Analysis
- max time kernel
148s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/07/2026, 10:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1ce18b9ce507f2e5cb3156f14e10ed72f96ffd3f510afc6dfd96e0fa6e6436c9.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
1ce18b9ce507f2e5cb3156f14e10ed72f96ffd3f510afc6dfd96e0fa6e6436c9.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 1ce18b9ce507f2e5cb3156f14e10ed72f96ffd3f510afc6dfd96e0fa6e6436c9.exe
- Size 395KB
- Sample260729-l85dvsttex
- SHA256 1ce18b9ce507f2e5cb3156f14e10ed72f96ffd3f510afc6dfd96e0fa6e6436c9
- MD5 d00402a21768d91d4c8dea73ea5256eb
- SHA1 33720076402e7ab819b903e76831f7fc4e02715a
- SHA512 ac6ec68517a4e3979d5b2a0cb1477bc74822714abe58d238254196e7f960f6b9553225c67af1774291dd6f0bf7afa3a74565905407aa78e9fbcb24aa6fae3428
- SSDEEP 6144:GcbcTgav1cdCTuoPbgwmOLJvKRILSFvdFDcEOkCybEaQRXr9HNdvOa:GCSvO2x9mONvKRILSFnOkx2LIa
- TLSH T1DC846D2AB6A0D076C4B79579C4A247BAFBB1742137204ACFA390475A1F637E2BD3530D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5832 11b12ab7 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 1 114.114.114.114 2808 1ce18b9ce507f2e5cb3156f14e10ed72f96ffd3f510afc6dfd96e0fa6e6436c9.exe Destination IP 4 223.5.5.5 2808 1ce18b9ce507f2e5cb3156f14e10ed72f96ffd3f510afc6dfd96e0fa6e6436c9.exe Destination IP 15 114.114.114.114 2808 1ce18b9ce507f2e5cb3156f14e10ed72f96ffd3f510afc6dfd96e0fa6e6436c9.exe Destination IP 16 223.5.5.5 2808 1ce18b9ce507f2e5cb3156f14e10ed72f96ffd3f510afc6dfd96e0fa6e6436c9.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 11b12ab7 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 11b12ab7 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 11b12ab7 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 11b12ab7 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 11b12ab7 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 11b12ab7 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 11b12ab7 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 11b12ab7 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 11b12ab7 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 11b12ab7 File created C:\Windows\SysWOW64\11b12ab7 1ce18b9ce507f2e5cb3156f14e10ed72f96ffd3f510afc6dfd96e0fa6e6436c9.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 11b12ab7 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 11b12ab7 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\63d890 11b12ab7 File opened for modification C:\Windows\3012f0 1ce18b9ce507f2e5cb3156f14e10ed72f96ffd3f510afc6dfd96e0fa6e6436c9.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ce18b9ce507f2e5cb3156f14e10ed72f96ffd3f510afc6dfd96e0fa6e6436c9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11b12ab7 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 11b12ab7 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 11b12ab7 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 11b12ab7 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 11b12ab7 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 11b12ab7 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 11b12ab7 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 11b12ab7 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 11b12ab7 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 11b12ab7 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 5832 11b12ab7 5832 11b12ab7 5832 11b12ab7 5832 11b12ab7 5832 11b12ab7 5832 11b12ab7 5832 11b12ab7 5832 11b12ab7 2808 1ce18b9ce507f2e5cb3156f14e10ed72f96ffd3f510afc6dfd96e0fa6e6436c9.exe 2808 1ce18b9ce507f2e5cb3156f14e10ed72f96ffd3f510afc6dfd96e0fa6e6436c9.exe 2808 1ce18b9ce507f2e5cb3156f14e10ed72f96ffd3f510afc6dfd96e0fa6e6436c9.exe 2808 1ce18b9ce507f2e5cb3156f14e10ed72f96ffd3f510afc6dfd96e0fa6e6436c9.exe 2808 1ce18b9ce507f2e5cb3156f14e10ed72f96ffd3f510afc6dfd96e0fa6e6436c9.exe 2808 1ce18b9ce507f2e5cb3156f14e10ed72f96ffd3f510afc6dfd96e0fa6e6436c9.exe 2808 1ce18b9ce507f2e5cb3156f14e10ed72f96ffd3f510afc6dfd96e0fa6e6436c9.exe 2808 1ce18b9ce507f2e5cb3156f14e10ed72f96ffd3f510afc6dfd96e0fa6e6436c9.exe 2808 1ce18b9ce507f2e5cb3156f14e10ed72f96ffd3f510afc6dfd96e0fa6e6436c9.exe 2808 1ce18b9ce507f2e5cb3156f14e10ed72f96ffd3f510afc6dfd96e0fa6e6436c9.exe 2808 1ce18b9ce507f2e5cb3156f14e10ed72f96ffd3f510afc6dfd96e0fa6e6436c9.exe 2808 1ce18b9ce507f2e5cb3156f14e10ed72f96ffd3f510afc6dfd96e0fa6e6436c9.exe 2808 1ce18b9ce507f2e5cb3156f14e10ed72f96ffd3f510afc6dfd96e0fa6e6436c9.exe 2808 1ce18b9ce507f2e5cb3156f14e10ed72f96ffd3f510afc6dfd96e0fa6e6436c9.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2808 1ce18b9ce507f2e5cb3156f14e10ed72f96ffd3f510afc6dfd96e0fa6e6436c9.exe Token: SeTcbPrivilege 2808 1ce18b9ce507f2e5cb3156f14e10ed72f96ffd3f510afc6dfd96e0fa6e6436c9.exe Token: SeDebugPrivilege 5832 11b12ab7 Token: SeTcbPrivilege 5832 11b12ab7
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ce18b9ce507f2e5cb3156f14e10ed72f96ffd3f510afc6dfd96e0fa6e6436c9.exe"C:\Users\Admin\AppData\Local\Temp\1ce18b9ce507f2e5cb3156f14e10ed72f96ffd3f510afc6dfd96e0fa6e6436c9.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2808
-
C:\Windows\Syswow64\11b12ab7C:\Windows\Syswow64\11b12ab71⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5832
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\11b12ab7
- Size 395KB
- SHA256 cb4dc62bdfb7bb50f9ea7dc4386734ae3435e92364f329aa3ec317e37d734613
- MD5 b9e09cb2eeaff56b4a950d43cdd93caa
- SHA1 1f5994ff9e5b1ea57c4195150a6c3b74555c2115
- SHA512 75d74571a709c357fbcc6503f009cb007e973cadd4129075d22e5f3dff4ae1f1d46cf9d206863ab5f02709b575d960b948d6a0b4db386c064c25ad10a32d9e3b
- SSDEEP 6144:ccbcTgav1cdCTuoPbgwmOLJvKRILSFvdFDcEOkCybEaQRXr9HNdvOa:cCSvO2x9mONvKRILSFnOkx2LIa
- TLSH T19F846D2AB6A0D076C4B79579C4A247BAFBB1742137204ACFA390475A1F637E2BD3530D
- MD5 SHA1 SHA512 SSDEEP TLSH