Analysis
- max time kernel
148s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/07/2026, 19:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fd4b256b0991b267a528f7a85ed2facd2db8ddb1c683521bccdadfef2699cf48.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
fd4b256b0991b267a528f7a85ed2facd2db8ddb1c683521bccdadfef2699cf48.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target fd4b256b0991b267a528f7a85ed2facd2db8ddb1c683521bccdadfef2699cf48.exe
- Size 871KB
- Sample260722-yn6gmsbg83
- SHA256 fd4b256b0991b267a528f7a85ed2facd2db8ddb1c683521bccdadfef2699cf48
- MD5 5854fcd4f610936b3e66a14d125c95cc
- SHA1 e8fc9f533da20397c4f67b236e694d84c69b9d6d
- SHA512 6c7afaadda14cbd2a9484a2774592a437902dd140b29298b8bdc0f680efd0add2d6127b8d0738e5cfd1974007a6232ff50a899eb39804750f9e5201e4e1c2e80
- SSDEEP 12288:wSvO2x9mONvKRILSFnOkx2LIaxya5FAQjU/LikGU5rCOTeidT:rvO2xJKRI2FOkx2LFEvcU6UQOJdT
- TLSH T1BE156B31E681C036D5B34571C6FA4BBBA9647D21531165CBA3C47A2A2FB37D2BA3130E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4692 4223efd - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 3 114.114.114.114 3212 fd4b256b0991b267a528f7a85ed2facd2db8ddb1c683521bccdadfef2699cf48.exe Destination IP 5 223.5.5.5 3212 fd4b256b0991b267a528f7a85ed2facd2db8ddb1c683521bccdadfef2699cf48.exe Destination IP 11 114.114.114.114 3212 fd4b256b0991b267a528f7a85ed2facd2db8ddb1c683521bccdadfef2699cf48.exe Destination IP 12 223.5.5.5 3212 fd4b256b0991b267a528f7a85ed2facd2db8ddb1c683521bccdadfef2699cf48.exe - Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\4223efd fd4b256b0991b267a528f7a85ed2facd2db8ddb1c683521bccdadfef2699cf48.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 4223efd File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 4223efd File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 4223efd File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 4223efd - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\505428 4223efd File opened for modification C:\Windows\36fd98 fd4b256b0991b267a528f7a85ed2facd2db8ddb1c683521bccdadfef2699cf48.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fd4b256b0991b267a528f7a85ed2facd2db8ddb1c683521bccdadfef2699cf48.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4223efd - Modifies data under HKEY_USERS 8 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 4223efd Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 4223efd Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 4223efd Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 4223efd Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 4223efd Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 4223efd Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 4223efd Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 4223efd - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 4692 4223efd 4692 4223efd 4692 4223efd 4692 4223efd 4692 4223efd 4692 4223efd 4692 4223efd 4692 4223efd 3212 fd4b256b0991b267a528f7a85ed2facd2db8ddb1c683521bccdadfef2699cf48.exe 3212 fd4b256b0991b267a528f7a85ed2facd2db8ddb1c683521bccdadfef2699cf48.exe 3212 fd4b256b0991b267a528f7a85ed2facd2db8ddb1c683521bccdadfef2699cf48.exe 3212 fd4b256b0991b267a528f7a85ed2facd2db8ddb1c683521bccdadfef2699cf48.exe 3212 fd4b256b0991b267a528f7a85ed2facd2db8ddb1c683521bccdadfef2699cf48.exe 3212 fd4b256b0991b267a528f7a85ed2facd2db8ddb1c683521bccdadfef2699cf48.exe 3212 fd4b256b0991b267a528f7a85ed2facd2db8ddb1c683521bccdadfef2699cf48.exe 3212 fd4b256b0991b267a528f7a85ed2facd2db8ddb1c683521bccdadfef2699cf48.exe 3212 fd4b256b0991b267a528f7a85ed2facd2db8ddb1c683521bccdadfef2699cf48.exe 3212 fd4b256b0991b267a528f7a85ed2facd2db8ddb1c683521bccdadfef2699cf48.exe 3212 fd4b256b0991b267a528f7a85ed2facd2db8ddb1c683521bccdadfef2699cf48.exe 3212 fd4b256b0991b267a528f7a85ed2facd2db8ddb1c683521bccdadfef2699cf48.exe 3212 fd4b256b0991b267a528f7a85ed2facd2db8ddb1c683521bccdadfef2699cf48.exe 3212 fd4b256b0991b267a528f7a85ed2facd2db8ddb1c683521bccdadfef2699cf48.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3212 fd4b256b0991b267a528f7a85ed2facd2db8ddb1c683521bccdadfef2699cf48.exe Token: SeTcbPrivilege 3212 fd4b256b0991b267a528f7a85ed2facd2db8ddb1c683521bccdadfef2699cf48.exe Token: SeDebugPrivilege 4692 4223efd Token: SeTcbPrivilege 4692 4223efd
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd4b256b0991b267a528f7a85ed2facd2db8ddb1c683521bccdadfef2699cf48.exe"C:\Users\Admin\AppData\Local\Temp\fd4b256b0991b267a528f7a85ed2facd2db8ddb1c683521bccdadfef2699cf48.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3212
-
C:\Windows\Syswow64\4223efdC:\Windows\Syswow64\4223efd1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4692
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\4223efd
- Size 871KB
- SHA256 8fc83e7069485d532564687a58acd0b1bee88d0abb088fbca5535de3d86a7595
- MD5 3ae83d23b2bda400085f52d5685cf362
- SHA1 cdcbb80f34e81bffe5b2c389c848636d4cb41491
- SHA512 f5e994e9f43c8e5a35b4e3d27b30cc76ccd8db6999ef167100ca8ce0d2702ead0a276ff8aae5f829d4558c0d2d6e6a275d79b5fa66f05a63cb3b5f9c16a17ca0
- SSDEEP 12288:xSvO2x9mONvKRILSFnOkx2LIaxya5FAQjU/LikGU5rCOTeidT:YvO2xJKRI2FOkx2LFEvcU6UQOJdT
- TLSH T1C6156B31E681C036D5B34571C6FA4BBBA9647D21531165CBA3C47A2A2FB37D2BA3130E
- MD5 SHA1 SHA512 SSDEEP TLSH