Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
21/07/2026, 19:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
93a55f7908f5acccabc59f9b37aee1e553e7fc97b389c50cc7de3e8e64bb4ec1.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
93a55f7908f5acccabc59f9b37aee1e553e7fc97b389c50cc7de3e8e64bb4ec1.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 93a55f7908f5acccabc59f9b37aee1e553e7fc97b389c50cc7de3e8e64bb4ec1.exe
- Size 395KB
- Sample260721-xvj2jsshpe
- SHA256 93a55f7908f5acccabc59f9b37aee1e553e7fc97b389c50cc7de3e8e64bb4ec1
- MD5 46e051a73eb8a3ddac23ddee2fe20ec2
- SHA1 b2df1c0d658b740d442f5d8f826d2304535a68eb
- SHA512 8d69caa670e0c1dc2fecf1dcc0fe2359087a3bfa13003b693b0e3eaa8458be994b74e49e26b479f0f7265ab4392f4b92d1cadf0f54885b6925b3825f10764f7d
- SSDEEP 6144:YcbcTgav1cdCTuoPbgwmOLJvKRILSFvdFDcEOkCybEaQRXr9HNdvOa:YCSvO2x9mONvKRILSFnOkx2LIa
- TLSH T104846D2AB6A0D076C4B79579C4A247BAFBB1742137204ACFA390475A1F637E2BD3530D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2904 657d7575 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 4 223.5.5.5 4452 93a55f7908f5acccabc59f9b37aee1e553e7fc97b389c50cc7de3e8e64bb4ec1.exe Destination IP 21 114.114.114.114 4452 93a55f7908f5acccabc59f9b37aee1e553e7fc97b389c50cc7de3e8e64bb4ec1.exe Destination IP 22 223.5.5.5 4452 93a55f7908f5acccabc59f9b37aee1e553e7fc97b389c50cc7de3e8e64bb4ec1.exe Destination IP 3 114.114.114.114 4452 93a55f7908f5acccabc59f9b37aee1e553e7fc97b389c50cc7de3e8e64bb4ec1.exe - Drops file in System32 directory 11 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 657d7575 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 657d7575 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 657d7575 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 657d7575 File created C:\Windows\SysWOW64\657d7575 93a55f7908f5acccabc59f9b37aee1e553e7fc97b389c50cc7de3e8e64bb4ec1.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 657d7575 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 657d7575 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 657d7575 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 657d7575 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 657d7575 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 657d7575 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\31b7b0 657d7575 File opened for modification C:\Windows\4c3848 93a55f7908f5acccabc59f9b37aee1e553e7fc97b389c50cc7de3e8e64bb4ec1.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93a55f7908f5acccabc59f9b37aee1e553e7fc97b389c50cc7de3e8e64bb4ec1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 657d7575 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 657d7575 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 657d7575 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 657d7575 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 657d7575 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 657d7575 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 657d7575 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 657d7575 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 657d7575 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 657d7575 - Modifies system certificate store 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1F24C630CDA418EF2069FFAD4FDD5F463A1B69AA 93a55f7908f5acccabc59f9b37aee1e553e7fc97b389c50cc7de3e8e64bb4ec1.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1F24C630CDA418EF2069FFAD4FDD5F463A1B69AA\Blob = 5c0000000100000004000000800100000f0000000100000030000000f019c7ba12795dacd6ef1a767657deb8e41060a2ad1a6c66900a6ec16870fc06eecbaffdd3e2c986659578e7e85e535a530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003800000047006c006f00620061006c005300690067006e002000450043004300200052006f006f00740020004300410020002d002000520035000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308620000000100000020000000179fbc148a3dd00fd24ea13458cc43bfa7f59c8182d783a513f6ebec100c89241400000001000000140000003de629489bea07ca21444a26de6eded283d09f591d0000000100000010000000b647dd2a9ccadee75e8905e256cc6b147f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d7010300000001000000140000001f24c630cda418ef2069ffad4fdd5f463a1b69aa190000000100000010000000e3087c0c81f60a2a2b466b8a3e70cce82000000001000000220200003082021e308201a4a0030201020211605949e0262ebb55f90a778a71f94ad86c300a06082a8648ce3d040303305031243022060355040b131b476c6f62616c5369676e2045434320526f6f74204341202d20523531133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3132313131333030303030305a170d3338303131393033313430375a305031243022060355040b131b476c6f62616c5369676e2045434320526f6f74204341202d20523531133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e3076301006072a8648ce3d020106052b810400220362000447450e96fb7d5dbfe939d121f89f0bb6d57b1e923a48591cf062312dc07a28fe1aa75cb3b6cc97e745d458fad1776d43a2c08765340a1f7addeb3c33a1c59d4da46f4195387fc91e84ebd19e49928794870c3a854a669f9d59934d976106864aa3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604143de629489bea07ca21444a26de6eded283d09f59300a06082a8648ce3d0403030368003065023100e56912c96edbc631ba0941e197f8fbfd9ae27d12c9ed7c64d3cb05258b56d9a0e75e5d4e0b839c5b7629a00926216a62023071d2b58f5cea3be1780985a875923bc85cfd48ef0d7422a808e26ec549cec70cbca76169f1f73be12acbf92bf3669037 93a55f7908f5acccabc59f9b37aee1e553e7fc97b389c50cc7de3e8e64bb4ec1.exe - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 2904 657d7575 2904 657d7575 2904 657d7575 2904 657d7575 2904 657d7575 2904 657d7575 2904 657d7575 2904 657d7575 2904 657d7575 2904 657d7575 2904 657d7575 2904 657d7575 4452 93a55f7908f5acccabc59f9b37aee1e553e7fc97b389c50cc7de3e8e64bb4ec1.exe 4452 93a55f7908f5acccabc59f9b37aee1e553e7fc97b389c50cc7de3e8e64bb4ec1.exe 4452 93a55f7908f5acccabc59f9b37aee1e553e7fc97b389c50cc7de3e8e64bb4ec1.exe 4452 93a55f7908f5acccabc59f9b37aee1e553e7fc97b389c50cc7de3e8e64bb4ec1.exe 4452 93a55f7908f5acccabc59f9b37aee1e553e7fc97b389c50cc7de3e8e64bb4ec1.exe 4452 93a55f7908f5acccabc59f9b37aee1e553e7fc97b389c50cc7de3e8e64bb4ec1.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4452 93a55f7908f5acccabc59f9b37aee1e553e7fc97b389c50cc7de3e8e64bb4ec1.exe Token: SeTcbPrivilege 4452 93a55f7908f5acccabc59f9b37aee1e553e7fc97b389c50cc7de3e8e64bb4ec1.exe Token: SeDebugPrivilege 2904 657d7575 Token: SeTcbPrivilege 2904 657d7575
Processes
-
C:\Users\Admin\AppData\Local\Temp\93a55f7908f5acccabc59f9b37aee1e553e7fc97b389c50cc7de3e8e64bb4ec1.exe"C:\Users\Admin\AppData\Local\Temp\93a55f7908f5acccabc59f9b37aee1e553e7fc97b389c50cc7de3e8e64bb4ec1.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4452
-
C:\Windows\Syswow64\657d7575C:\Windows\Syswow64\657d75751⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2904
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\657d7575
- Size 395KB
- SHA256 ade5f1076659bdba9d2759f4c790ce5157172a93b06eb8364b05e3b07140b95b
- MD5 2322fca56d9cd227b497efa73b4afdaf
- SHA1 1f42cafbe471b9f4edd08171fbb0a5e0274c3945
- SHA512 565999b36c9afea8e5531e0cae7ff693a0e9ba85dfa5650d32455d5cddec3a31fefdfa7a5db8ecefbdbbfc7562d39d15d3044d9743fec6e11a2d8fc4e28ed7d0
- SSDEEP 6144:fcbcTgav1cdCTuoPbgwmOLJvKRILSFvdFDcEOkCybEaQRXr9HNdvOa:fCSvO2x9mONvKRILSFnOkx2LIa
- TLSH T124846D2AB6A0D076C4B79579C4A247BAFBB1742137204ACFA390475A1F637E2BD3530D
- MD5 SHA1 SHA512 SSDEEP TLSH