Analysis
- max time kernel
148s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/07/2026, 19:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5fb305f21045e2cdc6333b219cf481919cdb2fb4a51f7eaf85bbbfd82db16942.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
5fb305f21045e2cdc6333b219cf481919cdb2fb4a51f7eaf85bbbfd82db16942.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 5fb305f21045e2cdc6333b219cf481919cdb2fb4a51f7eaf85bbbfd82db16942.exe
- Size 395KB
- Sample260722-ya2arsyzf1
- SHA256 5fb305f21045e2cdc6333b219cf481919cdb2fb4a51f7eaf85bbbfd82db16942
- MD5 df81d8505a28ce1c1bc250807f428438
- SHA1 9e60d3556e411ea6ba36a5b26ea7671706173b74
- SHA512 feea1ebfe19571ec3f1a93030579617dadeac75a3b65ce91030dcc5e6e8292e04d03d22eee8a86fec00a1ad40fafc597231f25c99a13efed37c15dc2726a74f4
- SSDEEP 6144:xcbcTgav1cdCTuoPbgwmOLJvKRILSFvdFDcEOkCybEaQRXr9HNdvOa:xCSvO2x9mONvKRILSFnOkx2LIa
- TLSH T133846D2AB6A0D076C4B79579C4A247BAFBB1742137204ACFA390475A1F637E2BD3530D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3472 9df2b137 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 1 114.114.114.114 4356 5fb305f21045e2cdc6333b219cf481919cdb2fb4a51f7eaf85bbbfd82db16942.exe Destination IP 2 223.5.5.5 4356 5fb305f21045e2cdc6333b219cf481919cdb2fb4a51f7eaf85bbbfd82db16942.exe Destination IP 15 114.114.114.114 4356 5fb305f21045e2cdc6333b219cf481919cdb2fb4a51f7eaf85bbbfd82db16942.exe Destination IP 16 223.5.5.5 4356 5fb305f21045e2cdc6333b219cf481919cdb2fb4a51f7eaf85bbbfd82db16942.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 9df2b137 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 9df2b137 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 9df2b137 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 9df2b137 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 9df2b137 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 9df2b137 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 9df2b137 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 9df2b137 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 9df2b137 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 9df2b137 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 9df2b137 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 9df2b137 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 9df2b137 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 9df2b137 File created C:\Windows\SysWOW64\9df2b137 5fb305f21045e2cdc6333b219cf481919cdb2fb4a51f7eaf85bbbfd82db16942.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\4a9388 5fb305f21045e2cdc6333b219cf481919cdb2fb4a51f7eaf85bbbfd82db16942.exe File opened for modification C:\Windows\3b7120 9df2b137 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5fb305f21045e2cdc6333b219cf481919cdb2fb4a51f7eaf85bbbfd82db16942.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9df2b137 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 9df2b137 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 9df2b137 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 9df2b137 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 9df2b137 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 9df2b137 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 9df2b137 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 9df2b137 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 9df2b137 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 9df2b137 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 3472 9df2b137 3472 9df2b137 3472 9df2b137 3472 9df2b137 3472 9df2b137 3472 9df2b137 3472 9df2b137 3472 9df2b137 4356 5fb305f21045e2cdc6333b219cf481919cdb2fb4a51f7eaf85bbbfd82db16942.exe 4356 5fb305f21045e2cdc6333b219cf481919cdb2fb4a51f7eaf85bbbfd82db16942.exe 4356 5fb305f21045e2cdc6333b219cf481919cdb2fb4a51f7eaf85bbbfd82db16942.exe 4356 5fb305f21045e2cdc6333b219cf481919cdb2fb4a51f7eaf85bbbfd82db16942.exe 4356 5fb305f21045e2cdc6333b219cf481919cdb2fb4a51f7eaf85bbbfd82db16942.exe 4356 5fb305f21045e2cdc6333b219cf481919cdb2fb4a51f7eaf85bbbfd82db16942.exe 4356 5fb305f21045e2cdc6333b219cf481919cdb2fb4a51f7eaf85bbbfd82db16942.exe 4356 5fb305f21045e2cdc6333b219cf481919cdb2fb4a51f7eaf85bbbfd82db16942.exe 4356 5fb305f21045e2cdc6333b219cf481919cdb2fb4a51f7eaf85bbbfd82db16942.exe 4356 5fb305f21045e2cdc6333b219cf481919cdb2fb4a51f7eaf85bbbfd82db16942.exe 4356 5fb305f21045e2cdc6333b219cf481919cdb2fb4a51f7eaf85bbbfd82db16942.exe 4356 5fb305f21045e2cdc6333b219cf481919cdb2fb4a51f7eaf85bbbfd82db16942.exe 4356 5fb305f21045e2cdc6333b219cf481919cdb2fb4a51f7eaf85bbbfd82db16942.exe 4356 5fb305f21045e2cdc6333b219cf481919cdb2fb4a51f7eaf85bbbfd82db16942.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4356 5fb305f21045e2cdc6333b219cf481919cdb2fb4a51f7eaf85bbbfd82db16942.exe Token: SeTcbPrivilege 4356 5fb305f21045e2cdc6333b219cf481919cdb2fb4a51f7eaf85bbbfd82db16942.exe Token: SeDebugPrivilege 3472 9df2b137 Token: SeTcbPrivilege 3472 9df2b137
Processes
-
C:\Users\Admin\AppData\Local\Temp\5fb305f21045e2cdc6333b219cf481919cdb2fb4a51f7eaf85bbbfd82db16942.exe"C:\Users\Admin\AppData\Local\Temp\5fb305f21045e2cdc6333b219cf481919cdb2fb4a51f7eaf85bbbfd82db16942.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4356
-
C:\Windows\Syswow64\9df2b137C:\Windows\Syswow64\9df2b1371⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3472
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\9df2b137
- Size 395KB
- SHA256 bbe908b2aa0832c625f9ebf1dcc07128adecaf88cd45474efd8b24e71085cfa6
- MD5 46b4ceb3ed031f12edcc7cd08f9a3e1e
- SHA1 3ad13795c59702f8af6adf8e8bbfcc8788136bb8
- SHA512 c04b5b09250ac2ecd81e776b9fee07bfcb920cf3ae9747344d7dd10fa391267c1784bbf421ecd8746bfb76b5f78acff7953dbe56950b9f8e3d4a5f7012c974c5
- SSDEEP 6144:3cbcTgav1cdCTuoPbgwmOLJvKRILSFvdFDcEOkCybEaQRXr9HNdvOa:3CSvO2x9mONvKRILSFnOkx2LIa
- TLSH T1CF846D2AB6A0D076C4B79579C4A247BAFBB1742137204ACFA390475A1F637E2BD3530D
- MD5 SHA1 SHA512 SSDEEP TLSH