Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/08/2026, 01:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
76cc944a65f9ceeaf512deb932f84a19e4c2d16fddde62c54c0edbc111913ace.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
76cc944a65f9ceeaf512deb932f84a19e4c2d16fddde62c54c0edbc111913ace.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 76cc944a65f9ceeaf512deb932f84a19e4c2d16fddde62c54c0edbc111913ace.exe
- Size 511KB
- Sample260807-bllccsdd27
- SHA256 76cc944a65f9ceeaf512deb932f84a19e4c2d16fddde62c54c0edbc111913ace
- MD5 5d12f2e920d06991561e4f22f4b951a6
- SHA1 de4bfddd42fba2e76560222e433185bc6192fb55
- SHA512 830514b591f36676a119db5acb098a353148ff4d574448aeda7bf7a88fb6c8096c7dde45b10e963eb3d0f3d3a21d9c62d2bd1400b092983886e1d027061fca36
- SSDEEP 6144:IcTgav1cdCTuoPbgwmOLJvKRILSFvdFDcEOkCybEaQRXr9HNdvOax5Rv0:ISvO2x9mONvKRILSFnOkx2LIax5F0
- TLSH T113B45C26F6908036C4B34575C5F64BAAFAB4BC21631156CBA3943A6A1F737D2BD3130E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 6160 3aeea2aa - Unexpected DNS network traffic destination 18 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 96 223.5.5.5 2220 76cc944a65f9ceeaf512deb932f84a19e4c2d16fddde62c54c0edbc111913ace.exe Destination IP 104 223.5.5.5 2220 76cc944a65f9ceeaf512deb932f84a19e4c2d16fddde62c54c0edbc111913ace.exe Destination IP 322 114.114.114.114 2220 76cc944a65f9ceeaf512deb932f84a19e4c2d16fddde62c54c0edbc111913ace.exe Destination IP 95 114.114.114.114 6160 3aeea2aa Destination IP 102 114.114.114.114 2220 76cc944a65f9ceeaf512deb932f84a19e4c2d16fddde62c54c0edbc111913ace.exe Destination IP 235 114.114.114.114 2220 76cc944a65f9ceeaf512deb932f84a19e4c2d16fddde62c54c0edbc111913ace.exe Destination IP 236 223.5.5.5 2220 76cc944a65f9ceeaf512deb932f84a19e4c2d16fddde62c54c0edbc111913ace.exe Destination IP 293 223.5.5.5 2220 76cc944a65f9ceeaf512deb932f84a19e4c2d16fddde62c54c0edbc111913ace.exe Destination IP 377 223.5.5.5 2220 76cc944a65f9ceeaf512deb932f84a19e4c2d16fddde62c54c0edbc111913ace.exe Destination IP 1 114.114.114.114 2220 76cc944a65f9ceeaf512deb932f84a19e4c2d16fddde62c54c0edbc111913ace.exe Destination IP 40 114.114.114.114 2220 76cc944a65f9ceeaf512deb932f84a19e4c2d16fddde62c54c0edbc111913ace.exe Destination IP 41 223.5.5.5 2220 76cc944a65f9ceeaf512deb932f84a19e4c2d16fddde62c54c0edbc111913ace.exe Destination IP 167 223.5.5.5 2220 76cc944a65f9ceeaf512deb932f84a19e4c2d16fddde62c54c0edbc111913ace.exe Destination IP 292 114.114.114.114 2220 76cc944a65f9ceeaf512deb932f84a19e4c2d16fddde62c54c0edbc111913ace.exe Destination IP 323 223.5.5.5 2220 76cc944a65f9ceeaf512deb932f84a19e4c2d16fddde62c54c0edbc111913ace.exe Destination IP 3 223.5.5.5 2220 76cc944a65f9ceeaf512deb932f84a19e4c2d16fddde62c54c0edbc111913ace.exe Destination IP 166 114.114.114.114 2220 76cc944a65f9ceeaf512deb932f84a19e4c2d16fddde62c54c0edbc111913ace.exe Destination IP 376 114.114.114.114 2220 76cc944a65f9ceeaf512deb932f84a19e4c2d16fddde62c54c0edbc111913ace.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 3aeea2aa File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 3aeea2aa File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 3aeea2aa File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 3aeea2aa File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 3aeea2aa File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 3aeea2aa File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 3aeea2aa File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 3aeea2aa File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 3aeea2aa File created C:\Windows\SysWOW64\3aeea2aa 76cc944a65f9ceeaf512deb932f84a19e4c2d16fddde62c54c0edbc111913ace.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 3aeea2aa File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 3aeea2aa File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 3aeea2aa - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\697620 3aeea2aa File opened for modification C:\Windows\2601d8 76cc944a65f9ceeaf512deb932f84a19e4c2d16fddde62c54c0edbc111913ace.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 76cc944a65f9ceeaf512deb932f84a19e4c2d16fddde62c54c0edbc111913ace.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3aeea2aa - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 3aeea2aa Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 3aeea2aa Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 3aeea2aa Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 3aeea2aa Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 3aeea2aa Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 3aeea2aa Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 3aeea2aa Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 3aeea2aa Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 3aeea2aa - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 6160 3aeea2aa 6160 3aeea2aa 6160 3aeea2aa 6160 3aeea2aa 6160 3aeea2aa 6160 3aeea2aa 6160 3aeea2aa 6160 3aeea2aa 2220 76cc944a65f9ceeaf512deb932f84a19e4c2d16fddde62c54c0edbc111913ace.exe 2220 76cc944a65f9ceeaf512deb932f84a19e4c2d16fddde62c54c0edbc111913ace.exe 2220 76cc944a65f9ceeaf512deb932f84a19e4c2d16fddde62c54c0edbc111913ace.exe 2220 76cc944a65f9ceeaf512deb932f84a19e4c2d16fddde62c54c0edbc111913ace.exe 2220 76cc944a65f9ceeaf512deb932f84a19e4c2d16fddde62c54c0edbc111913ace.exe 2220 76cc944a65f9ceeaf512deb932f84a19e4c2d16fddde62c54c0edbc111913ace.exe 2220 76cc944a65f9ceeaf512deb932f84a19e4c2d16fddde62c54c0edbc111913ace.exe 2220 76cc944a65f9ceeaf512deb932f84a19e4c2d16fddde62c54c0edbc111913ace.exe 2220 76cc944a65f9ceeaf512deb932f84a19e4c2d16fddde62c54c0edbc111913ace.exe 2220 76cc944a65f9ceeaf512deb932f84a19e4c2d16fddde62c54c0edbc111913ace.exe 2220 76cc944a65f9ceeaf512deb932f84a19e4c2d16fddde62c54c0edbc111913ace.exe 2220 76cc944a65f9ceeaf512deb932f84a19e4c2d16fddde62c54c0edbc111913ace.exe 2220 76cc944a65f9ceeaf512deb932f84a19e4c2d16fddde62c54c0edbc111913ace.exe 2220 76cc944a65f9ceeaf512deb932f84a19e4c2d16fddde62c54c0edbc111913ace.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2220 76cc944a65f9ceeaf512deb932f84a19e4c2d16fddde62c54c0edbc111913ace.exe Token: SeTcbPrivilege 2220 76cc944a65f9ceeaf512deb932f84a19e4c2d16fddde62c54c0edbc111913ace.exe Token: SeDebugPrivilege 6160 3aeea2aa Token: SeTcbPrivilege 6160 3aeea2aa
Processes
-
C:\Users\Admin\AppData\Local\Temp\76cc944a65f9ceeaf512deb932f84a19e4c2d16fddde62c54c0edbc111913ace.exe"C:\Users\Admin\AppData\Local\Temp\76cc944a65f9ceeaf512deb932f84a19e4c2d16fddde62c54c0edbc111913ace.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2220
-
C:\Windows\Syswow64\3aeea2aaC:\Windows\Syswow64\3aeea2aa1⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6160
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\3aeea2aa
- Size 511KB
- SHA256 49fa1fd78890299edbafb5e7389fa38dd1ef19d393f24b789c4670ba57992a8f
- MD5 82cec45001eb1170e177f85317d4a453
- SHA1 0a3b0c46df424eae1353c750ba59ae46f8c51b9b
- SHA512 31a376602fa22b3be2971b0e66e82ec5ee4352d5f5992b0e83acef370e3810421b052af4a2e4bc100c76e595df56b35a21e2fc3d120c0799f981a9867d0c484c
- SSDEEP 6144:4cTgav1cdCTuoPbgwmOLJvKRILSFvdFDcEOkCybEaQRXr9HNdvOax5Rv0:4SvO2x9mONvKRILSFnOkx2LIax5F0
- TLSH T114B45C26F6908036C4B34575C5F64BAAFAB4BC21631156CBA3943A6A1F737D2BD3130E
- MD5 SHA1 SHA512 SSDEEP TLSH