Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
05/08/2026, 00:57
Behavioral task
behavioral1
Sample
117d21527ea77851af3ce38a1e5152fafc55fd009d33e9b12253d80fe51d0bbf.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 117d21527ea77851af3ce38a1e5152fafc55fd009d33e9b12253d80fe51d0bbf.exe
- Size 832KB
- Sample260805-ba2vzavdpg
- SHA256 117d21527ea77851af3ce38a1e5152fafc55fd009d33e9b12253d80fe51d0bbf
- MD5 4dcc63bd57fa97c11b88b28496cbc5b3
- SHA1 2a7c4339fd220a29d7c948313e0130817f903084
- SHA512 11aafa5244a961f3c00ff090376c55147c8db5bdaec6fcece1596ea50a683bf089093578a98dfdbf01fe7e5dcd55ec20bc1caabe8197e7eb107b32d2ba7aef64
- SSDEEP 12288:fqXUHkUXe39sOkx2LIan5FAQjU/Lik8CQ3uEuZ9oawhtyybAsLAkQ:fjHPOSOkx2LFscUQPxuZ98Es8kQ
- TLSH T171059D21E202C13AD49701B2C6BE0BAFA5687D15432561C7E3D87D6A2FB61D2BE3171F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2376 cfbb87df - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 3 114.114.114.114 3424 117d21527ea77851af3ce38a1e5152fafc55fd009d33e9b12253d80fe51d0bbf.exe Destination IP 4 223.5.5.5 3424 117d21527ea77851af3ce38a1e5152fafc55fd009d33e9b12253d80fe51d0bbf.exe Destination IP 33 114.114.114.114 3424 117d21527ea77851af3ce38a1e5152fafc55fd009d33e9b12253d80fe51d0bbf.exe Destination IP 34 223.5.5.5 3424 117d21527ea77851af3ce38a1e5152fafc55fd009d33e9b12253d80fe51d0bbf.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE cfbb87df File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 cfbb87df File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft cfbb87df File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache cfbb87df File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 cfbb87df File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content cfbb87df File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies cfbb87df File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData cfbb87df File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 cfbb87df File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AAD646CB44373074ADE741C38400E7E1 cfbb87df File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AAD646CB44373074ADE741C38400E7E1 cfbb87df File created C:\Windows\SysWOW64\cfbb87df 117d21527ea77851af3ce38a1e5152fafc55fd009d33e9b12253d80fe51d0bbf.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 cfbb87df -
resource yara_rule behavioral1/memory/3424-0-0x0000000000870000-0x00000000008F9000-memory.dmp upx behavioral1/files/0x000a0000000242fc-2.dat upx behavioral1/memory/2376-4-0x0000000000950000-0x00000000009D9000-memory.dmp upx behavioral1/memory/3424-17-0x0000000000870000-0x00000000008F9000-memory.dmp upx behavioral1/memory/2376-19-0x0000000000950000-0x00000000009D9000-memory.dmp upx behavioral1/memory/3424-34-0x0000000000870000-0x00000000008F9000-memory.dmp upx behavioral1/memory/2376-35-0x0000000000950000-0x00000000009D9000-memory.dmp upx behavioral1/memory/3424-50-0x0000000000870000-0x00000000008F9000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\28ad90 cfbb87df File opened for modification C:\Windows\3a9ec0 117d21527ea77851af3ce38a1e5152fafc55fd009d33e9b12253d80fe51d0bbf.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 117d21527ea77851af3ce38a1e5152fafc55fd009d33e9b12253d80fe51d0bbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cfbb87df - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" cfbb87df Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" cfbb87df Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing cfbb87df Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" cfbb87df Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" cfbb87df Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" cfbb87df Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix cfbb87df Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" cfbb87df Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ cfbb87df - Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 2376 cfbb87df 2376 cfbb87df 2376 cfbb87df 2376 cfbb87df 2376 cfbb87df 2376 cfbb87df 2376 cfbb87df 2376 cfbb87df 2376 cfbb87df 2376 cfbb87df 2376 cfbb87df 2376 cfbb87df 2376 cfbb87df 2376 cfbb87df 2376 cfbb87df 2376 cfbb87df 2376 cfbb87df 2376 cfbb87df 2376 cfbb87df 2376 cfbb87df 3424 117d21527ea77851af3ce38a1e5152fafc55fd009d33e9b12253d80fe51d0bbf.exe 3424 117d21527ea77851af3ce38a1e5152fafc55fd009d33e9b12253d80fe51d0bbf.exe 3424 117d21527ea77851af3ce38a1e5152fafc55fd009d33e9b12253d80fe51d0bbf.exe 3424 117d21527ea77851af3ce38a1e5152fafc55fd009d33e9b12253d80fe51d0bbf.exe 3424 117d21527ea77851af3ce38a1e5152fafc55fd009d33e9b12253d80fe51d0bbf.exe 3424 117d21527ea77851af3ce38a1e5152fafc55fd009d33e9b12253d80fe51d0bbf.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3424 117d21527ea77851af3ce38a1e5152fafc55fd009d33e9b12253d80fe51d0bbf.exe Token: SeTcbPrivilege 3424 117d21527ea77851af3ce38a1e5152fafc55fd009d33e9b12253d80fe51d0bbf.exe Token: SeDebugPrivilege 2376 cfbb87df Token: SeTcbPrivilege 2376 cfbb87df
Processes
-
C:\Users\Admin\AppData\Local\Temp\117d21527ea77851af3ce38a1e5152fafc55fd009d33e9b12253d80fe51d0bbf.exe"C:\Users\Admin\AppData\Local\Temp\117d21527ea77851af3ce38a1e5152fafc55fd009d33e9b12253d80fe51d0bbf.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3424
-
C:\Windows\Syswow64\cfbb87dfC:\Windows\Syswow64\cfbb87df1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2376
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\28ad90
- Size 1KB
- SHA256 9ab79aa1864dcfa89ffcc769c61793a539b55692d4fd95693e7f25f60ddc16b4
- MD5 ac5e549f9e147189326553a4e95b4a41
- SHA1 1c6dfd752146cdc1f59b320deb4d3cb2116c18ae
- SHA512 8742780004915ed83c95459c75385bc2dfa558a2c2c8892c82d156279cc6f808822594ad207e4ade88cd363df4dcb2b364bb38ce29868b712442b50fb680e1f6
- TLSH T10D21943DA8B828651DBA542045A37BBC0A09772D461D5228FD87FF430795F25AF46943
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\cfbb87df
- Size 832KB
- SHA256 3f27174f5026ede1a1f31ac67d1c683866f2dde6bfea0735b2ad6dd1fe372009
- MD5 853a6bbcab0cc9bc85e44a5f3ec0e4e4
- SHA1 dc5e138ccc89005646de6e66cc6206bf46700f45
- SHA512 16a152fdacaeb9f5111abde876a8a0b1345088ea730b6e0439d9fc3e7c9e1eafd243c71d47035aa4eeb8e137126c1616af0e691025dc4a9b5576b52170045cee
- SSDEEP 12288:/qXUHkUXe39sOkx2LIan5FAQjU/Lik8CQ3uEuZ9oawhtyybAsLAkQ:/jHPOSOkx2LFscUQPxuZ98Es8kQ
- TLSH T1AB059D21E202C13AD49701B2C6BE0BAFA5687D15432561C7E3D87D6A2FB61D2BE3171F
- MD5 SHA1 SHA512 SSDEEP TLSH