Analysis
- max time kernel
148s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 03:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3af6a46d2e0beffd0e7ddbcb99e8760dc2c474c1c064d8caadec983fb1bde56b.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
3af6a46d2e0beffd0e7ddbcb99e8760dc2c474c1c064d8caadec983fb1bde56b.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 3af6a46d2e0beffd0e7ddbcb99e8760dc2c474c1c064d8caadec983fb1bde56b.exe
- Size 704KB
- Sample260730-dt3bys11gz
- SHA256 3af6a46d2e0beffd0e7ddbcb99e8760dc2c474c1c064d8caadec983fb1bde56b
- MD5 2f2fe56c4163aa0362c35bf14ca08688
- SHA1 b08ead697fd2908896b37219f3271c45a0628b68
- SHA512 eaa7492127b3f0ea6d66c171a56d80c155a845d144a1f55d28cbbecf404b46af6d641020cf9d5801acd798a6a7872b8db81d75314e25f21495fd0438eaef35ef
- SSDEEP 12288:USvO2x9mONvKRILSFnOkx2LIaxy6RJ05r:nvO2xJKRI2FOkx2LFEF
- TLSH T173E46C26B7908136C477463585AB47A6EBB5BD11AB228B8F6340731D0F73793AE31B1C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3616 af35d4e - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 1 114.114.114.114 1804 3af6a46d2e0beffd0e7ddbcb99e8760dc2c474c1c064d8caadec983fb1bde56b.exe Destination IP 2 223.5.5.5 1804 3af6a46d2e0beffd0e7ddbcb99e8760dc2c474c1c064d8caadec983fb1bde56b.exe Destination IP 17 114.114.114.114 1804 3af6a46d2e0beffd0e7ddbcb99e8760dc2c474c1c064d8caadec983fb1bde56b.exe Destination IP 18 223.5.5.5 1804 3af6a46d2e0beffd0e7ddbcb99e8760dc2c474c1c064d8caadec983fb1bde56b.exe - Drops file in System32 directory 13 IoCs
description ioc Process File created C:\Windows\SysWOW64\af35d4e 3af6a46d2e0beffd0e7ddbcb99e8760dc2c474c1c064d8caadec983fb1bde56b.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE af35d4e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft af35d4e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache af35d4e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 af35d4e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 af35d4e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 af35d4e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies af35d4e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 af35d4e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData af35d4e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 af35d4e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content af35d4e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 af35d4e - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\3de840 af35d4e File opened for modification C:\Windows\1ee298 3af6a46d2e0beffd0e7ddbcb99e8760dc2c474c1c064d8caadec983fb1bde56b.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3af6a46d2e0beffd0e7ddbcb99e8760dc2c474c1c064d8caadec983fb1bde56b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language af35d4e - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" af35d4e Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" af35d4e Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" af35d4e Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ af35d4e Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" af35d4e Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" af35d4e Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" af35d4e Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing af35d4e Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix af35d4e - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 3616 af35d4e 3616 af35d4e 3616 af35d4e 3616 af35d4e 3616 af35d4e 3616 af35d4e 3616 af35d4e 3616 af35d4e 1804 3af6a46d2e0beffd0e7ddbcb99e8760dc2c474c1c064d8caadec983fb1bde56b.exe 1804 3af6a46d2e0beffd0e7ddbcb99e8760dc2c474c1c064d8caadec983fb1bde56b.exe 1804 3af6a46d2e0beffd0e7ddbcb99e8760dc2c474c1c064d8caadec983fb1bde56b.exe 1804 3af6a46d2e0beffd0e7ddbcb99e8760dc2c474c1c064d8caadec983fb1bde56b.exe 1804 3af6a46d2e0beffd0e7ddbcb99e8760dc2c474c1c064d8caadec983fb1bde56b.exe 1804 3af6a46d2e0beffd0e7ddbcb99e8760dc2c474c1c064d8caadec983fb1bde56b.exe 1804 3af6a46d2e0beffd0e7ddbcb99e8760dc2c474c1c064d8caadec983fb1bde56b.exe 1804 3af6a46d2e0beffd0e7ddbcb99e8760dc2c474c1c064d8caadec983fb1bde56b.exe 1804 3af6a46d2e0beffd0e7ddbcb99e8760dc2c474c1c064d8caadec983fb1bde56b.exe 1804 3af6a46d2e0beffd0e7ddbcb99e8760dc2c474c1c064d8caadec983fb1bde56b.exe 1804 3af6a46d2e0beffd0e7ddbcb99e8760dc2c474c1c064d8caadec983fb1bde56b.exe 1804 3af6a46d2e0beffd0e7ddbcb99e8760dc2c474c1c064d8caadec983fb1bde56b.exe 1804 3af6a46d2e0beffd0e7ddbcb99e8760dc2c474c1c064d8caadec983fb1bde56b.exe 1804 3af6a46d2e0beffd0e7ddbcb99e8760dc2c474c1c064d8caadec983fb1bde56b.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1804 3af6a46d2e0beffd0e7ddbcb99e8760dc2c474c1c064d8caadec983fb1bde56b.exe Token: SeTcbPrivilege 1804 3af6a46d2e0beffd0e7ddbcb99e8760dc2c474c1c064d8caadec983fb1bde56b.exe Token: SeDebugPrivilege 3616 af35d4e Token: SeTcbPrivilege 3616 af35d4e
Processes
-
C:\Users\Admin\AppData\Local\Temp\3af6a46d2e0beffd0e7ddbcb99e8760dc2c474c1c064d8caadec983fb1bde56b.exe"C:\Users\Admin\AppData\Local\Temp\3af6a46d2e0beffd0e7ddbcb99e8760dc2c474c1c064d8caadec983fb1bde56b.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1804
-
C:\Windows\Syswow64\af35d4eC:\Windows\Syswow64\af35d4e1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3616
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\af35d4e
- Size 704KB
- SHA256 784f3c930cd2241474c73b3907bc981dfcb1156caa2e6993e53a811452340add
- MD5 3792a798ac686f2b0f2a2b13e4d49321
- SHA1 233122c86f45f5dfba42c98083d4a7845649348e
- SHA512 723f9dec2f733f389d63d12a8612b6d7b162682ef864edbbdc538f101c76f5d37a4b226087e286f322fa484f119cfa4d9fe1ae362dae2af1fcc5f4103e67b625
- SSDEEP 12288:CSvO2x9mONvKRILSFnOkx2LIaxy6RJ05r:JvO2xJKRI2FOkx2LFEF
- TLSH T13BE46C26B7908136C477463585AB47A6EBB5BD11AB228B8F6340731D0F73793AE31B1C
- MD5 SHA1 SHA512 SSDEEP TLSH