Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/08/2026, 05:07
Behavioral task
behavioral1
Sample
79f4aabd6c12ad273e2e6af342686563844b0302160f9a34a7e954470446e06c.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
79f4aabd6c12ad273e2e6af342686563844b0302160f9a34a7e954470446e06c.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 79f4aabd6c12ad273e2e6af342686563844b0302160f9a34a7e954470446e06c.exe
- Size 1.7MB
- Sample260802-fr516stsdv
- SHA256 79f4aabd6c12ad273e2e6af342686563844b0302160f9a34a7e954470446e06c
- MD5 320e07da26646042988d1f2775daa7b5
- SHA1 b60e1f488be9ad9ae8cc58569ac415b67e4216be
- SHA512 27dd00c98061f3ab7a5e0b90d1d03eb7ab7d80d6e8dd011748afe85551cf55933e1fee7cea0ea3fac3b0a051e76ab0479203e1b0524c123adfd668f5d123db12
- SSDEEP 24576:OvO2xJKRh2kOkx2LFxNcU6UQOJdBqsCPhH9Do2sOfNZMjHfUr:OHHKX2WQt56/OJdJCXDrsOFZMjHfUr
- TLSH T1F5858D31AAC04132E2B3867585FA56F6A9257C222721E5CF62C57B291E737D3ED3070E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4664 4baf4cb2 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 3 114.114.114.114 2928 79f4aabd6c12ad273e2e6af342686563844b0302160f9a34a7e954470446e06c.exe Destination IP 4 223.5.5.5 2928 79f4aabd6c12ad273e2e6af342686563844b0302160f9a34a7e954470446e06c.exe Destination IP 38 114.114.114.114 2928 79f4aabd6c12ad273e2e6af342686563844b0302160f9a34a7e954470446e06c.exe Destination IP 39 223.5.5.5 2928 79f4aabd6c12ad273e2e6af342686563844b0302160f9a34a7e954470446e06c.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 4baf4cb2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 4baf4cb2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 4baf4cb2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 4baf4cb2 File created C:\Windows\SysWOW64\4baf4cb2 79f4aabd6c12ad273e2e6af342686563844b0302160f9a34a7e954470446e06c.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 4baf4cb2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 4baf4cb2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 4baf4cb2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 4baf4cb2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 4baf4cb2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 4baf4cb2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 4baf4cb2 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 4baf4cb2 -
resource yara_rule behavioral1/memory/2928-0-0x0000000000CA0000-0x0000000000D2C000-memory.dmp upx behavioral1/files/0x000a0000000243b3-2.dat upx behavioral1/memory/4664-4-0x0000000000B90000-0x0000000000C1C000-memory.dmp upx behavioral1/memory/2928-18-0x0000000000CA0000-0x0000000000D2C000-memory.dmp upx behavioral1/memory/4664-19-0x0000000000B90000-0x0000000000C1C000-memory.dmp upx behavioral1/memory/4664-26-0x0000000000B90000-0x0000000000C1C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\4fd970 4baf4cb2 File opened for modification C:\Windows\3220e0 79f4aabd6c12ad273e2e6af342686563844b0302160f9a34a7e954470446e06c.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79f4aabd6c12ad273e2e6af342686563844b0302160f9a34a7e954470446e06c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4baf4cb2 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 4baf4cb2 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 4baf4cb2 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 4baf4cb2 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 4baf4cb2 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 4baf4cb2 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 4baf4cb2 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 4baf4cb2 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 4baf4cb2 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 4baf4cb2 - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 4664 4baf4cb2 4664 4baf4cb2 4664 4baf4cb2 4664 4baf4cb2 4664 4baf4cb2 4664 4baf4cb2 4664 4baf4cb2 4664 4baf4cb2 4664 4baf4cb2 4664 4baf4cb2 4664 4baf4cb2 4664 4baf4cb2 2928 79f4aabd6c12ad273e2e6af342686563844b0302160f9a34a7e954470446e06c.exe 2928 79f4aabd6c12ad273e2e6af342686563844b0302160f9a34a7e954470446e06c.exe 2928 79f4aabd6c12ad273e2e6af342686563844b0302160f9a34a7e954470446e06c.exe 2928 79f4aabd6c12ad273e2e6af342686563844b0302160f9a34a7e954470446e06c.exe 2928 79f4aabd6c12ad273e2e6af342686563844b0302160f9a34a7e954470446e06c.exe 2928 79f4aabd6c12ad273e2e6af342686563844b0302160f9a34a7e954470446e06c.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2928 79f4aabd6c12ad273e2e6af342686563844b0302160f9a34a7e954470446e06c.exe Token: SeTcbPrivilege 2928 79f4aabd6c12ad273e2e6af342686563844b0302160f9a34a7e954470446e06c.exe Token: SeDebugPrivilege 4664 4baf4cb2 Token: SeTcbPrivilege 4664 4baf4cb2
Processes
-
C:\Users\Admin\AppData\Local\Temp\79f4aabd6c12ad273e2e6af342686563844b0302160f9a34a7e954470446e06c.exe"C:\Users\Admin\AppData\Local\Temp\79f4aabd6c12ad273e2e6af342686563844b0302160f9a34a7e954470446e06c.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2928
-
C:\Windows\Syswow64\4baf4cb2C:\Windows\Syswow64\4baf4cb21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4664
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\4fd970
- Size 506B
- SHA256 b028ad600269e90d3e6ff3c31d06230a899ddf0581f9bb3eb82f2b2218a39a91
- MD5 37f58cd47674613e99a974be4d4ffa2e
- SHA1 018adf20af0662243f53c03b63044f21f4408fe8
- SHA512 00e187281370a27a3b1429a28787a8817ea4e36d6c924fd687b19dd146a636a3047100bb7e2f13a94e6f1802af4dd9207b6a1aabf030611596549939614f217a
- TLSH T18DF0C93FEA27A2B0189FEDA1E4D32A4F3014713DC86A6366ACC7FC0042C29846D0B809
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\4baf4cb2
- Size 1.7MB
- SHA256 a77e25db5dcf0953261a0eacddf9a2c2d5db6af5e46b27313f17dd6345e9bf63
- MD5 7b65a075d00a1f5cf829c4c2389c9691
- SHA1 6603ee66fa6eab33b25490b42ed6c16821371f38
- SHA512 452975006a1143efa23c3fc3c936b1e449518619c3c486d63078c1ba1270e3853a41be367ffe37e0abf0ec6319640002ea2ec25e9bf004439c967cce13dd6183
- SSDEEP 24576:+vO2xJKRh2kOkx2LFxNcU6UQOJdBqsCPhH9Do2sOfNZMjHfUr:+HHKX2WQt56/OJdJCXDrsOFZMjHfUr
- TLSH T1CF858D31AAC04132E2B3867585FA56F6A9257C222721E5CF62C57B291E737D3ED3070E
- MD5 SHA1 SHA512 SSDEEP TLSH