Analysis
- max time kernel
149s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
01/08/2026, 12:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
aaabd7c754429d822c51f4b201db776880c1a9bcfda476d2e0a02bdb89c2a44f.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
aaabd7c754429d822c51f4b201db776880c1a9bcfda476d2e0a02bdb89c2a44f.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target aaabd7c754429d822c51f4b201db776880c1a9bcfda476d2e0a02bdb89c2a44f.exe
- Size 948KB
- Sample260801-pee4naac96
- SHA256 aaabd7c754429d822c51f4b201db776880c1a9bcfda476d2e0a02bdb89c2a44f
- MD5 7881fb9f8711e6f90e6d3c6ef8d655c1
- SHA1 8d943407f2e67abd134bad9a41f712f339b017cd
- SHA512 0602879011c3eb4aba3af14538bddc79fb8b2c4f5f2b84ff8ed791f99fbd48a5890c5b139b9d03d0bbf123a21a3b04e38a91a6adb53f52e5334c38115c6c5d6b
- SSDEEP 24576:ivO2xJKRI2dOkx2LFAAX1oOYSY82e5QPJJ:iHHKO2FQd1oOU82lPJ
- TLSH T129259D16F7A1C072C86742B448B6872EA671BC152B214ACBF7C07B5E4E727D1AE3634D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2360 74d1b3b9 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 3 114.114.114.114 3464 aaabd7c754429d822c51f4b201db776880c1a9bcfda476d2e0a02bdb89c2a44f.exe Destination IP 4 223.5.5.5 3464 aaabd7c754429d822c51f4b201db776880c1a9bcfda476d2e0a02bdb89c2a44f.exe Destination IP 25 114.114.114.114 3464 aaabd7c754429d822c51f4b201db776880c1a9bcfda476d2e0a02bdb89c2a44f.exe Destination IP 26 223.5.5.5 3464 aaabd7c754429d822c51f4b201db776880c1a9bcfda476d2e0a02bdb89c2a44f.exe - Drops file in System32 directory 13 IoCs
description ioc Process File created C:\Windows\SysWOW64\74d1b3b9 aaabd7c754429d822c51f4b201db776880c1a9bcfda476d2e0a02bdb89c2a44f.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 74d1b3b9 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 74d1b3b9 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 74d1b3b9 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 74d1b3b9 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 74d1b3b9 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 74d1b3b9 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 74d1b3b9 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 74d1b3b9 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 74d1b3b9 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 74d1b3b9 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 74d1b3b9 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 74d1b3b9 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\286770 74d1b3b9 File opened for modification C:\Windows\3b4e10 aaabd7c754429d822c51f4b201db776880c1a9bcfda476d2e0a02bdb89c2a44f.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 74d1b3b9 Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aaabd7c754429d822c51f4b201db776880c1a9bcfda476d2e0a02bdb89c2a44f.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 74d1b3b9 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 74d1b3b9 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 74d1b3b9 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 74d1b3b9 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 74d1b3b9 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 74d1b3b9 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 74d1b3b9 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 74d1b3b9 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 74d1b3b9 - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 2360 74d1b3b9 2360 74d1b3b9 2360 74d1b3b9 2360 74d1b3b9 2360 74d1b3b9 2360 74d1b3b9 2360 74d1b3b9 2360 74d1b3b9 2360 74d1b3b9 2360 74d1b3b9 2360 74d1b3b9 2360 74d1b3b9 3464 aaabd7c754429d822c51f4b201db776880c1a9bcfda476d2e0a02bdb89c2a44f.exe 3464 aaabd7c754429d822c51f4b201db776880c1a9bcfda476d2e0a02bdb89c2a44f.exe 3464 aaabd7c754429d822c51f4b201db776880c1a9bcfda476d2e0a02bdb89c2a44f.exe 3464 aaabd7c754429d822c51f4b201db776880c1a9bcfda476d2e0a02bdb89c2a44f.exe 3464 aaabd7c754429d822c51f4b201db776880c1a9bcfda476d2e0a02bdb89c2a44f.exe 3464 aaabd7c754429d822c51f4b201db776880c1a9bcfda476d2e0a02bdb89c2a44f.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3464 aaabd7c754429d822c51f4b201db776880c1a9bcfda476d2e0a02bdb89c2a44f.exe Token: SeTcbPrivilege 3464 aaabd7c754429d822c51f4b201db776880c1a9bcfda476d2e0a02bdb89c2a44f.exe Token: SeDebugPrivilege 2360 74d1b3b9 Token: SeTcbPrivilege 2360 74d1b3b9
Processes
-
C:\Users\Admin\AppData\Local\Temp\aaabd7c754429d822c51f4b201db776880c1a9bcfda476d2e0a02bdb89c2a44f.exe"C:\Users\Admin\AppData\Local\Temp\aaabd7c754429d822c51f4b201db776880c1a9bcfda476d2e0a02bdb89c2a44f.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3464
-
C:\Windows\Syswow64\74d1b3b9C:\Windows\Syswow64\74d1b3b91⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2360
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\74d1b3b9
- Size 948KB
- SHA256 68cb1b772ab34316bab07fd5ae5683775f9520f9a0a7ae2808cc00998478a715
- MD5 31487cee8345014aef796888fcb4496e
- SHA1 79e2a13b599fb20389517525068bc351c91086a7
- SHA512 aef7662f37ab63b15e3c99a350e186e712be61f0d3f3479e57b62cee0b9c4105391626cef81af376ec4a276e07f457b23c48cab958be48177ef9b797a7af54e0
- SSDEEP 24576:ovO2xJKRI2dOkx2LFAAX1oOYSY82e5QPJJ:oHHKO2FQd1oOU82lPJ
- TLSH T10C259D16F7A1C072C86742B448B6872EA671BC152B214ACBF7C07B5E4E727D1AE3634D
- MD5 SHA1 SHA512 SSDEEP TLSH