Analysis
- max time kernel
148s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/08/2026, 08:29
Behavioral task
behavioral1
Sample
934515e4130be7c039c11637b9c827e5be36f43b44380501bdb1adc5276c64b5.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 934515e4130be7c039c11637b9c827e5be36f43b44380501bdb1adc5276c64b5.exe
- Size 525KB
- Sample260805-kdnbesshph
- SHA256 934515e4130be7c039c11637b9c827e5be36f43b44380501bdb1adc5276c64b5
- MD5 9d37047533d4d618ac2f3e9576a87a84
- SHA1 87bf8b926b4bc04a25ed6c0f0b83cd7efa242de4
- SHA512 850477f095a2498a77055e4cc57784de0334457443d302f26c54dd4dbdd5e288de6e871ec31ddb818cf0271677e0ccfc918d9ec83a8da1e3313d36b5273ecbb4
- SSDEEP 6144:1cTgav1cdCTuoPbgwmOLJvKRwLSFXdFwirGcEOkCybEaQRXr9HNdvOa+y8K:1SvO2x9mONvKRwLSFtsOkx2LIa+y
- TLSH T1EAB47D2AB6A0D076C4779579C4A257BAFBB1742137204ACFA390475A1F237E2BE3530D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5908 ae777e9c - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 9 223.5.5.5 3820 934515e4130be7c039c11637b9c827e5be36f43b44380501bdb1adc5276c64b5.exe Destination IP 1 114.114.114.114 3820 934515e4130be7c039c11637b9c827e5be36f43b44380501bdb1adc5276c64b5.exe Destination IP 2 223.5.5.5 3820 934515e4130be7c039c11637b9c827e5be36f43b44380501bdb1adc5276c64b5.exe Destination IP 8 114.114.114.114 3820 934515e4130be7c039c11637b9c827e5be36f43b44380501bdb1adc5276c64b5.exe - Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\ae777e9c 934515e4130be7c039c11637b9c827e5be36f43b44380501bdb1adc5276c64b5.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 ae777e9c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE ae777e9c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies ae777e9c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 ae777e9c -
resource yara_rule behavioral2/memory/3820-0-0x0000000000020000-0x00000000000AC000-memory.dmp upx behavioral2/files/0x00070000000187d5-2.dat upx behavioral2/memory/5908-4-0x0000000000960000-0x00000000009EC000-memory.dmp upx behavioral2/memory/3820-10-0x0000000000020000-0x00000000000AC000-memory.dmp upx behavioral2/memory/5908-11-0x0000000000960000-0x00000000009EC000-memory.dmp upx behavioral2/memory/5908-20-0x0000000000960000-0x00000000009EC000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\6525a8 ae777e9c File opened for modification C:\Windows\416658 934515e4130be7c039c11637b9c827e5be36f43b44380501bdb1adc5276c64b5.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ae777e9c Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 934515e4130be7c039c11637b9c827e5be36f43b44380501bdb1adc5276c64b5.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix ae777e9c Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" ae777e9c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ae777e9c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ae777e9c Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" ae777e9c Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ae777e9c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ae777e9c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ae777e9c Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing ae777e9c - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 5908 ae777e9c 5908 ae777e9c 5908 ae777e9c 5908 ae777e9c 5908 ae777e9c 5908 ae777e9c 5908 ae777e9c 5908 ae777e9c 3820 934515e4130be7c039c11637b9c827e5be36f43b44380501bdb1adc5276c64b5.exe 3820 934515e4130be7c039c11637b9c827e5be36f43b44380501bdb1adc5276c64b5.exe 3820 934515e4130be7c039c11637b9c827e5be36f43b44380501bdb1adc5276c64b5.exe 3820 934515e4130be7c039c11637b9c827e5be36f43b44380501bdb1adc5276c64b5.exe 3820 934515e4130be7c039c11637b9c827e5be36f43b44380501bdb1adc5276c64b5.exe 3820 934515e4130be7c039c11637b9c827e5be36f43b44380501bdb1adc5276c64b5.exe 3820 934515e4130be7c039c11637b9c827e5be36f43b44380501bdb1adc5276c64b5.exe 3820 934515e4130be7c039c11637b9c827e5be36f43b44380501bdb1adc5276c64b5.exe 3820 934515e4130be7c039c11637b9c827e5be36f43b44380501bdb1adc5276c64b5.exe 3820 934515e4130be7c039c11637b9c827e5be36f43b44380501bdb1adc5276c64b5.exe 3820 934515e4130be7c039c11637b9c827e5be36f43b44380501bdb1adc5276c64b5.exe 3820 934515e4130be7c039c11637b9c827e5be36f43b44380501bdb1adc5276c64b5.exe 3820 934515e4130be7c039c11637b9c827e5be36f43b44380501bdb1adc5276c64b5.exe 3820 934515e4130be7c039c11637b9c827e5be36f43b44380501bdb1adc5276c64b5.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3820 934515e4130be7c039c11637b9c827e5be36f43b44380501bdb1adc5276c64b5.exe Token: SeTcbPrivilege 3820 934515e4130be7c039c11637b9c827e5be36f43b44380501bdb1adc5276c64b5.exe Token: SeDebugPrivilege 5908 ae777e9c Token: SeTcbPrivilege 5908 ae777e9c
Processes
-
C:\Users\Admin\AppData\Local\Temp\934515e4130be7c039c11637b9c827e5be36f43b44380501bdb1adc5276c64b5.exe"C:\Users\Admin\AppData\Local\Temp\934515e4130be7c039c11637b9c827e5be36f43b44380501bdb1adc5276c64b5.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3820
-
C:\Windows\Syswow64\ae777e9cC:\Windows\Syswow64\ae777e9c1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5908
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\ae777e9c
- Size 525KB
- SHA256 30884e31b28307c3b4f09e79cb9093c0e1ace7ce4f6aabb4e33771aa3ca1afb2
- MD5 cee3bfc8d94051c46e4865abeeb2b6b3
- SHA1 7ead3dd1df6c8f41e1d60fe35d179cfa066619b7
- SHA512 38f9e07dedd7c4c7a674eff16b00f982a9c50c772a629175c30b49eaaad8b8ffa0a355030e67ecc8cc582b2a88fbf52db997edab653d7ba0dfef4ef8993c2306
- SSDEEP 6144:PcTgav1cdCTuoPbgwmOLJvKRwLSFXdFwirGcEOkCybEaQRXr9HNdvOa+y8K:PSvO2x9mONvKRwLSFtsOkx2LIa+y
- TLSH T17FB47D2AB6A0D076C4779579C4A257BAFBB1742137204ACFA390475A1F237E2BE3530D
- MD5 SHA1 SHA512 SSDEEP TLSH