Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
07/08/2026, 01:19
Behavioral task
behavioral1
Sample
d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe
- Size 1024KB
- Sample260807-bpzddsvepg
- SHA256 d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c
- MD5 dce01f82678b0e98a63750fb2d651d1d
- SHA1 59da487f512e9d79a70d99e5bd3a7e34e72101e6
- SHA512 b7f8e9393e237f0a4396e71993c7e4b407e72f214fef86fdd7a1d741f33cdf07f9893d5d3d2cf43adcbec0701669868da647f7909f2fa5906452a373e41755a6
- SSDEEP 24576:AjHPOSOkx2LFshuZ98Es8k3OH3C0rQ6+y:ATGkQyhuTtS0rQi
- TLSH T15525AF31E242C03AD5A70172C6BE0BAF95787D25472951C7A3D43D6A2FB22D2AE3570F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4264 7c46214b - Unexpected DNS network traffic destination 18 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 294 114.114.114.114 2444 d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe Destination IP 295 223.5.5.5 2444 d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe Destination IP 364 114.114.114.114 2444 d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe Destination IP 4 223.5.5.5 2444 d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe Destination IP 128 223.5.5.5 2444 d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe Destination IP 156 223.5.5.5 2444 d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe Destination IP 220 114.114.114.114 2444 d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe Destination IP 396 223.5.5.5 2444 d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe Destination IP 3 114.114.114.114 2444 d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe Destination IP 221 223.5.5.5 2444 d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe Destination IP 365 223.5.5.5 2444 d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe Destination IP 42 114.114.114.114 2444 d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe Destination IP 43 223.5.5.5 2444 d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe Destination IP 127 114.114.114.114 4264 7c46214b Destination IP 154 114.114.114.114 2444 d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe Destination IP 456 114.114.114.114 2444 d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe Destination IP 457 223.5.5.5 2444 d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe Destination IP 395 114.114.114.114 2444 d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 7c46214b File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 7c46214b File created C:\Windows\SysWOW64\7c46214b d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 7c46214b File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 7c46214b File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 7c46214b File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 7c46214b File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 7c46214b File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 7c46214b File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 7c46214b File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 7c46214b File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 7c46214b File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 7c46214b -
resource yara_rule behavioral1/memory/2444-0-0x0000000000690000-0x0000000000719000-memory.dmp upx behavioral1/files/0x0005000000016917-2.dat upx behavioral1/memory/4264-3-0x0000000000A00000-0x0000000000A89000-memory.dmp upx behavioral1/memory/2444-16-0x0000000000690000-0x0000000000719000-memory.dmp upx behavioral1/memory/4264-20-0x0000000000A00000-0x0000000000A89000-memory.dmp upx behavioral1/memory/4264-22-0x0000000000A00000-0x0000000000A89000-memory.dmp upx behavioral1/memory/4264-26-0x0000000000A00000-0x0000000000A89000-memory.dmp upx behavioral1/memory/2444-37-0x0000000000690000-0x0000000000719000-memory.dmp upx behavioral1/memory/4264-38-0x0000000000A00000-0x0000000000A89000-memory.dmp upx behavioral1/memory/2444-41-0x0000000000690000-0x0000000000719000-memory.dmp upx behavioral1/memory/4264-42-0x0000000000A00000-0x0000000000A89000-memory.dmp upx behavioral1/memory/2444-45-0x0000000000690000-0x0000000000719000-memory.dmp upx behavioral1/memory/2444-49-0x0000000000690000-0x0000000000719000-memory.dmp upx behavioral1/memory/2444-54-0x0000000000690000-0x0000000000719000-memory.dmp upx behavioral1/memory/2444-61-0x0000000000690000-0x0000000000719000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\490050 7c46214b File opened for modification C:\Windows\29d798 d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7c46214b - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 7c46214b Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 7c46214b Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 7c46214b Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 7c46214b Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 7c46214b Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 7c46214b Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 7c46214b Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 7c46214b Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 7c46214b - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 4264 7c46214b 4264 7c46214b 4264 7c46214b 4264 7c46214b 4264 7c46214b 4264 7c46214b 4264 7c46214b 4264 7c46214b 2444 d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe 2444 d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe 2444 d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe 2444 d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe 2444 d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe 2444 d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2444 d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe Token: SeTcbPrivilege 2444 d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe Token: SeDebugPrivilege 4264 7c46214b Token: SeTcbPrivilege 4264 7c46214b
Processes
-
C:\Users\Admin\AppData\Local\Temp\d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe"C:\Users\Admin\AppData\Local\Temp\d0a9ce2e3c172bb7e96c1331823c90e86f7970760c8d8c213c039c628aabf85c.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2444
-
C:\Windows\Syswow64\7c46214bC:\Windows\Syswow64\7c46214b1⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4264
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\7c46214b
- Size 1024KB
- SHA256 a483b04d8638dcca5a285aee841ef13579b0507b7fe9f56a57d9fa23490327ac
- MD5 8d11face1defc63eeb1ef1f9886cd1bd
- SHA1 6378cc08e0a96c35a6769994b8efc26ce8b6c66c
- SHA512 8edd4d2b2d8c66034d7c75c80a801c53a2de3f9a80e28d5b0bf79ddc166adc0505c2b5cc574ec6ccaa9410b7abb6fb1dae3fbf418c3e3bbad806f75c98f00649
- SSDEEP 24576:vjHPOSOkx2LFshuZ98Es8k3OH3C0rQ6+y:vTGkQyhuTtS0rQi
- TLSH T1C325AF31E242C03AD5A70172C6BE0BAF95787D25472951C7A3D43D6A2FB22D2AE3570F
- MD5 SHA1 SHA512 SSDEEP TLSH