Analysis
- max time kernel
148s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 02:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7086195abe0f4851ffbfb2bf202a7c1a2f21b1252ad86b1c2b3bd78fa56e16a5.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
7086195abe0f4851ffbfb2bf202a7c1a2f21b1252ad86b1c2b3bd78fa56e16a5.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 7086195abe0f4851ffbfb2bf202a7c1a2f21b1252ad86b1c2b3bd78fa56e16a5.exe
- Size 2.0MB
- Sample260802-cl33vabp2v
- SHA256 7086195abe0f4851ffbfb2bf202a7c1a2f21b1252ad86b1c2b3bd78fa56e16a5
- MD5 ed0d796ec72e2f8d44c7995740edee3d
- SHA1 ac2ce39466e14f905427595395a06b0474822ec2
- SHA512 1bec284911e19b0f0475311652ca161020b456b44ef22d4dc397dd46ee0523489f51e5b0c2ca6cadd37bdbe4fe75763315be0f46b1ec43021b90049ccfc52160
- SSDEEP 49152:CHHKO29QG56/OJdJCXDrsOFZMjHfUTGkQy58:CnKdVkOhCXHHFZMjHfUKkVi
- TLSH T155A57D31A6C18036E1B3867586FA56FAA5247C216311A5CF63C47A2A1F737D3EE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1068 a5f1f878 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 1 114.114.114.114 4980 7086195abe0f4851ffbfb2bf202a7c1a2f21b1252ad86b1c2b3bd78fa56e16a5.exe Destination IP 2 223.5.5.5 4980 7086195abe0f4851ffbfb2bf202a7c1a2f21b1252ad86b1c2b3bd78fa56e16a5.exe Destination IP 9 114.114.114.114 4980 7086195abe0f4851ffbfb2bf202a7c1a2f21b1252ad86b1c2b3bd78fa56e16a5.exe Destination IP 10 223.5.5.5 4980 7086195abe0f4851ffbfb2bf202a7c1a2f21b1252ad86b1c2b3bd78fa56e16a5.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 a5f1f878 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 a5f1f878 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 a5f1f878 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft a5f1f878 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData a5f1f878 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE a5f1f878 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies a5f1f878 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache a5f1f878 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 a5f1f878 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content a5f1f878 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 a5f1f878 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 a5f1f878 File created C:\Windows\SysWOW64\a5f1f878 7086195abe0f4851ffbfb2bf202a7c1a2f21b1252ad86b1c2b3bd78fa56e16a5.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 a5f1f878 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 a5f1f878 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\1248d8 a5f1f878 File opened for modification C:\Windows\554268 7086195abe0f4851ffbfb2bf202a7c1a2f21b1252ad86b1c2b3bd78fa56e16a5.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7086195abe0f4851ffbfb2bf202a7c1a2f21b1252ad86b1c2b3bd78fa56e16a5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a5f1f878 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix a5f1f878 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" a5f1f878 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" a5f1f878 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" a5f1f878 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" a5f1f878 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ a5f1f878 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" a5f1f878 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" a5f1f878 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing a5f1f878 - Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 1068 a5f1f878 1068 a5f1f878 1068 a5f1f878 1068 a5f1f878 1068 a5f1f878 1068 a5f1f878 1068 a5f1f878 1068 a5f1f878 1068 a5f1f878 1068 a5f1f878 1068 a5f1f878 1068 a5f1f878 1068 a5f1f878 1068 a5f1f878 1068 a5f1f878 1068 a5f1f878 1068 a5f1f878 1068 a5f1f878 1068 a5f1f878 1068 a5f1f878 4980 7086195abe0f4851ffbfb2bf202a7c1a2f21b1252ad86b1c2b3bd78fa56e16a5.exe 4980 7086195abe0f4851ffbfb2bf202a7c1a2f21b1252ad86b1c2b3bd78fa56e16a5.exe 4980 7086195abe0f4851ffbfb2bf202a7c1a2f21b1252ad86b1c2b3bd78fa56e16a5.exe 4980 7086195abe0f4851ffbfb2bf202a7c1a2f21b1252ad86b1c2b3bd78fa56e16a5.exe 4980 7086195abe0f4851ffbfb2bf202a7c1a2f21b1252ad86b1c2b3bd78fa56e16a5.exe 4980 7086195abe0f4851ffbfb2bf202a7c1a2f21b1252ad86b1c2b3bd78fa56e16a5.exe 4980 7086195abe0f4851ffbfb2bf202a7c1a2f21b1252ad86b1c2b3bd78fa56e16a5.exe 4980 7086195abe0f4851ffbfb2bf202a7c1a2f21b1252ad86b1c2b3bd78fa56e16a5.exe 4980 7086195abe0f4851ffbfb2bf202a7c1a2f21b1252ad86b1c2b3bd78fa56e16a5.exe 4980 7086195abe0f4851ffbfb2bf202a7c1a2f21b1252ad86b1c2b3bd78fa56e16a5.exe 4980 7086195abe0f4851ffbfb2bf202a7c1a2f21b1252ad86b1c2b3bd78fa56e16a5.exe 4980 7086195abe0f4851ffbfb2bf202a7c1a2f21b1252ad86b1c2b3bd78fa56e16a5.exe 4980 7086195abe0f4851ffbfb2bf202a7c1a2f21b1252ad86b1c2b3bd78fa56e16a5.exe 4980 7086195abe0f4851ffbfb2bf202a7c1a2f21b1252ad86b1c2b3bd78fa56e16a5.exe 4980 7086195abe0f4851ffbfb2bf202a7c1a2f21b1252ad86b1c2b3bd78fa56e16a5.exe 4980 7086195abe0f4851ffbfb2bf202a7c1a2f21b1252ad86b1c2b3bd78fa56e16a5.exe 4980 7086195abe0f4851ffbfb2bf202a7c1a2f21b1252ad86b1c2b3bd78fa56e16a5.exe 4980 7086195abe0f4851ffbfb2bf202a7c1a2f21b1252ad86b1c2b3bd78fa56e16a5.exe 4980 7086195abe0f4851ffbfb2bf202a7c1a2f21b1252ad86b1c2b3bd78fa56e16a5.exe 4980 7086195abe0f4851ffbfb2bf202a7c1a2f21b1252ad86b1c2b3bd78fa56e16a5.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4980 7086195abe0f4851ffbfb2bf202a7c1a2f21b1252ad86b1c2b3bd78fa56e16a5.exe Token: SeTcbPrivilege 4980 7086195abe0f4851ffbfb2bf202a7c1a2f21b1252ad86b1c2b3bd78fa56e16a5.exe Token: SeDebugPrivilege 1068 a5f1f878 Token: SeTcbPrivilege 1068 a5f1f878
Processes
-
C:\Users\Admin\AppData\Local\Temp\7086195abe0f4851ffbfb2bf202a7c1a2f21b1252ad86b1c2b3bd78fa56e16a5.exe"C:\Users\Admin\AppData\Local\Temp\7086195abe0f4851ffbfb2bf202a7c1a2f21b1252ad86b1c2b3bd78fa56e16a5.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4980
-
C:\Windows\Syswow64\a5f1f878C:\Windows\Syswow64\a5f1f8781⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1068
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\1248d8
- Size 1KB
- SHA256 84d191a3f92705b26db2c588b43778fbb6fc31deeb96022716f1690e6e3f5c2c
- MD5 c9f9b892297878cfcec7e03e00ac9c22
- SHA1 0cf299eec66c7e72115ab6402f5eb263494b152d
- SHA512 e0b016fa6e7081c6dab674530fa137f5be0ab68e2781e9516322ae9104794349140ab468217d3466a7b8faefcb224c3693ed214119305c1f64483756af3b7238
- TLSH T1E221202EF8FC28F196FE4D958607C4C4F532A0374609204A00E73CC7605399D995363B
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\a5f1f878
- Size 2.0MB
- SHA256 65a727fefa575b04423eb40c3b0667cf2669eaa968b4717346e47f63eab9167e
- MD5 9d4f666228e74657ef31e567202e645d
- SHA1 dcc8909985eba6238c7e69ffcb429eb436dfb233
- SHA512 4964bd086b6654ec13abeccf5c3d28bc83938c892079cfc4cf041efd91db8f8c9b0909c8257fe0c9230bfceb9d31b9b4b66b960018bf70297c95579b86c37dbc
- SSDEEP 49152:sHHKO29QG56/OJdJCXDrsOFZMjHfUTGkQy58:snKdVkOhCXHHFZMjHfUKkVi
- TLSH T1D1A57D31A6C18036E1B3867586FA56FAA5247C216311A5CF63C47A2A1F737D3EE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH