Analysis
- max time kernel
148s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/07/2026, 07:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ca05ed3091528cab0fbc177e274b87f54c3dcd252912dd0c52e248190e8f65ba.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
ca05ed3091528cab0fbc177e274b87f54c3dcd252912dd0c52e248190e8f65ba.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target ca05ed3091528cab0fbc177e274b87f54c3dcd252912dd0c52e248190e8f65ba.exe
- Size 419KB
- Sample260728-jbsmpa11az
- SHA256 ca05ed3091528cab0fbc177e274b87f54c3dcd252912dd0c52e248190e8f65ba
- MD5 bc47c4400e7427d11ce3c0431cbfe8e1
- SHA1 f4db484b5691666b43cdd399416066e45b9c8546
- SHA512 ca636dc2a19e1a8c8c31fae4bc614a73fc997f305dd052551099b62cc954d066d20e5c30a51d5a4b736ebb5b10766576571d7dc41622d4030032296d29580a58
- SSDEEP 6144:k8a+AjLd9fSZLC/umZjqDvjZFXcEOkCybEaQRXr9HNdvOa:Ja+4EZe/uwqDvDOkx2LIa
- TLSH T1C3948D19FAA08036C5A38575C4A257A7FBB1752137209ACFA3A057561F237E3BD3630E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4100 e76cb861 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 1 114.114.114.114 700 ca05ed3091528cab0fbc177e274b87f54c3dcd252912dd0c52e248190e8f65ba.exe Destination IP 4 223.5.5.5 700 ca05ed3091528cab0fbc177e274b87f54c3dcd252912dd0c52e248190e8f65ba.exe Destination IP 23 114.114.114.114 700 ca05ed3091528cab0fbc177e274b87f54c3dcd252912dd0c52e248190e8f65ba.exe Destination IP 24 223.5.5.5 700 ca05ed3091528cab0fbc177e274b87f54c3dcd252912dd0c52e248190e8f65ba.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData e76cb861 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 e76cb861 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 e76cb861 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies e76cb861 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 e76cb861 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft e76cb861 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 e76cb861 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache e76cb861 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 e76cb861 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC845F33427F1C99AF855BE8930371C e76cb861 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 e76cb861 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE e76cb861 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content e76cb861 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC845F33427F1C99AF855BE8930371C e76cb861 File created C:\Windows\SysWOW64\e76cb861 ca05ed3091528cab0fbc177e274b87f54c3dcd252912dd0c52e248190e8f65ba.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\463188 e76cb861 File opened for modification C:\Windows\bfbf8 ca05ed3091528cab0fbc177e274b87f54c3dcd252912dd0c52e248190e8f65ba.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ca05ed3091528cab0fbc177e274b87f54c3dcd252912dd0c52e248190e8f65ba.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e76cb861 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix e76cb861 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" e76cb861 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ e76cb861 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" e76cb861 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" e76cb861 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing e76cb861 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" e76cb861 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" e76cb861 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" e76cb861 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 4100 e76cb861 4100 e76cb861 4100 e76cb861 4100 e76cb861 4100 e76cb861 4100 e76cb861 4100 e76cb861 4100 e76cb861 700 ca05ed3091528cab0fbc177e274b87f54c3dcd252912dd0c52e248190e8f65ba.exe 700 ca05ed3091528cab0fbc177e274b87f54c3dcd252912dd0c52e248190e8f65ba.exe 700 ca05ed3091528cab0fbc177e274b87f54c3dcd252912dd0c52e248190e8f65ba.exe 700 ca05ed3091528cab0fbc177e274b87f54c3dcd252912dd0c52e248190e8f65ba.exe 700 ca05ed3091528cab0fbc177e274b87f54c3dcd252912dd0c52e248190e8f65ba.exe 700 ca05ed3091528cab0fbc177e274b87f54c3dcd252912dd0c52e248190e8f65ba.exe 700 ca05ed3091528cab0fbc177e274b87f54c3dcd252912dd0c52e248190e8f65ba.exe 700 ca05ed3091528cab0fbc177e274b87f54c3dcd252912dd0c52e248190e8f65ba.exe 700 ca05ed3091528cab0fbc177e274b87f54c3dcd252912dd0c52e248190e8f65ba.exe 700 ca05ed3091528cab0fbc177e274b87f54c3dcd252912dd0c52e248190e8f65ba.exe 700 ca05ed3091528cab0fbc177e274b87f54c3dcd252912dd0c52e248190e8f65ba.exe 700 ca05ed3091528cab0fbc177e274b87f54c3dcd252912dd0c52e248190e8f65ba.exe 700 ca05ed3091528cab0fbc177e274b87f54c3dcd252912dd0c52e248190e8f65ba.exe 700 ca05ed3091528cab0fbc177e274b87f54c3dcd252912dd0c52e248190e8f65ba.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 700 ca05ed3091528cab0fbc177e274b87f54c3dcd252912dd0c52e248190e8f65ba.exe Token: SeTcbPrivilege 700 ca05ed3091528cab0fbc177e274b87f54c3dcd252912dd0c52e248190e8f65ba.exe Token: SeDebugPrivilege 4100 e76cb861 Token: SeTcbPrivilege 4100 e76cb861
Processes
-
C:\Users\Admin\AppData\Local\Temp\ca05ed3091528cab0fbc177e274b87f54c3dcd252912dd0c52e248190e8f65ba.exe"C:\Users\Admin\AppData\Local\Temp\ca05ed3091528cab0fbc177e274b87f54c3dcd252912dd0c52e248190e8f65ba.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:700
-
C:\Windows\Syswow64\e76cb861C:\Windows\Syswow64\e76cb8611⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4100
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\e76cb861
- Size 419KB
- SHA256 078ec3b7b5649d5a78dffafc49cdbceb8077e48f4f47de7ca93c1766d9332c6c
- MD5 03b14355b9500cfd20a2e9e35218a8a9
- SHA1 41283b53e21afd551bcc28e3ece1436943701fd4
- SHA512 9ef17572595f35e9a5d958c2db358dab8fc6ff73e130a2d6202177254deff0033f618078c2b14bc6ea40cbfd7520775eb5ad4b602ccef4f7b7f1aa38d8f74c7e
- SSDEEP 6144:K8a+AjLd9fSZLC/umZjqDvjZFXcEOkCybEaQRXr9HNdvOa:ba+4EZe/uwqDvDOkx2LIa
- TLSH T168948D19FAA08036C5A38575C4A257A7FBB1752137209ACFA3A057561F237E3BD3630E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\bfbf8
- Size 780B
- SHA256 aeb3996869d38b2cf1f9bad7867ccce309ca6822ce9b70c38f564eb5bcb16259
- MD5 0f937709f46cdc07a336d7160ec0db8a
- SHA1 ccd5d4c023857b9bca5fa7d36079beed3cad49eb
- SHA512 90d6559107e00fd55cc36208c039518f172fcf674a0543d60d73fdfdd7ff3de8cb9975dce020f5a73dda09333cbbcefa22dc53bae0a86390f841087390fe0f16
- TLSH T123014DB4A3BAC5C1A6F3803F69228B965AFA4D80E5C264084691CCF120212F6CD3301E
- MD5 SHA1 SHA512 TLSH