Analysis
- max time kernel
148s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/07/2026, 03:23
Behavioral task
behavioral1
Sample
ad04934b6f256db17730d68b03b68e8f1f0e2495397b551da28c19537a3c96fd.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target ad04934b6f256db17730d68b03b68e8f1f0e2495397b551da28c19537a3c96fd.exe
- Size 832KB
- Sample260727-dxth8avwct
- SHA256 ad04934b6f256db17730d68b03b68e8f1f0e2495397b551da28c19537a3c96fd
- MD5 27cbec10d0156eaf864fbadc8c295af8
- SHA1 5f795c75fdf6f7b12b200348f2682f62f3494659
- SHA512 6db5837f06826a915ae3d072c10fb62d2e7595ce18d87a8837f34d3dc9f4d5dbef441e824c026e3b8a85a315a3b3896e400ebe95bc57982340345221af546549
- SSDEEP 12288:0qXUHkUXe39sOkx2LIan5FAQjU/Lik8CQ3uEuZ9oawhtyybAsLAkQ:0jHPOSOkx2LFscUQPxuZ98Es8kQ
- TLSH T162059D21E202C13AD49701B2C6BE0BAFA5687D15432561C7E3D87D6A2FB61D2BE3171F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 724 1af2c706 - Unexpected DNS network traffic destination 6 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 61 223.5.5.5 2420 ad04934b6f256db17730d68b03b68e8f1f0e2495397b551da28c19537a3c96fd.exe Destination IP 1 114.114.114.114 2420 ad04934b6f256db17730d68b03b68e8f1f0e2495397b551da28c19537a3c96fd.exe Destination IP 2 223.5.5.5 2420 ad04934b6f256db17730d68b03b68e8f1f0e2495397b551da28c19537a3c96fd.exe Destination IP 36 114.114.114.114 724 1af2c706 Destination IP 37 223.5.5.5 2420 ad04934b6f256db17730d68b03b68e8f1f0e2495397b551da28c19537a3c96fd.exe Destination IP 60 114.114.114.114 2420 ad04934b6f256db17730d68b03b68e8f1f0e2495397b551da28c19537a3c96fd.exe - Drops file in System32 directory 15 IoCs
description ioc Process File created C:\Windows\SysWOW64\1af2c706 ad04934b6f256db17730d68b03b68e8f1f0e2495397b551da28c19537a3c96fd.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 1af2c706 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 1af2c706 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 1af2c706 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 1af2c706 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 1af2c706 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 1af2c706 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 1af2c706 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 1af2c706 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 1af2c706 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 1af2c706 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 1af2c706 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 1af2c706 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 1af2c706 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 1af2c706 -
resource yara_rule behavioral2/memory/2420-0-0x0000000000400000-0x0000000000489000-memory.dmp upx behavioral2/files/0x000a000000011390-2.dat upx behavioral2/memory/724-3-0x0000000000A90000-0x0000000000B19000-memory.dmp upx behavioral2/memory/2420-27-0x0000000000400000-0x0000000000489000-memory.dmp upx behavioral2/memory/724-29-0x0000000000A90000-0x0000000000B19000-memory.dmp upx behavioral2/memory/2420-52-0x0000000000400000-0x0000000000489000-memory.dmp upx behavioral2/memory/724-53-0x0000000000A90000-0x0000000000B19000-memory.dmp upx behavioral2/memory/2420-64-0x0000000000400000-0x0000000000489000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\c6528 1af2c706 File opened for modification C:\Windows\296e68 ad04934b6f256db17730d68b03b68e8f1f0e2495397b551da28c19537a3c96fd.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1af2c706 Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ad04934b6f256db17730d68b03b68e8f1f0e2495397b551da28c19537a3c96fd.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 1af2c706 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 1af2c706 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 1af2c706 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 1af2c706 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 1af2c706 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 1af2c706 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 1af2c706 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 1af2c706 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 1af2c706 - Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 724 1af2c706 724 1af2c706 724 1af2c706 724 1af2c706 724 1af2c706 724 1af2c706 724 1af2c706 724 1af2c706 724 1af2c706 724 1af2c706 724 1af2c706 724 1af2c706 724 1af2c706 724 1af2c706 724 1af2c706 724 1af2c706 724 1af2c706 724 1af2c706 724 1af2c706 724 1af2c706 2420 ad04934b6f256db17730d68b03b68e8f1f0e2495397b551da28c19537a3c96fd.exe 2420 ad04934b6f256db17730d68b03b68e8f1f0e2495397b551da28c19537a3c96fd.exe 2420 ad04934b6f256db17730d68b03b68e8f1f0e2495397b551da28c19537a3c96fd.exe 2420 ad04934b6f256db17730d68b03b68e8f1f0e2495397b551da28c19537a3c96fd.exe 2420 ad04934b6f256db17730d68b03b68e8f1f0e2495397b551da28c19537a3c96fd.exe 2420 ad04934b6f256db17730d68b03b68e8f1f0e2495397b551da28c19537a3c96fd.exe 2420 ad04934b6f256db17730d68b03b68e8f1f0e2495397b551da28c19537a3c96fd.exe 2420 ad04934b6f256db17730d68b03b68e8f1f0e2495397b551da28c19537a3c96fd.exe 2420 ad04934b6f256db17730d68b03b68e8f1f0e2495397b551da28c19537a3c96fd.exe 2420 ad04934b6f256db17730d68b03b68e8f1f0e2495397b551da28c19537a3c96fd.exe 2420 ad04934b6f256db17730d68b03b68e8f1f0e2495397b551da28c19537a3c96fd.exe 2420 ad04934b6f256db17730d68b03b68e8f1f0e2495397b551da28c19537a3c96fd.exe 2420 ad04934b6f256db17730d68b03b68e8f1f0e2495397b551da28c19537a3c96fd.exe 2420 ad04934b6f256db17730d68b03b68e8f1f0e2495397b551da28c19537a3c96fd.exe 2420 ad04934b6f256db17730d68b03b68e8f1f0e2495397b551da28c19537a3c96fd.exe 2420 ad04934b6f256db17730d68b03b68e8f1f0e2495397b551da28c19537a3c96fd.exe 2420 ad04934b6f256db17730d68b03b68e8f1f0e2495397b551da28c19537a3c96fd.exe 2420 ad04934b6f256db17730d68b03b68e8f1f0e2495397b551da28c19537a3c96fd.exe 2420 ad04934b6f256db17730d68b03b68e8f1f0e2495397b551da28c19537a3c96fd.exe 2420 ad04934b6f256db17730d68b03b68e8f1f0e2495397b551da28c19537a3c96fd.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2420 ad04934b6f256db17730d68b03b68e8f1f0e2495397b551da28c19537a3c96fd.exe Token: SeTcbPrivilege 2420 ad04934b6f256db17730d68b03b68e8f1f0e2495397b551da28c19537a3c96fd.exe Token: SeDebugPrivilege 724 1af2c706 Token: SeTcbPrivilege 724 1af2c706
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad04934b6f256db17730d68b03b68e8f1f0e2495397b551da28c19537a3c96fd.exe"C:\Users\Admin\AppData\Local\Temp\ad04934b6f256db17730d68b03b68e8f1f0e2495397b551da28c19537a3c96fd.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2420
-
C:\Windows\Syswow64\1af2c706C:\Windows\Syswow64\1af2c7061⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:724
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\1af2c706
- Size 832KB
- SHA256 e8ad7c2e1b634f00d7da206d65cb76dbb0f2719a90b19312070cc8680c8db36b
- MD5 76773c08588b7ef640ea0fccdd2fddbf
- SHA1 88d2c9b970882d59a2c39ccc2a9c382745efc171
- SHA512 dd646112ff15d5285afa6f37b7d92fc8fbbf10d4167d26a5549f21d565dd6e3dd5caa4ad87d0984ffc32b7f23268b016c97a4f397e31611647800d6e50ee419f
- SSDEEP 12288:OqXUHkUXe39sOkx2LIan5FAQjU/Lik8CQ3uEuZ9oawhtyybAsLAkQ:OjHPOSOkx2LFscUQPxuZ98Es8kQ
- TLSH T131059D21E202C13AD49701B2C6BE0BAFA5687D15432561C7E3D87D6A2FB61D2BE3171F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\c6528
- Size 1KB
- SHA256 8a31c4ef3d490b9dbddb4012d96620163774efdb760b262ea42255d32755c4d7
- MD5 7e4a79b055ed171217a3f228e1c6fe0a
- SHA1 691bb59b5da11f769e95b33ec298c833ead4ef61
- SHA512 4d1954fc79739d884af6e65e0641f79143f8052aceba917d91fdc057300930d4d1939410b0bbe405ff7f065547ac79d79113eeaabdd8e9a1def87cd36cd8c969
- TLSH T13D21ED3DB8EC20F149BF4AA56E47C9E8B36790370005635A02CA28D7706BBDC9C57532
- MD5 SHA1 SHA512 TLSH