Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
05/08/2026, 07:57
Behavioral task
behavioral1
Sample
8c2c21c57409a19db5080383d86b524560b53d68d1daaec69638fb46b3901012.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
8c2c21c57409a19db5080383d86b524560b53d68d1daaec69638fb46b3901012.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 8c2c21c57409a19db5080383d86b524560b53d68d1daaec69638fb46b3901012.exe
- Size 640KB
- Sample260805-js8p8ssdkc
- SHA256 8c2c21c57409a19db5080383d86b524560b53d68d1daaec69638fb46b3901012
- MD5 e20bda406c86c2c817f75afd1af31dd5
- SHA1 42d5dd1a6f7848d7ae34d7c04f1989e12cec79f9
- SHA512 b995c363d709f9572379c3797de5a65649e410fbba766f7ad5415104977737077db711ed73b8713952a0d5ae47d2d843d291528080d7419b3f5d5201ee5a2704
- SSDEEP 6144:XcTgav1cdCTuoPbgwmOLJvKRwLSFXdFwirGcEOkCybEaQRuy8KU5Rc:XSvO2x9mONvKRwLSFtsOkxHya5+
- TLSH T13CD45B35A6808036C0B74631C6F64BAAF9B5BC25631195CFA384376A1F737D2BA3570E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1400 b1f244c8 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 3 114.114.114.114 1852 8c2c21c57409a19db5080383d86b524560b53d68d1daaec69638fb46b3901012.exe Destination IP 4 223.5.5.5 1852 8c2c21c57409a19db5080383d86b524560b53d68d1daaec69638fb46b3901012.exe Destination IP 36 114.114.114.114 1852 8c2c21c57409a19db5080383d86b524560b53d68d1daaec69638fb46b3901012.exe Destination IP 37 223.5.5.5 1852 8c2c21c57409a19db5080383d86b524560b53d68d1daaec69638fb46b3901012.exe - Drops file in System32 directory 11 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 b1f244c8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData b1f244c8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 b1f244c8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 b1f244c8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 b1f244c8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies b1f244c8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft b1f244c8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache b1f244c8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content b1f244c8 File created C:\Windows\SysWOW64\b1f244c8 8c2c21c57409a19db5080383d86b524560b53d68d1daaec69638fb46b3901012.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE b1f244c8 -
resource yara_rule behavioral1/memory/1852-0-0x00000000007A0000-0x000000000082C000-memory.dmp upx behavioral1/files/0x000b000000024273-2.dat upx behavioral1/memory/1400-4-0x00000000001C0000-0x000000000024C000-memory.dmp upx behavioral1/memory/1852-12-0x00000000007A0000-0x000000000082C000-memory.dmp upx behavioral1/memory/1400-13-0x00000000001C0000-0x000000000024C000-memory.dmp upx behavioral1/memory/1400-24-0x00000000001C0000-0x000000000024C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\17f7f0 b1f244c8 File opened for modification C:\Windows\1fb4f8 8c2c21c57409a19db5080383d86b524560b53d68d1daaec69638fb46b3901012.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c2c21c57409a19db5080383d86b524560b53d68d1daaec69638fb46b3901012.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b1f244c8 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix b1f244c8 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ b1f244c8 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" b1f244c8 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" b1f244c8 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" b1f244c8 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" b1f244c8 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" b1f244c8 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" b1f244c8 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing b1f244c8 - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 1400 b1f244c8 1400 b1f244c8 1400 b1f244c8 1400 b1f244c8 1400 b1f244c8 1400 b1f244c8 1400 b1f244c8 1400 b1f244c8 1400 b1f244c8 1400 b1f244c8 1400 b1f244c8 1400 b1f244c8 1852 8c2c21c57409a19db5080383d86b524560b53d68d1daaec69638fb46b3901012.exe 1852 8c2c21c57409a19db5080383d86b524560b53d68d1daaec69638fb46b3901012.exe 1852 8c2c21c57409a19db5080383d86b524560b53d68d1daaec69638fb46b3901012.exe 1852 8c2c21c57409a19db5080383d86b524560b53d68d1daaec69638fb46b3901012.exe 1852 8c2c21c57409a19db5080383d86b524560b53d68d1daaec69638fb46b3901012.exe 1852 8c2c21c57409a19db5080383d86b524560b53d68d1daaec69638fb46b3901012.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1852 8c2c21c57409a19db5080383d86b524560b53d68d1daaec69638fb46b3901012.exe Token: SeTcbPrivilege 1852 8c2c21c57409a19db5080383d86b524560b53d68d1daaec69638fb46b3901012.exe Token: SeDebugPrivilege 1400 b1f244c8 Token: SeTcbPrivilege 1400 b1f244c8
Processes
-
C:\Users\Admin\AppData\Local\Temp\8c2c21c57409a19db5080383d86b524560b53d68d1daaec69638fb46b3901012.exe"C:\Users\Admin\AppData\Local\Temp\8c2c21c57409a19db5080383d86b524560b53d68d1daaec69638fb46b3901012.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1852
-
C:\Windows\Syswow64\b1f244c8C:\Windows\Syswow64\b1f244c81⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1400
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\17f7f0
- Size 506B
- SHA256 289b9be322f57f4cd57d9f5a84ac3f5c24b5468d122b87e0baaf95d08d0c1c72
- MD5 c290d071b03e38eb1a231daea1b2f7dd
- SHA1 fcbad1fc6da43e23ea58b5cf4c4c3365a177f6c1
- SHA512 1ef5a4914f561a5d9c5d993d15f647acbd48967bda32cc54f21b3eb07eccff11d8ac01162182a93a7916a7eba76934c6a0ab375075c05ab85f982592655993c2
- TLSH T1B5F00E73DC6C0BB11EFF963274539CC8A629D03B4003408028D438FC0C935245943CDC
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\b1f244c8
- Size 640KB
- SHA256 e9563c4a66cbee9f880236bee86e84428466fa8d491903c33504ad0d82e8281a
- MD5 97be200d2a559dbb7f587152c0b7360a
- SHA1 70f7b12a9a905230dc18a8b86c01e020dac3a8b1
- SHA512 092bbdce101deb1bee9d5a7484aade743dd1d9dc6df27b8ce8a8cadd2cfbfd188c8841c3f669eea551de0a9f75c476b6b5a4208f225a530b4fee59b87127fe79
- SSDEEP 6144:zcTgav1cdCTuoPbgwmOLJvKRwLSFXdFwirGcEOkCybEaQRuy8KU5Rc:zSvO2x9mONvKRwLSFtsOkxHya5+
- TLSH T117D45B35A6808036C0B74631C6F64BAAF9B5BC25631195CFA384376A1F737D2BA3570E
- MD5 SHA1 SHA512 SSDEEP TLSH