Analysis
- max time kernel
150s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 01:04
Behavioral task
behavioral1
Sample
fcaa920dadfcdfb8a41ad3c571e4fe2baf4a934956ad247137607c0193182b8e.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target fcaa920dadfcdfb8a41ad3c571e4fe2baf4a934956ad247137607c0193182b8e.exe
- Size 3.0MB
- Sample260802-bfc4ssbj5v
- SHA256 fcaa920dadfcdfb8a41ad3c571e4fe2baf4a934956ad247137607c0193182b8e
- MD5 c981f73e134d21cba9b1c090a67496a0
- SHA1 cc95322d474040bb3a3b8c9c81a36555e9f9a9f3
- SHA512 95961e5a62f9e09b36a76e4c6dbdf8d6fd407b26d304217b188da031a56ffbf2cd67a9e822f2159e74b518b374d96056538e9e69d7244db920333f8ed238af8d
- SSDEEP 49152:YA/JuTQKqVmgbQIzZMPXpB91rHpn/qKmNAOaG6IOY/:f/whnLrHp/qKm2/Sb/
- TLSH T1EEE55953EB914AE8E39D0536DF544150E72AF2256BEF13A27428420DDE83387BF61A3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2976 262cc01c - Unexpected DNS network traffic destination 5 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 5 114.114.114.114 4768 fcaa920dadfcdfb8a41ad3c571e4fe2baf4a934956ad247137607c0193182b8e.exe Destination IP 6 223.5.5.5 4768 fcaa920dadfcdfb8a41ad3c571e4fe2baf4a934956ad247137607c0193182b8e.exe Destination IP 18 114.114.114.114 4768 fcaa920dadfcdfb8a41ad3c571e4fe2baf4a934956ad247137607c0193182b8e.exe Destination IP 19 223.5.5.5 4768 fcaa920dadfcdfb8a41ad3c571e4fe2baf4a934956ad247137607c0193182b8e.exe Destination IP 63 114.114.114.114 4768 fcaa920dadfcdfb8a41ad3c571e4fe2baf4a934956ad247137607c0193182b8e.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 262cc01c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC845F33427F1C99AF855BE8930371C 262cc01c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 262cc01c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 262cc01c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 262cc01c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 262cc01c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 262cc01c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 262cc01c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 262cc01c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC845F33427F1C99AF855BE8930371C 262cc01c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 262cc01c File created C:\Windows\SysWOW64\262cc01c fcaa920dadfcdfb8a41ad3c571e4fe2baf4a934956ad247137607c0193182b8e.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 262cc01c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 262cc01c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 262cc01c -
resource yara_rule behavioral2/memory/4768-0-0x0000000000DF0000-0x00000000010F5000-memory.dmp upx behavioral2/files/0x000e00000001c51f-2.dat upx behavioral2/memory/2976-3-0x00000000000D0000-0x00000000003D5000-memory.dmp upx behavioral2/memory/4768-8-0x0000000000DF0000-0x00000000010F5000-memory.dmp upx behavioral2/memory/2976-9-0x00000000000D0000-0x00000000003D5000-memory.dmp upx behavioral2/memory/2976-21-0x00000000000D0000-0x00000000003D5000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fcaa920dadfcdfb8a41ad3c571e4fe2baf4a934956ad247137607c0193182b8e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 262cc01c - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 262cc01c Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 262cc01c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 262cc01c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 262cc01c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 262cc01c Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 262cc01c Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 262cc01c Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 262cc01c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 262cc01c - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 2976 262cc01c 2976 262cc01c 2976 262cc01c 2976 262cc01c 2976 262cc01c 2976 262cc01c 2976 262cc01c 2976 262cc01c 4768 fcaa920dadfcdfb8a41ad3c571e4fe2baf4a934956ad247137607c0193182b8e.exe 4768 fcaa920dadfcdfb8a41ad3c571e4fe2baf4a934956ad247137607c0193182b8e.exe 4768 fcaa920dadfcdfb8a41ad3c571e4fe2baf4a934956ad247137607c0193182b8e.exe 4768 fcaa920dadfcdfb8a41ad3c571e4fe2baf4a934956ad247137607c0193182b8e.exe 4768 fcaa920dadfcdfb8a41ad3c571e4fe2baf4a934956ad247137607c0193182b8e.exe 4768 fcaa920dadfcdfb8a41ad3c571e4fe2baf4a934956ad247137607c0193182b8e.exe 4768 fcaa920dadfcdfb8a41ad3c571e4fe2baf4a934956ad247137607c0193182b8e.exe 4768 fcaa920dadfcdfb8a41ad3c571e4fe2baf4a934956ad247137607c0193182b8e.exe 4768 fcaa920dadfcdfb8a41ad3c571e4fe2baf4a934956ad247137607c0193182b8e.exe 4768 fcaa920dadfcdfb8a41ad3c571e4fe2baf4a934956ad247137607c0193182b8e.exe 4768 fcaa920dadfcdfb8a41ad3c571e4fe2baf4a934956ad247137607c0193182b8e.exe 4768 fcaa920dadfcdfb8a41ad3c571e4fe2baf4a934956ad247137607c0193182b8e.exe 4768 fcaa920dadfcdfb8a41ad3c571e4fe2baf4a934956ad247137607c0193182b8e.exe 4768 fcaa920dadfcdfb8a41ad3c571e4fe2baf4a934956ad247137607c0193182b8e.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4768 fcaa920dadfcdfb8a41ad3c571e4fe2baf4a934956ad247137607c0193182b8e.exe Token: SeTcbPrivilege 4768 fcaa920dadfcdfb8a41ad3c571e4fe2baf4a934956ad247137607c0193182b8e.exe Token: SeDebugPrivilege 2976 262cc01c Token: SeTcbPrivilege 2976 262cc01c
Processes
-
C:\Users\Admin\AppData\Local\Temp\fcaa920dadfcdfb8a41ad3c571e4fe2baf4a934956ad247137607c0193182b8e.exe"C:\Users\Admin\AppData\Local\Temp\fcaa920dadfcdfb8a41ad3c571e4fe2baf4a934956ad247137607c0193182b8e.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4768
-
C:\Windows\Syswow64\262cc01cC:\Windows\Syswow64\262cc01c1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2976
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\262cc01c
- Size 3.0MB
- SHA256 4a8c0ff78e3c4db35d7d7dca06e79718482ab139b6c5056790c7c4b8f31ec617
- MD5 02d182bfb632fafd036f23c290dbf0cf
- SHA1 2703a31aa06c106674ac3acfbcbb3b509d1f8b4b
- SHA512 f9ea398aed009c86dbbfa46152b572ce550d8bc061d2bffd5ceff61bd1c7507366cfe093753e7c2254b0549f506341abdd52b506d1be351bae1d7f0acfe172dc
- SSDEEP 49152:pA/JuTQKqVmgbQIzZMPXpB91rHpn/qKmNAOaG6IOY/:e/whnLrHp/qKm2/Sb/
- TLSH T11DE55953EB914AE8E39D0536DF544150E72AF2256BEF13A27428420DDE83387BF61A3D
- MD5 SHA1 SHA512 SSDEEP TLSH