Analysis
- max time kernel
150s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/07/2026, 19:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fec720832eb27f1a18f320e2c0582ea6076aaeee6bd835e44f9d7d374dd1d864.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
fec720832eb27f1a18f320e2c0582ea6076aaeee6bd835e44f9d7d374dd1d864.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target fec720832eb27f1a18f320e2c0582ea6076aaeee6bd835e44f9d7d374dd1d864.exe
- Size 1.1MB
- Sample260720-ybajfaey9z
- SHA256 fec720832eb27f1a18f320e2c0582ea6076aaeee6bd835e44f9d7d374dd1d864
- MD5 047109a6c0333349edb0b32f19ffed9e
- SHA1 79d86edbb875519e2578959126fcdf80b48f7f54
- SHA512 efb6f24641cf5525dda7f0838d134e9726b7d8c7b59049c92719182a65b109d0253eda4f86a806d4916a4928f1cb105d037ce34b59c9aca7c163b64dc262a27f
- SSDEEP 24576:MvO2xJKRI2dOkx2LFAAX1oOYSY82e5QPJJOgufWWsYo:MHHKO2FQd1oOU82lPJ6Po
- TLSH T1BE359D12F7A1C072C8A7427448B6C36EA675BC152B214BCBB7C03B5E5E723D1AE36359
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5260 dbcdbf34 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 1 114.114.114.114 540 fec720832eb27f1a18f320e2c0582ea6076aaeee6bd835e44f9d7d374dd1d864.exe Destination IP 2 223.5.5.5 540 fec720832eb27f1a18f320e2c0582ea6076aaeee6bd835e44f9d7d374dd1d864.exe Destination IP 10 114.114.114.114 540 fec720832eb27f1a18f320e2c0582ea6076aaeee6bd835e44f9d7d374dd1d864.exe Destination IP 11 223.5.5.5 540 fec720832eb27f1a18f320e2c0582ea6076aaeee6bd835e44f9d7d374dd1d864.exe - Drops file in System32 directory 17 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE dbcdbf34 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 dbcdbf34 File created C:\Windows\SysWOW64\dbcdbf34 fec720832eb27f1a18f320e2c0582ea6076aaeee6bd835e44f9d7d374dd1d864.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 dbcdbf34 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache dbcdbf34 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData dbcdbf34 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content dbcdbf34 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 dbcdbf34 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC845F33427F1C99AF855BE8930371C dbcdbf34 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft dbcdbf34 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 dbcdbf34 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 dbcdbf34 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 dbcdbf34 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC845F33427F1C99AF855BE8930371C dbcdbf34 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 dbcdbf34 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies dbcdbf34 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 dbcdbf34 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\5a0d98 dbcdbf34 File opened for modification C:\Windows\93eb8 fec720832eb27f1a18f320e2c0582ea6076aaeee6bd835e44f9d7d374dd1d864.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fec720832eb27f1a18f320e2c0582ea6076aaeee6bd835e44f9d7d374dd1d864.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dbcdbf34 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" dbcdbf34 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" dbcdbf34 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ dbcdbf34 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" dbcdbf34 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" dbcdbf34 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing dbcdbf34 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix dbcdbf34 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" dbcdbf34 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" dbcdbf34 - Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 5260 dbcdbf34 5260 dbcdbf34 5260 dbcdbf34 5260 dbcdbf34 5260 dbcdbf34 5260 dbcdbf34 5260 dbcdbf34 5260 dbcdbf34 5260 dbcdbf34 5260 dbcdbf34 5260 dbcdbf34 5260 dbcdbf34 5260 dbcdbf34 5260 dbcdbf34 5260 dbcdbf34 5260 dbcdbf34 5260 dbcdbf34 5260 dbcdbf34 5260 dbcdbf34 5260 dbcdbf34 540 fec720832eb27f1a18f320e2c0582ea6076aaeee6bd835e44f9d7d374dd1d864.exe 540 fec720832eb27f1a18f320e2c0582ea6076aaeee6bd835e44f9d7d374dd1d864.exe 540 fec720832eb27f1a18f320e2c0582ea6076aaeee6bd835e44f9d7d374dd1d864.exe 540 fec720832eb27f1a18f320e2c0582ea6076aaeee6bd835e44f9d7d374dd1d864.exe 540 fec720832eb27f1a18f320e2c0582ea6076aaeee6bd835e44f9d7d374dd1d864.exe 540 fec720832eb27f1a18f320e2c0582ea6076aaeee6bd835e44f9d7d374dd1d864.exe 540 fec720832eb27f1a18f320e2c0582ea6076aaeee6bd835e44f9d7d374dd1d864.exe 540 fec720832eb27f1a18f320e2c0582ea6076aaeee6bd835e44f9d7d374dd1d864.exe 540 fec720832eb27f1a18f320e2c0582ea6076aaeee6bd835e44f9d7d374dd1d864.exe 540 fec720832eb27f1a18f320e2c0582ea6076aaeee6bd835e44f9d7d374dd1d864.exe 540 fec720832eb27f1a18f320e2c0582ea6076aaeee6bd835e44f9d7d374dd1d864.exe 540 fec720832eb27f1a18f320e2c0582ea6076aaeee6bd835e44f9d7d374dd1d864.exe 540 fec720832eb27f1a18f320e2c0582ea6076aaeee6bd835e44f9d7d374dd1d864.exe 540 fec720832eb27f1a18f320e2c0582ea6076aaeee6bd835e44f9d7d374dd1d864.exe 540 fec720832eb27f1a18f320e2c0582ea6076aaeee6bd835e44f9d7d374dd1d864.exe 540 fec720832eb27f1a18f320e2c0582ea6076aaeee6bd835e44f9d7d374dd1d864.exe 540 fec720832eb27f1a18f320e2c0582ea6076aaeee6bd835e44f9d7d374dd1d864.exe 540 fec720832eb27f1a18f320e2c0582ea6076aaeee6bd835e44f9d7d374dd1d864.exe 540 fec720832eb27f1a18f320e2c0582ea6076aaeee6bd835e44f9d7d374dd1d864.exe 540 fec720832eb27f1a18f320e2c0582ea6076aaeee6bd835e44f9d7d374dd1d864.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 540 fec720832eb27f1a18f320e2c0582ea6076aaeee6bd835e44f9d7d374dd1d864.exe Token: SeTcbPrivilege 540 fec720832eb27f1a18f320e2c0582ea6076aaeee6bd835e44f9d7d374dd1d864.exe Token: SeDebugPrivilege 5260 dbcdbf34 Token: SeTcbPrivilege 5260 dbcdbf34
Processes
-
C:\Users\Admin\AppData\Local\Temp\fec720832eb27f1a18f320e2c0582ea6076aaeee6bd835e44f9d7d374dd1d864.exe"C:\Users\Admin\AppData\Local\Temp\fec720832eb27f1a18f320e2c0582ea6076aaeee6bd835e44f9d7d374dd1d864.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:540
-
C:\Windows\Syswow64\dbcdbf34C:\Windows\Syswow64\dbcdbf341⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5260
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\5a0d98
- Size 1KB
- SHA256 b3f825e80dba8141bea78655a935557d0e4a274243edd40c5f5b6d68f333139a
- MD5 a907fe794f212e9a376e9b2593b94ccd
- SHA1 57e101f498a3e74146b230f904e7bdece4d5a81d
- SHA512 257b1477d6bf14fb5d659d3bb5acee2082d53adf643eaa283d8a35344566ab92c93e4a9d9d5faa6807757472ddb30d6acd2299dbfc27ba09f4eac1a132d063dc
- TLSH T13A2112BAB9D9E7F039E865192AA3CCDD6E1935F3B102102704AB7D111A034AC7822C2A
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\dbcdbf34
- Size 1.1MB
- SHA256 eb8eedc8586538b0e6068fe94337dc7193f0f41e64959d81ce3cb3ada3f4e61e
- MD5 51119a42153d85f9f2a8101a3a1a5542
- SHA1 1c9cb060aab968a1d71558f5ebc22c8f4216fa5e
- SHA512 0825d948e14dcb7bebaaef3fdc133e94cec3fbb01ae37b22a47c242193f2251e83d8ddc6edc735d46d0ed5f4ef74095343af470a32448a2a1fa8388f0243c733
- SSDEEP 24576:tvO2xJKRI2dOkx2LFAAX1oOYSY82e5QPJJOgufWWsYo:tHHKO2FQd1oOU82lPJ6Po
- TLSH T179359D12F7A1C072C8A7427448B6C36EA675BC152B214BCBB7C03B5E5E723D1AE36359
- MD5 SHA1 SHA512 SSDEEP TLSH