Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/08/2026, 20:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
15a9e85eb1b07ff7e6f689fe82fd6b3ae2e26d0270e39302bfb18449c636323e.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
15a9e85eb1b07ff7e6f689fe82fd6b3ae2e26d0270e39302bfb18449c636323e.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 15a9e85eb1b07ff7e6f689fe82fd6b3ae2e26d0270e39302bfb18449c636323e.exe
- Size 3.3MB
- Sample260807-zbjb1starc
- SHA256 15a9e85eb1b07ff7e6f689fe82fd6b3ae2e26d0270e39302bfb18449c636323e
- MD5 82a85b65aa0870ece034e860f56f6b6b
- SHA1 2562cc31c52cf76a75430e41cc30d6110dd2236a
- SHA512 662a8e19085c922cb45bdc4497d74f4799aa6528825439c250d1a50ea17233015892eef9d8dfa6cc47be0bff471158708d98f6b671efb6671f75760651db08c9
- SSDEEP 24576:VvO2xJKRI2dOkx2LFAC///wjHPOnOkx2LFhJbKkKF/eMNPjxdnQbzU:VHHKO2FQN///wTGHQd9KFeMxQbzU
- TLSH T101F54B12FB90C636D16A573048AB439A6BB5FD405B128BDF62D4B31F0F732869E31E58
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4252 eccfe8b0 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 1 114.114.114.114 5052 15a9e85eb1b07ff7e6f689fe82fd6b3ae2e26d0270e39302bfb18449c636323e.exe Destination IP 5 223.5.5.5 5052 15a9e85eb1b07ff7e6f689fe82fd6b3ae2e26d0270e39302bfb18449c636323e.exe Destination IP 16 114.114.114.114 5052 15a9e85eb1b07ff7e6f689fe82fd6b3ae2e26d0270e39302bfb18449c636323e.exe Destination IP 17 223.5.5.5 5052 15a9e85eb1b07ff7e6f689fe82fd6b3ae2e26d0270e39302bfb18449c636323e.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE eccfe8b0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies eccfe8b0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft eccfe8b0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 eccfe8b0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 eccfe8b0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 eccfe8b0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 eccfe8b0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache eccfe8b0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData eccfe8b0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 eccfe8b0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content eccfe8b0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 eccfe8b0 File created C:\Windows\SysWOW64\eccfe8b0 15a9e85eb1b07ff7e6f689fe82fd6b3ae2e26d0270e39302bfb18449c636323e.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\48cbb8 eccfe8b0 File opened for modification C:\Windows\567df8 15a9e85eb1b07ff7e6f689fe82fd6b3ae2e26d0270e39302bfb18449c636323e.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15a9e85eb1b07ff7e6f689fe82fd6b3ae2e26d0270e39302bfb18449c636323e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eccfe8b0 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" eccfe8b0 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" eccfe8b0 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing eccfe8b0 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" eccfe8b0 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ eccfe8b0 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" eccfe8b0 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" eccfe8b0 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix eccfe8b0 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" eccfe8b0 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 4252 eccfe8b0 4252 eccfe8b0 4252 eccfe8b0 4252 eccfe8b0 4252 eccfe8b0 4252 eccfe8b0 4252 eccfe8b0 4252 eccfe8b0 5052 15a9e85eb1b07ff7e6f689fe82fd6b3ae2e26d0270e39302bfb18449c636323e.exe 5052 15a9e85eb1b07ff7e6f689fe82fd6b3ae2e26d0270e39302bfb18449c636323e.exe 5052 15a9e85eb1b07ff7e6f689fe82fd6b3ae2e26d0270e39302bfb18449c636323e.exe 5052 15a9e85eb1b07ff7e6f689fe82fd6b3ae2e26d0270e39302bfb18449c636323e.exe 5052 15a9e85eb1b07ff7e6f689fe82fd6b3ae2e26d0270e39302bfb18449c636323e.exe 5052 15a9e85eb1b07ff7e6f689fe82fd6b3ae2e26d0270e39302bfb18449c636323e.exe 5052 15a9e85eb1b07ff7e6f689fe82fd6b3ae2e26d0270e39302bfb18449c636323e.exe 5052 15a9e85eb1b07ff7e6f689fe82fd6b3ae2e26d0270e39302bfb18449c636323e.exe 5052 15a9e85eb1b07ff7e6f689fe82fd6b3ae2e26d0270e39302bfb18449c636323e.exe 5052 15a9e85eb1b07ff7e6f689fe82fd6b3ae2e26d0270e39302bfb18449c636323e.exe 5052 15a9e85eb1b07ff7e6f689fe82fd6b3ae2e26d0270e39302bfb18449c636323e.exe 5052 15a9e85eb1b07ff7e6f689fe82fd6b3ae2e26d0270e39302bfb18449c636323e.exe 5052 15a9e85eb1b07ff7e6f689fe82fd6b3ae2e26d0270e39302bfb18449c636323e.exe 5052 15a9e85eb1b07ff7e6f689fe82fd6b3ae2e26d0270e39302bfb18449c636323e.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 5052 15a9e85eb1b07ff7e6f689fe82fd6b3ae2e26d0270e39302bfb18449c636323e.exe Token: SeTcbPrivilege 5052 15a9e85eb1b07ff7e6f689fe82fd6b3ae2e26d0270e39302bfb18449c636323e.exe Token: SeDebugPrivilege 4252 eccfe8b0 Token: SeTcbPrivilege 4252 eccfe8b0
Processes
-
C:\Users\Admin\AppData\Local\Temp\15a9e85eb1b07ff7e6f689fe82fd6b3ae2e26d0270e39302bfb18449c636323e.exe"C:\Users\Admin\AppData\Local\Temp\15a9e85eb1b07ff7e6f689fe82fd6b3ae2e26d0270e39302bfb18449c636323e.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5052
-
C:\Windows\Syswow64\eccfe8b0C:\Windows\Syswow64\eccfe8b01⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4252
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\eccfe8b0
- Size 3.3MB
- SHA256 3b9a1d98d8a6ee621a87cbb21d64bce59ea421cff743e8cf1f8a90fd5f8ee392
- MD5 94ebfdd0ce819d54af31a70c40bc7f65
- SHA1 382f43d1665c9c3c72ba5a30782c46a01c3b92ca
- SHA512 020705b1e20180070a995855e7b14a51ed5b1c6501c5f6876bc4b81f95a7408ec175ce1d2b6d375a25cc21b8333aa569c30ffe59921d87241e981f9fdc57bc83
- SSDEEP 24576:8vO2xJKRI2dOkx2LFAC///wjHPOnOkx2LFhJbKkKF/eMNPjxdnQbzU:8HHKO2FQN///wTGHQd9KFeMxQbzU
- TLSH T1DDF54B12FB90C636D16A573048AB439A6BB5FD405B128BDF62D4B31F0F732869E31E58
- MD5 SHA1 SHA512 SSDEEP TLSH