Analysis
- max time kernel
148s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/07/2026, 04:45
Behavioral task
behavioral1
Sample
0ce14abcf850451ce356ce3c614a47f74be5d7c7d32b4d6dda333aeb3b352552.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
0ce14abcf850451ce356ce3c614a47f74be5d7c7d32b4d6dda333aeb3b352552.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 0ce14abcf850451ce356ce3c614a47f74be5d7c7d32b4d6dda333aeb3b352552.exe
- Size 560KB
- Sample260720-fdjwsahy3x
- SHA256 0ce14abcf850451ce356ce3c614a47f74be5d7c7d32b4d6dda333aeb3b352552
- MD5 72e932c0e30310d7a29180434065c863
- SHA1 bb3f7a29d30cd1c3105617e25a259cb63aa45435
- SHA512 db1ecfd1fce504d3e29c6aa2fcacd920ff5d8f6efe21ab931ff39bd5fe2a1831b1caa557d02cdd7146ab619fca88a4aa7efcebbcbf112ff78a5f5277a8b0b9f7
- SSDEEP 6144:Q4ZaN1cb90oOTFmIFLq0cvnXhLCqj2EFNirGcEOkCybEaQRuy8K:QrNOb9+sIF+0cvnXhLCqEsOkxHy
- TLSH T11EC48D29B6E0C076C4B79578C4A186B6FAB17832372459CFA394075A1F337E2BA3570D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5048 ee05c30 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 16 114.114.114.114 2420 0ce14abcf850451ce356ce3c614a47f74be5d7c7d32b4d6dda333aeb3b352552.exe Destination IP 18 223.5.5.5 2420 0ce14abcf850451ce356ce3c614a47f74be5d7c7d32b4d6dda333aeb3b352552.exe Destination IP 1 114.114.114.114 2420 0ce14abcf850451ce356ce3c614a47f74be5d7c7d32b4d6dda333aeb3b352552.exe Destination IP 3 223.5.5.5 2420 0ce14abcf850451ce356ce3c614a47f74be5d7c7d32b4d6dda333aeb3b352552.exe - Drops file in System32 directory 17 IoCs
description ioc Process File created C:\Windows\SysWOW64\ee05c30 0ce14abcf850451ce356ce3c614a47f74be5d7c7d32b4d6dda333aeb3b352552.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 ee05c30 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache ee05c30 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 ee05c30 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AAD646CB44373074ADE741C38400E7E1 ee05c30 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC845F33427F1C99AF855BE8930371C ee05c30 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft ee05c30 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC845F33427F1C99AF855BE8930371C ee05c30 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AAD646CB44373074ADE741C38400E7E1 ee05c30 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE ee05c30 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies ee05c30 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData ee05c30 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 ee05c30 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 ee05c30 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content ee05c30 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 ee05c30 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 ee05c30 -
resource yara_rule behavioral2/memory/2420-0-0x0000000000420000-0x00000000004AC000-memory.dmp upx behavioral2/memory/5048-3-0x0000000000870000-0x00000000008FC000-memory.dmp upx behavioral2/files/0x000a000000011390-2.dat upx behavioral2/memory/2420-19-0x0000000000420000-0x00000000004AC000-memory.dmp upx behavioral2/memory/5048-20-0x0000000000870000-0x00000000008FC000-memory.dmp upx behavioral2/memory/5048-41-0x0000000000870000-0x00000000008FC000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\566c70 ee05c30 File opened for modification C:\Windows\296e68 0ce14abcf850451ce356ce3c614a47f74be5d7c7d32b4d6dda333aeb3b352552.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0ce14abcf850451ce356ce3c614a47f74be5d7c7d32b4d6dda333aeb3b352552.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ee05c30 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" ee05c30 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ee05c30 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ee05c30 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing ee05c30 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix ee05c30 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" ee05c30 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ee05c30 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ee05c30 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ee05c30 - Modifies system certificate store 2 TTPs 2 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1F24C630CDA418EF2069FFAD4FDD5F463A1B69AA\Blob = 5c000000010000000400000080010000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003800000047006c006f00620061006c005300690067006e002000450043004300200052006f006f00740020004300410020002d002000520035000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308620000000100000020000000179fbc148a3dd00fd24ea13458cc43bfa7f59c8182d783a513f6ebec100c89241400000001000000140000003de629489bea07ca21444a26de6eded283d09f591d0000000100000010000000b647dd2a9ccadee75e8905e256cc6b147f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d7010300000001000000140000001f24c630cda418ef2069ffad4fdd5f463a1b69aa2000000001000000220200003082021e308201a4a0030201020211605949e0262ebb55f90a778a71f94ad86c300a06082a8648ce3d040303305031243022060355040b131b476c6f62616c5369676e2045434320526f6f74204341202d20523531133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3132313131333030303030305a170d3338303131393033313430375a305031243022060355040b131b476c6f62616c5369676e2045434320526f6f74204341202d20523531133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e3076301006072a8648ce3d020106052b810400220362000447450e96fb7d5dbfe939d121f89f0bb6d57b1e923a48591cf062312dc07a28fe1aa75cb3b6cc97e745d458fad1776d43a2c08765340a1f7addeb3c33a1c59d4da46f4195387fc91e84ebd19e49928794870c3a854a669f9d59934d976106864aa3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604143de629489bea07ca21444a26de6eded283d09f59300a06082a8648ce3d0403030368003065023100e56912c96edbc631ba0941e197f8fbfd9ae27d12c9ed7c64d3cb05258b56d9a0e75e5d4e0b839c5b7629a00926216a62023071d2b58f5cea3be1780985a875923bc85cfd48ef0d7422a808e26ec549cec70cbca76169f1f73be12acbf92bf3669037 ee05c30 Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1F24C630CDA418EF2069FFAD4FDD5F463A1B69AA ee05c30 - Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 5048 ee05c30 5048 ee05c30 5048 ee05c30 5048 ee05c30 5048 ee05c30 5048 ee05c30 5048 ee05c30 5048 ee05c30 5048 ee05c30 5048 ee05c30 5048 ee05c30 5048 ee05c30 5048 ee05c30 5048 ee05c30 5048 ee05c30 5048 ee05c30 5048 ee05c30 5048 ee05c30 5048 ee05c30 5048 ee05c30 2420 0ce14abcf850451ce356ce3c614a47f74be5d7c7d32b4d6dda333aeb3b352552.exe 2420 0ce14abcf850451ce356ce3c614a47f74be5d7c7d32b4d6dda333aeb3b352552.exe 2420 0ce14abcf850451ce356ce3c614a47f74be5d7c7d32b4d6dda333aeb3b352552.exe 2420 0ce14abcf850451ce356ce3c614a47f74be5d7c7d32b4d6dda333aeb3b352552.exe 2420 0ce14abcf850451ce356ce3c614a47f74be5d7c7d32b4d6dda333aeb3b352552.exe 2420 0ce14abcf850451ce356ce3c614a47f74be5d7c7d32b4d6dda333aeb3b352552.exe 2420 0ce14abcf850451ce356ce3c614a47f74be5d7c7d32b4d6dda333aeb3b352552.exe 2420 0ce14abcf850451ce356ce3c614a47f74be5d7c7d32b4d6dda333aeb3b352552.exe 2420 0ce14abcf850451ce356ce3c614a47f74be5d7c7d32b4d6dda333aeb3b352552.exe 2420 0ce14abcf850451ce356ce3c614a47f74be5d7c7d32b4d6dda333aeb3b352552.exe 2420 0ce14abcf850451ce356ce3c614a47f74be5d7c7d32b4d6dda333aeb3b352552.exe 2420 0ce14abcf850451ce356ce3c614a47f74be5d7c7d32b4d6dda333aeb3b352552.exe 2420 0ce14abcf850451ce356ce3c614a47f74be5d7c7d32b4d6dda333aeb3b352552.exe 2420 0ce14abcf850451ce356ce3c614a47f74be5d7c7d32b4d6dda333aeb3b352552.exe 2420 0ce14abcf850451ce356ce3c614a47f74be5d7c7d32b4d6dda333aeb3b352552.exe 2420 0ce14abcf850451ce356ce3c614a47f74be5d7c7d32b4d6dda333aeb3b352552.exe 2420 0ce14abcf850451ce356ce3c614a47f74be5d7c7d32b4d6dda333aeb3b352552.exe 2420 0ce14abcf850451ce356ce3c614a47f74be5d7c7d32b4d6dda333aeb3b352552.exe 2420 0ce14abcf850451ce356ce3c614a47f74be5d7c7d32b4d6dda333aeb3b352552.exe 2420 0ce14abcf850451ce356ce3c614a47f74be5d7c7d32b4d6dda333aeb3b352552.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2420 0ce14abcf850451ce356ce3c614a47f74be5d7c7d32b4d6dda333aeb3b352552.exe Token: SeTcbPrivilege 2420 0ce14abcf850451ce356ce3c614a47f74be5d7c7d32b4d6dda333aeb3b352552.exe Token: SeDebugPrivilege 5048 ee05c30 Token: SeTcbPrivilege 5048 ee05c30
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ce14abcf850451ce356ce3c614a47f74be5d7c7d32b4d6dda333aeb3b352552.exe"C:\Users\Admin\AppData\Local\Temp\0ce14abcf850451ce356ce3c614a47f74be5d7c7d32b4d6dda333aeb3b352552.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2420
-
C:\Windows\Syswow64\ee05c30C:\Windows\Syswow64\ee05c301⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5048
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\566c70
- Size 1KB
- SHA256 ca5fe2f45373efcddf462e78b78e4977c6e4becc9462f374ed129e90f729de33
- MD5 b05a5fe897310a8a2cbf8890f3d3dbba
- SHA1 64f78fb097345b9ab3e56b4d5bdaa27217ce4402
- SHA512 691a7192e0043f2d3067478fefa1ffe2851ce028eb8d89d118fdca6a7920867d7893746eaa511ecb278e842ffbda1c6afee39ea613036b06b469db535534db07
- TLSH T17721243DB8FCA8E256BF4BE55B46C4C4B372A03F4904516A04C638C7A0B369CAA5743E
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\ee05c30
- Size 560KB
- SHA256 9fc9d143b3c8566abc016e27b79d6597ce4c8beca7450a3adec6f53d733c416e
- MD5 fdf8f0edc5e21088652d8f39743cfca5
- SHA1 d78a1fa4b0509bf94f1ce2c0eef9e204ef1edacc
- SHA512 b925cbf89887ac55ddb01a9395da3ba1e8cbd99b9041c09927d97e4d19fcf6729f47fa32d6657accafa46af0e0e64caa743746694cd7b70f75fc30fb0980faa4
- SSDEEP 6144:W4ZaN1cb90oOTFmIFLq0cvnXhLCqj2EFNirGcEOkCybEaQRuy8K:WrNOb9+sIF+0cvnXhLCqEsOkxHy
- TLSH T184C48D29B6E0C076C4B79578C4A186B6FAB17832372459CFA394075A1F337E2BA3570D
- MD5 SHA1 SHA512 SSDEEP TLSH