Analysis
- max time kernel
148s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
21/07/2026, 19:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
93a55f7908f5acccabc59f9b37aee1e553e7fc97b389c50cc7de3e8e64bb4ec1.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
93a55f7908f5acccabc59f9b37aee1e553e7fc97b389c50cc7de3e8e64bb4ec1.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 93a55f7908f5acccabc59f9b37aee1e553e7fc97b389c50cc7de3e8e64bb4ec1.exe
- Size 395KB
- Sample260721-xvj2jsshpe
- SHA256 93a55f7908f5acccabc59f9b37aee1e553e7fc97b389c50cc7de3e8e64bb4ec1
- MD5 46e051a73eb8a3ddac23ddee2fe20ec2
- SHA1 b2df1c0d658b740d442f5d8f826d2304535a68eb
- SHA512 8d69caa670e0c1dc2fecf1dcc0fe2359087a3bfa13003b693b0e3eaa8458be994b74e49e26b479f0f7265ab4392f4b92d1cadf0f54885b6925b3825f10764f7d
- SSDEEP 6144:YcbcTgav1cdCTuoPbgwmOLJvKRILSFvdFDcEOkCybEaQRXr9HNdvOa:YCSvO2x9mONvKRILSFnOkx2LIa
- TLSH T104846D2AB6A0D076C4B79579C4A247BAFBB1742137204ACFA390475A1F637E2BD3530D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1160 708f8862 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 1 114.114.114.114 4468 93a55f7908f5acccabc59f9b37aee1e553e7fc97b389c50cc7de3e8e64bb4ec1.exe Destination IP 3 223.5.5.5 4468 93a55f7908f5acccabc59f9b37aee1e553e7fc97b389c50cc7de3e8e64bb4ec1.exe Destination IP 11 114.114.114.114 4468 93a55f7908f5acccabc59f9b37aee1e553e7fc97b389c50cc7de3e8e64bb4ec1.exe Destination IP 12 223.5.5.5 4468 93a55f7908f5acccabc59f9b37aee1e553e7fc97b389c50cc7de3e8e64bb4ec1.exe - Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\708f8862 93a55f7908f5acccabc59f9b37aee1e553e7fc97b389c50cc7de3e8e64bb4ec1.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 708f8862 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 708f8862 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 708f8862 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 708f8862 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\4c7e68 93a55f7908f5acccabc59f9b37aee1e553e7fc97b389c50cc7de3e8e64bb4ec1.exe File opened for modification C:\Windows\13dc10 708f8862 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93a55f7908f5acccabc59f9b37aee1e553e7fc97b389c50cc7de3e8e64bb4ec1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 708f8862 - Modifies data under HKEY_USERS 8 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 708f8862 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 708f8862 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 708f8862 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 708f8862 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 708f8862 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 708f8862 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 708f8862 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 708f8862 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 1160 708f8862 1160 708f8862 1160 708f8862 1160 708f8862 1160 708f8862 1160 708f8862 1160 708f8862 1160 708f8862 4468 93a55f7908f5acccabc59f9b37aee1e553e7fc97b389c50cc7de3e8e64bb4ec1.exe 4468 93a55f7908f5acccabc59f9b37aee1e553e7fc97b389c50cc7de3e8e64bb4ec1.exe 4468 93a55f7908f5acccabc59f9b37aee1e553e7fc97b389c50cc7de3e8e64bb4ec1.exe 4468 93a55f7908f5acccabc59f9b37aee1e553e7fc97b389c50cc7de3e8e64bb4ec1.exe 4468 93a55f7908f5acccabc59f9b37aee1e553e7fc97b389c50cc7de3e8e64bb4ec1.exe 4468 93a55f7908f5acccabc59f9b37aee1e553e7fc97b389c50cc7de3e8e64bb4ec1.exe 4468 93a55f7908f5acccabc59f9b37aee1e553e7fc97b389c50cc7de3e8e64bb4ec1.exe 4468 93a55f7908f5acccabc59f9b37aee1e553e7fc97b389c50cc7de3e8e64bb4ec1.exe 4468 93a55f7908f5acccabc59f9b37aee1e553e7fc97b389c50cc7de3e8e64bb4ec1.exe 4468 93a55f7908f5acccabc59f9b37aee1e553e7fc97b389c50cc7de3e8e64bb4ec1.exe 4468 93a55f7908f5acccabc59f9b37aee1e553e7fc97b389c50cc7de3e8e64bb4ec1.exe 4468 93a55f7908f5acccabc59f9b37aee1e553e7fc97b389c50cc7de3e8e64bb4ec1.exe 4468 93a55f7908f5acccabc59f9b37aee1e553e7fc97b389c50cc7de3e8e64bb4ec1.exe 4468 93a55f7908f5acccabc59f9b37aee1e553e7fc97b389c50cc7de3e8e64bb4ec1.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4468 93a55f7908f5acccabc59f9b37aee1e553e7fc97b389c50cc7de3e8e64bb4ec1.exe Token: SeTcbPrivilege 4468 93a55f7908f5acccabc59f9b37aee1e553e7fc97b389c50cc7de3e8e64bb4ec1.exe Token: SeDebugPrivilege 1160 708f8862 Token: SeTcbPrivilege 1160 708f8862
Processes
-
C:\Users\Admin\AppData\Local\Temp\93a55f7908f5acccabc59f9b37aee1e553e7fc97b389c50cc7de3e8e64bb4ec1.exe"C:\Users\Admin\AppData\Local\Temp\93a55f7908f5acccabc59f9b37aee1e553e7fc97b389c50cc7de3e8e64bb4ec1.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4468
-
C:\Windows\Syswow64\708f8862C:\Windows\Syswow64\708f88621⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1160
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\708f8862
- Size 395KB
- SHA256 a12f371536e804c9c7946dd140753120a2de443967ba2b2fe2f61e4447e4dcf6
- MD5 b1a534087a7800c77a283c43aacc7dc0
- SHA1 28b6618fadf88e97b789aedfc53c8288b9e86ba5
- SHA512 4050aede4d40bc7583bcc376210206473d1bd5525412b7f4850c4efef742b934fa634ef909955676952a6a7e8ea5cb621150d20d2d9f1540f808a1bb85690921
- SSDEEP 6144:CcbcTgav1cdCTuoPbgwmOLJvKRILSFvdFDcEOkCybEaQRXr9HNdvOa:CCSvO2x9mONvKRILSFnOkx2LIa
- TLSH T1E1846D2AB6A0D076C4B79579C4A247BAFBB1742137204ACFA390475A1F637E2BD3530D
- MD5 SHA1 SHA512 SSDEEP TLSH