Analysis
- max time kernel
148s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 07:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c357a720db161676947772cd0cd4e582bd6c40d88f3c6899dcc7a184a0017ae3.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
c357a720db161676947772cd0cd4e582bd6c40d88f3c6899dcc7a184a0017ae3.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target c357a720db161676947772cd0cd4e582bd6c40d88f3c6899dcc7a184a0017ae3.exe
- Size 896KB
- Sample260802-jmcevavydz
- SHA256 c357a720db161676947772cd0cd4e582bd6c40d88f3c6899dcc7a184a0017ae3
- MD5 44ad05ca80620a12330d25d9e9ce5f3d
- SHA1 97c399c1162a80a644248de78ea62d5c3ae47282
- SHA512 35965f975fc607891619d10c57b7e79698c465b640f5eba26481853c2713d2bbccc0efef1f8a799781a3c3fc6dca6975d3f43273766768cd3297255e9ce25fbe
- SSDEEP 12288:wSvO2x9mONvKRILSFnOkx2LIaxya5FAQjU/Lik8CQ3uEuYyybAsLAk1:rvO2xJKRI2FOkx2LFEvcUQPxu6Es8k1
- TLSH T10E157C31E641C03AD4A7457686BA0BBFA5787D22131565C7E3D43E662FB32D2BA3130E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4968 3df455bf - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 16 114.114.114.114 3968 c357a720db161676947772cd0cd4e582bd6c40d88f3c6899dcc7a184a0017ae3.exe Destination IP 17 223.5.5.5 3968 c357a720db161676947772cd0cd4e582bd6c40d88f3c6899dcc7a184a0017ae3.exe Destination IP 1 114.114.114.114 3968 c357a720db161676947772cd0cd4e582bd6c40d88f3c6899dcc7a184a0017ae3.exe Destination IP 2 223.5.5.5 3968 c357a720db161676947772cd0cd4e582bd6c40d88f3c6899dcc7a184a0017ae3.exe - Drops file in System32 directory 13 IoCs
description ioc Process File created C:\Windows\SysWOW64\3df455bf c357a720db161676947772cd0cd4e582bd6c40d88f3c6899dcc7a184a0017ae3.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 3df455bf File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 3df455bf File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 3df455bf File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 3df455bf File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 3df455bf File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AAD646CB44373074ADE741C38400E7E1 3df455bf File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AAD646CB44373074ADE741C38400E7E1 3df455bf File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 3df455bf File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 3df455bf File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 3df455bf File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 3df455bf File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 3df455bf - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\43ef00 c357a720db161676947772cd0cd4e582bd6c40d88f3c6899dcc7a184a0017ae3.exe File opened for modification C:\Windows\550dd0 3df455bf - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c357a720db161676947772cd0cd4e582bd6c40d88f3c6899dcc7a184a0017ae3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3df455bf - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 3df455bf Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 3df455bf Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 3df455bf Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 3df455bf Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 3df455bf Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 3df455bf Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 3df455bf Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 3df455bf Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 3df455bf - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 4968 3df455bf 4968 3df455bf 4968 3df455bf 4968 3df455bf 4968 3df455bf 4968 3df455bf 4968 3df455bf 4968 3df455bf 3968 c357a720db161676947772cd0cd4e582bd6c40d88f3c6899dcc7a184a0017ae3.exe 3968 c357a720db161676947772cd0cd4e582bd6c40d88f3c6899dcc7a184a0017ae3.exe 3968 c357a720db161676947772cd0cd4e582bd6c40d88f3c6899dcc7a184a0017ae3.exe 3968 c357a720db161676947772cd0cd4e582bd6c40d88f3c6899dcc7a184a0017ae3.exe 3968 c357a720db161676947772cd0cd4e582bd6c40d88f3c6899dcc7a184a0017ae3.exe 3968 c357a720db161676947772cd0cd4e582bd6c40d88f3c6899dcc7a184a0017ae3.exe 3968 c357a720db161676947772cd0cd4e582bd6c40d88f3c6899dcc7a184a0017ae3.exe 3968 c357a720db161676947772cd0cd4e582bd6c40d88f3c6899dcc7a184a0017ae3.exe 3968 c357a720db161676947772cd0cd4e582bd6c40d88f3c6899dcc7a184a0017ae3.exe 3968 c357a720db161676947772cd0cd4e582bd6c40d88f3c6899dcc7a184a0017ae3.exe 3968 c357a720db161676947772cd0cd4e582bd6c40d88f3c6899dcc7a184a0017ae3.exe 3968 c357a720db161676947772cd0cd4e582bd6c40d88f3c6899dcc7a184a0017ae3.exe 3968 c357a720db161676947772cd0cd4e582bd6c40d88f3c6899dcc7a184a0017ae3.exe 3968 c357a720db161676947772cd0cd4e582bd6c40d88f3c6899dcc7a184a0017ae3.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3968 c357a720db161676947772cd0cd4e582bd6c40d88f3c6899dcc7a184a0017ae3.exe Token: SeTcbPrivilege 3968 c357a720db161676947772cd0cd4e582bd6c40d88f3c6899dcc7a184a0017ae3.exe Token: SeDebugPrivilege 4968 3df455bf Token: SeTcbPrivilege 4968 3df455bf
Processes
-
C:\Users\Admin\AppData\Local\Temp\c357a720db161676947772cd0cd4e582bd6c40d88f3c6899dcc7a184a0017ae3.exe"C:\Users\Admin\AppData\Local\Temp\c357a720db161676947772cd0cd4e582bd6c40d88f3c6899dcc7a184a0017ae3.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3968
-
C:\Windows\Syswow64\3df455bfC:\Windows\Syswow64\3df455bf1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4968
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\3df455bf
- Size 896KB
- SHA256 f80b65ee4fa0e2e1c3dd87884b05661811f9681257b8a7e1ea247206e10b8df2
- MD5 66dda9c17fd66dd4ab3db0963a33b552
- SHA1 629fff3e43f59d24f7ba1427d0c5be4d0daad95f
- SHA512 c65cb88de948766595477197995ca499042e46631fdfc78778068974840c217f40443ca77e8ed92a320752f82df6922dd38b81d76b387e5604b98c99204363ab
- SSDEEP 12288:0SvO2x9mONvKRILSFnOkx2LIaxya5FAQjU/Lik8CQ3uEuYyybAsLAk1:HvO2xJKRI2FOkx2LFEvcUQPxu6Es8k1
- TLSH T152157C31E641C03AD4A7457686BA0BBFA5787D22131565C7E3D43E662FB32D2BA3130E
- MD5 SHA1 SHA512 SSDEEP TLSH