Analysis
- max time kernel
148s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/07/2026, 19:17
Behavioral task
behavioral1
Sample
3f03a41a188ed8e695d328d71489f849cf86d2b5f98b3622ceaa2a7e9f44ab90.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 3f03a41a188ed8e695d328d71489f849cf86d2b5f98b3622ceaa2a7e9f44ab90.exe
- Size 761KB
- Sample260722-xzp4cssgqe
- SHA256 3f03a41a188ed8e695d328d71489f849cf86d2b5f98b3622ceaa2a7e9f44ab90
- MD5 dcd3a2d896c5df86ba2355e97729a8f9
- SHA1 57aaafd9c257bd57adf1ab5191dce015eb4827a0
- SHA512 b5b8f4803e0cab21fe095961b29d0961e2556f689f4b988d8f9d42e22d5e314fadaf3a8e2cbb1d723d0c75ab06c52114f2896fc66c2bc77935fec422726acc63
- SSDEEP 12288:mSvO2x9mONvKRwLSFtsOkxHya5hYIW0p98B:FvO2xJKRw2kOkxSkW298B
- TLSH T176F49E35A2808036C0B34532C6F94AABF9797D35631565CBA3843B662F737D2BA3570E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4104 38f395a8 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 22 223.5.5.5 4484 3f03a41a188ed8e695d328d71489f849cf86d2b5f98b3622ceaa2a7e9f44ab90.exe Destination IP 1 114.114.114.114 4484 3f03a41a188ed8e695d328d71489f849cf86d2b5f98b3622ceaa2a7e9f44ab90.exe Destination IP 4 223.5.5.5 4484 3f03a41a188ed8e695d328d71489f849cf86d2b5f98b3622ceaa2a7e9f44ab90.exe Destination IP 21 114.114.114.114 4484 3f03a41a188ed8e695d328d71489f849cf86d2b5f98b3622ceaa2a7e9f44ab90.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 38f395a8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 38f395a8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 38f395a8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 38f395a8 File created C:\Windows\SysWOW64\38f395a8 3f03a41a188ed8e695d328d71489f849cf86d2b5f98b3622ceaa2a7e9f44ab90.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 38f395a8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 38f395a8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 38f395a8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 38f395a8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 38f395a8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 38f395a8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 38f395a8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 38f395a8 -
resource yara_rule behavioral2/memory/4484-0-0x0000000000C90000-0x0000000000D1C000-memory.dmp upx behavioral2/files/0x001300000001b1d0-2.dat upx behavioral2/memory/4104-4-0x0000000000750000-0x00000000007DC000-memory.dmp upx behavioral2/memory/4484-16-0x0000000000C90000-0x0000000000D1C000-memory.dmp upx behavioral2/memory/4104-17-0x0000000000750000-0x00000000007DC000-memory.dmp upx behavioral2/memory/4104-32-0x0000000000750000-0x00000000007DC000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\464310 38f395a8 File opened for modification C:\Windows\4cc488 3f03a41a188ed8e695d328d71489f849cf86d2b5f98b3622ceaa2a7e9f44ab90.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3f03a41a188ed8e695d328d71489f849cf86d2b5f98b3622ceaa2a7e9f44ab90.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38f395a8 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 38f395a8 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 38f395a8 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 38f395a8 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 38f395a8 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 38f395a8 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 38f395a8 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 38f395a8 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 38f395a8 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 38f395a8 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 4104 38f395a8 4104 38f395a8 4104 38f395a8 4104 38f395a8 4104 38f395a8 4104 38f395a8 4104 38f395a8 4104 38f395a8 4484 3f03a41a188ed8e695d328d71489f849cf86d2b5f98b3622ceaa2a7e9f44ab90.exe 4484 3f03a41a188ed8e695d328d71489f849cf86d2b5f98b3622ceaa2a7e9f44ab90.exe 4484 3f03a41a188ed8e695d328d71489f849cf86d2b5f98b3622ceaa2a7e9f44ab90.exe 4484 3f03a41a188ed8e695d328d71489f849cf86d2b5f98b3622ceaa2a7e9f44ab90.exe 4484 3f03a41a188ed8e695d328d71489f849cf86d2b5f98b3622ceaa2a7e9f44ab90.exe 4484 3f03a41a188ed8e695d328d71489f849cf86d2b5f98b3622ceaa2a7e9f44ab90.exe 4484 3f03a41a188ed8e695d328d71489f849cf86d2b5f98b3622ceaa2a7e9f44ab90.exe 4484 3f03a41a188ed8e695d328d71489f849cf86d2b5f98b3622ceaa2a7e9f44ab90.exe 4484 3f03a41a188ed8e695d328d71489f849cf86d2b5f98b3622ceaa2a7e9f44ab90.exe 4484 3f03a41a188ed8e695d328d71489f849cf86d2b5f98b3622ceaa2a7e9f44ab90.exe 4484 3f03a41a188ed8e695d328d71489f849cf86d2b5f98b3622ceaa2a7e9f44ab90.exe 4484 3f03a41a188ed8e695d328d71489f849cf86d2b5f98b3622ceaa2a7e9f44ab90.exe 4484 3f03a41a188ed8e695d328d71489f849cf86d2b5f98b3622ceaa2a7e9f44ab90.exe 4484 3f03a41a188ed8e695d328d71489f849cf86d2b5f98b3622ceaa2a7e9f44ab90.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4484 3f03a41a188ed8e695d328d71489f849cf86d2b5f98b3622ceaa2a7e9f44ab90.exe Token: SeTcbPrivilege 4484 3f03a41a188ed8e695d328d71489f849cf86d2b5f98b3622ceaa2a7e9f44ab90.exe Token: SeDebugPrivilege 4104 38f395a8 Token: SeTcbPrivilege 4104 38f395a8
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f03a41a188ed8e695d328d71489f849cf86d2b5f98b3622ceaa2a7e9f44ab90.exe"C:\Users\Admin\AppData\Local\Temp\3f03a41a188ed8e695d328d71489f849cf86d2b5f98b3622ceaa2a7e9f44ab90.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4484
-
C:\Windows\Syswow64\38f395a8C:\Windows\Syswow64\38f395a81⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4104
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\38f395a8
- Size 761KB
- SHA256 abf267dae0da5f7f75d70df9a5cb299e7c648e387c1919d670240c7e96bc0e03
- MD5 2b94db09e275b514ad621a039998a7b0
- SHA1 45abd62d8ae5626fadb9f4402aa031998ebaf350
- SHA512 390dfa8418f5b5b5415689892ff638b04aee73f064771dd59e797566e0c2959eb737029e425363a404b0f3bd3d3ba73a13a2275939d090f95720f69d30f33ff8
- SSDEEP 12288:gSvO2x9mONvKRwLSFtsOkxHya5hYIW0p98B:7vO2xJKRw2kOkxSkW298B
- TLSH T1CAF49E35A2808036C0B34532C6F94AABF9797D35631565CBA3843B662F737D2BA3570E
- MD5 SHA1 SHA512 SSDEEP TLSH