2fa19218c228c702d7aa49646ee5ca94e0eceaf3a7854810.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 64fc57da File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 64fc57da File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 64fc57da -
resource yara_rule behavioral2/memory/5532-0-0x0000000000010000-0x000000000009C000-memory.dmp upx behavioral2/files/0x000f000000016cdb-2.dat upx behavioral2/memory/5040-3-0x0000000000570000-0x00000000005FC000-memory.dmp upx behavioral2/memory/5532-17-0x0000000000010000-0x000000000009C000-memory.dmp upx behavioral2/memory/5040-18-0x0000000000570000-0x00000000005FC000-memory.dmp upx behavioral2/memory/5040-40-0x0000000000570000-0x00000000005FC000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\564960 64fc57da File opened for modification C:\Windows\5eb5b8 b69565caae088b7a2fa19218c228c702d7aa49646ee5ca94e0eceaf3a7854810.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b69565caae088b7a2fa19218c228c702d7aa49646ee5ca94e0eceaf3a7854810.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64fc57da - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 64fc57da Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 64fc57da Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 64fc57da Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 64fc57da Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 64fc57da Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 64fc57da Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 64fc57da Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 64fc57da Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 64fc57da - Modifies system certificate store 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1F24C630CDA418EF2069FFAD4FDD5F463A1B69AA 64fc57da Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1F24C630CDA418EF2069FFAD4FDD5F463A1B69AA\Blob = 5c000000010000000400000080010000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003800000047006c006f00620061006c005300690067006e002000450043004300200052006f006f00740020004300410020002d002000520035000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308620000000100000020000000179fbc148a3dd00fd24ea13458cc43bfa7f59c8182d783a513f6ebec100c89241400000001000000140000003de629489bea07ca21444a26de6eded283d09f591d0000000100000010000000b647dd2a9ccadee75e8905e256cc6b147f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d7010300000001000000140000001f24c630cda418ef2069ffad4fdd5f463a1b69aa2000000001000000220200003082021e308201a4a0030201020211605949e0262ebb55f90a778a71f94ad86c300a06082a8648ce3d040303305031243022060355040b131b476c6f62616c5369676e2045434320526f6f74204341202d20523531133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3132313131333030303030305a170d3338303131393033313430375a305031243022060355040b131b476c6f62616c5369676e2045434320526f6f74204341202d20523531133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e3076301006072a8648ce3d020106052b810400220362000447450e96fb7d5dbfe939d121f89f0bb6d57b1e923a48591cf062312dc07a28fe1aa75cb3b6cc97e745d458fad1776d43a2c08765340a1f7addeb3c33a1c59d4da46f4195387fc91e84ebd19e49928794870c3a854a669f9d59934d976106864aa3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604143de629489bea07ca21444a26de6eded283d09f59300a06082a8648ce3d0403030368003065023100e56912c96edbc631ba0941e197f8fbfd9ae27d12c9ed7c64d3cb05258b56d9a0e75e5d4e0b839c5b7629a00926216a62023071d2b58f5cea3be1780985a875923bc85cfd48ef0d7422a808e26ec549cec70cbca76169f1f73be12acbf92bf3669037 64fc57da - Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 5040 64fc57da 5040 64fc57da 5040 64fc57da 5040 64fc57da 5040 64fc57da 5040 64fc57da 5040 64fc57da 5040 64fc57da 5040 64fc57da 5040 64fc57da 5040 64fc57da 5040 64fc57da 5040 64fc57da 5040 64fc57da 5040 64fc57da 5040 64fc57da 5040 64fc57da 5040 64fc57da 5040 64fc57da 5040 64fc57da 5532 b69565caae088b7a2fa19218c228c702d7aa49646ee5ca94e0eceaf3a7854810.exe 5532 b69565caae088b7a2fa19218c228c702d7aa49646ee5ca94e0eceaf3a7854810.exe 5532 b69565caae088b7a2fa19218c228c702d7aa49646ee5ca94e0eceaf3a7854810.exe 5532 b69565caae088b7a2fa19218c228c702d7aa49646ee5ca94e0eceaf3a7854810.exe 5532 b69565caae088b7a2fa19218c228c702d7aa49646ee5ca94e0eceaf3a7854810.exe 5532 b69565caae088b7a2fa19218c228c702d7aa49646ee5ca94e0eceaf3a7854810.exe 5532 b69565caae088b7a2fa19218c228c702d7aa49646ee5ca94e0eceaf3a7854810.exe 5532 b69565caae088b7a2fa19218c228c702d7aa49646ee5ca94e0eceaf3a7854810.exe 5532 b69565caae088b7a2fa19218c228c702d7aa49646ee5ca94e0eceaf3a7854810.exe 5532 b69565caae088b7a2fa19218c228c702d7aa49646ee5ca94e0eceaf3a7854810.exe 5532 b69565caae088b7a2fa19218c228c702d7aa49646ee5ca94e0eceaf3a7854810.exe 5532 b69565caae088b7a2fa19218c228c702d7aa49646ee5ca94e0eceaf3a7854810.exe 5532 b69565caae088b7a2fa19218c228c702d7aa49646ee5ca94e0eceaf3a7854810.exe 5532 b69565caae088b7a2fa19218c228c702d7aa49646ee5ca94e0eceaf3a7854810.exe 5532 b69565caae088b7a2fa19218c228c702d7aa49646ee5ca94e0eceaf3a7854810.exe 5532 b69565caae088b7a2fa19218c228c702d7aa49646ee5ca94e0eceaf3a7854810.exe 5532 b69565caae088b7a2fa19218c228c702d7aa49646ee5ca94e0eceaf3a7854810.exe 5532 b69565caae088b7a2fa19218c228c702d7aa49646ee5ca94e0eceaf3a7854810.exe 5532 b69565caae088b7a2fa19218c228c702d7aa49646ee5ca94e0eceaf3a7854810.exe 5532 b69565caae088b7a2fa19218c228c702d7aa49646ee5ca94e0eceaf3a7854810.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 5532 b69565caae088b7a2fa19218c228c702d7aa49646ee5ca94e0eceaf3a7854810.exe Token: SeTcbPrivilege 5532 b69565caae088b7a2fa19218c228c702d7aa49646ee5ca94e0eceaf3a7854810.exe Token: SeDebugPrivilege 5040 64fc57da Token: SeTcbPrivilege 5040 64fc57da
Processes
-
C:\Users\Admin\AppData\Local\Temp\b69565caae088b7a2fa19218c228c702d7aa49646ee5ca94e0eceaf3a7854810.exe"C:\Users\Admin\AppData\Local\Temp\b69565caae088b7a2fa19218c228c702d7aa49646ee5ca94e0eceaf3a7854810.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5532
-
C:\Windows\Syswow64\64fc57daC:\Windows\Syswow64\64fc57da1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5040
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\564960
- Size 916B
- SHA256 6906d2b8aba3a488b4bb09a100469d268729fac847c758cf4a6e7f45f458bcf3
- MD5 d2e712c69be9324c6aacfe370bb22f47
- SHA1 c4a9efc2ed677d12e761c6646d9a42de0cd4f656
- SHA512 eab8c9bcf592c3a5650011646d06354744df61763ede04fc6f74f4ab1587154d67cd464604d4e61b75ec4cbd5f4c14ac10c242939d630ba10f29a424cf6d144d
- TLSH T19E11E7729455E3A1DC9D43663DF269DC67B0789BC6CB45171C83A0C9267639DC3B9802
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\64fc57da
- Size 640KB
- SHA256 1d9577d595ad37b6430f994dcd3bc986f0048b490214a8386243c5849169a42e
- MD5 8a8d4358bd7eeb1942f56e20d200af65
- SHA1 f4d8f6da309553dc08ddca22c805393da29518d7
- SHA512 4117c5d11b80f43501a981b10d4f2c232b707b33fb51a5ec0341211f8301684c3d4025d40eac64eb6afba9c9db90075cb1ee5988a90fc6b8b63146faccd2bbea
- SSDEEP 6144:ZcTgav1cdCTuoPbgwmOLJvKRwLSFXdFwirGcEOkCybEaQRuy8KU5Rc:ZSvO2x9mONvKRwLSFtsOkxHya5+
- TLSH T17DD45B35A6808036C0B74631C6F64BAAF9B5BC25631195CFA384376A1F737D2BA3570E
- MD5 SHA1 SHA512 SSDEEP TLSH