Analysis
- max time kernel
148s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/08/2026, 22:01
Behavioral task
behavioral1
Sample
0ae4bd4d9a0f1b31d8a77b1e2fda740ed2c98d8056ac134a6cf129fcbf3f9f20.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 0ae4bd4d9a0f1b31d8a77b1e2fda740ed2c98d8056ac134a6cf129fcbf3f9f20.exe
- Size 830KB
- Sample260807-1xbpqsvanf
- SHA256 0ae4bd4d9a0f1b31d8a77b1e2fda740ed2c98d8056ac134a6cf129fcbf3f9f20
- MD5 43135ce95bc33569a1a6133e1ea7d597
- SHA1 40cfdfea310b993f248a96d93f6e18e7cac4b77f
- SHA512 932dde0e9a49d6a8651d08c89e6ce11b2f1a0631e5f55c2f80ba9c74f3b8566d41b4f5d8e4a3542507eec1d3843cc0d069b432a861f8f6e551ac902f38ec3090
- SSDEEP 12288:7SvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/Lik8CQ3K:OvO2xJKRw2kOkx2LFRvcUQPK
- TLSH T163055A31E641C03AD0A74575C6FA4BBFE964BD25131165CBA3C43A262FB36D2BA3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4128 a653c691 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 1 114.114.114.114 2872 0ae4bd4d9a0f1b31d8a77b1e2fda740ed2c98d8056ac134a6cf129fcbf3f9f20.exe Destination IP 4 223.5.5.5 2872 0ae4bd4d9a0f1b31d8a77b1e2fda740ed2c98d8056ac134a6cf129fcbf3f9f20.exe Destination IP 20 114.114.114.114 2872 0ae4bd4d9a0f1b31d8a77b1e2fda740ed2c98d8056ac134a6cf129fcbf3f9f20.exe Destination IP 21 223.5.5.5 2872 0ae4bd4d9a0f1b31d8a77b1e2fda740ed2c98d8056ac134a6cf129fcbf3f9f20.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 a653c691 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 a653c691 File created C:\Windows\SysWOW64\a653c691 0ae4bd4d9a0f1b31d8a77b1e2fda740ed2c98d8056ac134a6cf129fcbf3f9f20.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 a653c691 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE a653c691 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft a653c691 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache a653c691 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 a653c691 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content a653c691 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 a653c691 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies a653c691 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 a653c691 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData a653c691 -
resource yara_rule behavioral2/memory/2872-0-0x0000000000F60000-0x0000000000FEC000-memory.dmp upx behavioral2/memory/4128-3-0x0000000000B00000-0x0000000000B8C000-memory.dmp upx behavioral2/files/0x0007000000011394-2.dat upx behavioral2/memory/2872-16-0x0000000000F60000-0x0000000000FEC000-memory.dmp upx behavioral2/memory/4128-17-0x0000000000B00000-0x0000000000B8C000-memory.dmp upx behavioral2/memory/4128-32-0x0000000000B00000-0x0000000000B8C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\46ac40 a653c691 File opened for modification C:\Windows\312b70 0ae4bd4d9a0f1b31d8a77b1e2fda740ed2c98d8056ac134a6cf129fcbf3f9f20.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0ae4bd4d9a0f1b31d8a77b1e2fda740ed2c98d8056ac134a6cf129fcbf3f9f20.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a653c691 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" a653c691 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" a653c691 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" a653c691 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" a653c691 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing a653c691 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix a653c691 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" a653c691 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ a653c691 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" a653c691 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 4128 a653c691 4128 a653c691 4128 a653c691 4128 a653c691 4128 a653c691 4128 a653c691 4128 a653c691 4128 a653c691 2872 0ae4bd4d9a0f1b31d8a77b1e2fda740ed2c98d8056ac134a6cf129fcbf3f9f20.exe 2872 0ae4bd4d9a0f1b31d8a77b1e2fda740ed2c98d8056ac134a6cf129fcbf3f9f20.exe 2872 0ae4bd4d9a0f1b31d8a77b1e2fda740ed2c98d8056ac134a6cf129fcbf3f9f20.exe 2872 0ae4bd4d9a0f1b31d8a77b1e2fda740ed2c98d8056ac134a6cf129fcbf3f9f20.exe 2872 0ae4bd4d9a0f1b31d8a77b1e2fda740ed2c98d8056ac134a6cf129fcbf3f9f20.exe 2872 0ae4bd4d9a0f1b31d8a77b1e2fda740ed2c98d8056ac134a6cf129fcbf3f9f20.exe 2872 0ae4bd4d9a0f1b31d8a77b1e2fda740ed2c98d8056ac134a6cf129fcbf3f9f20.exe 2872 0ae4bd4d9a0f1b31d8a77b1e2fda740ed2c98d8056ac134a6cf129fcbf3f9f20.exe 2872 0ae4bd4d9a0f1b31d8a77b1e2fda740ed2c98d8056ac134a6cf129fcbf3f9f20.exe 2872 0ae4bd4d9a0f1b31d8a77b1e2fda740ed2c98d8056ac134a6cf129fcbf3f9f20.exe 2872 0ae4bd4d9a0f1b31d8a77b1e2fda740ed2c98d8056ac134a6cf129fcbf3f9f20.exe 2872 0ae4bd4d9a0f1b31d8a77b1e2fda740ed2c98d8056ac134a6cf129fcbf3f9f20.exe 2872 0ae4bd4d9a0f1b31d8a77b1e2fda740ed2c98d8056ac134a6cf129fcbf3f9f20.exe 2872 0ae4bd4d9a0f1b31d8a77b1e2fda740ed2c98d8056ac134a6cf129fcbf3f9f20.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2872 0ae4bd4d9a0f1b31d8a77b1e2fda740ed2c98d8056ac134a6cf129fcbf3f9f20.exe Token: SeTcbPrivilege 2872 0ae4bd4d9a0f1b31d8a77b1e2fda740ed2c98d8056ac134a6cf129fcbf3f9f20.exe Token: SeDebugPrivilege 4128 a653c691 Token: SeTcbPrivilege 4128 a653c691
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ae4bd4d9a0f1b31d8a77b1e2fda740ed2c98d8056ac134a6cf129fcbf3f9f20.exe"C:\Users\Admin\AppData\Local\Temp\0ae4bd4d9a0f1b31d8a77b1e2fda740ed2c98d8056ac134a6cf129fcbf3f9f20.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2872
-
C:\Windows\Syswow64\a653c691C:\Windows\Syswow64\a653c6911⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4128
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\a653c691
- Size 830KB
- SHA256 e64d7dc03d9ff866a4c520e47382f0d22486484f0f2e4cd0182d70636c2177f0
- MD5 122429f6f00c9c5c8346ba40bd29c137
- SHA1 ae022639fa415aa5594021af6ce327f20503d58b
- SHA512 2328d7055933c8c27309d4f446e5e5de1e3c506e57bbd848e6ed92b16ce1b2ff8d72d9a51213992fbe8a45bedf7d3d1d57a729b64b0eefec1ab60a5978eafcd0
- SSDEEP 12288:VSvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/Lik8CQ3K:UvO2xJKRw2kOkx2LFRvcUQPK
- TLSH T195055A31E641C03AD0A74575C6FA4BBFE964BD25131165CBA3C43A262FB36D2BA3170E
- MD5 SHA1 SHA512 SSDEEP TLSH