Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 22:52
Behavioral task
behavioral1
Sample
2fde7209fa80749b0f5bed5868bd23bdc770a3d9bda7bba7b861f66d03032937.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 2fde7209fa80749b0f5bed5868bd23bdc770a3d9bda7bba7b861f66d03032937.exe
- Size 766KB
- Sample260808-2tcy3ael2t
- SHA256 2fde7209fa80749b0f5bed5868bd23bdc770a3d9bda7bba7b861f66d03032937
- MD5 4f8fc5e2864e16e0487ed49d3390ee8e
- SHA1 07ce95c7e70541f6fbe64a96e2f4cc2b75831f79
- SHA512 a374800a0fdf9170241063e673412977baad089308e63e9d81f03789a7059eb0f520f1fd42a937324f17a3d05c5286cc1ebdcebd908f4e3a3a6bc750e288b66b
- SSDEEP 12288:xSvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/Liw:YvO2xJKRw2kOkx2LFRvcUV
- TLSH T12DF45A31E241C03AD0A74576C6FA0BAFE564BD25531155CBA3C43A6A2FB36D2BE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2432 10bc5b79 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 4 114.114.114.114 5092 2fde7209fa80749b0f5bed5868bd23bdc770a3d9bda7bba7b861f66d03032937.exe Destination IP 6 223.5.5.5 5092 2fde7209fa80749b0f5bed5868bd23bdc770a3d9bda7bba7b861f66d03032937.exe Destination IP 15 114.114.114.114 5092 2fde7209fa80749b0f5bed5868bd23bdc770a3d9bda7bba7b861f66d03032937.exe Destination IP 16 223.5.5.5 5092 2fde7209fa80749b0f5bed5868bd23bdc770a3d9bda7bba7b861f66d03032937.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 10bc5b79 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 10bc5b79 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 10bc5b79 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 10bc5b79 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 10bc5b79 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 10bc5b79 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 10bc5b79 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 10bc5b79 File created C:\Windows\SysWOW64\10bc5b79 2fde7209fa80749b0f5bed5868bd23bdc770a3d9bda7bba7b861f66d03032937.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 10bc5b79 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 10bc5b79 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 10bc5b79 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 10bc5b79 -
resource yara_rule behavioral2/memory/5092-0-0x0000000000090000-0x000000000011C000-memory.dmp upx behavioral2/files/0x000d00000001c5aa-2.dat upx behavioral2/memory/2432-3-0x00000000006E0000-0x000000000076C000-memory.dmp upx behavioral2/memory/5092-16-0x0000000000090000-0x000000000011C000-memory.dmp upx behavioral2/memory/2432-17-0x00000000006E0000-0x000000000076C000-memory.dmp upx behavioral2/memory/2432-26-0x00000000006E0000-0x000000000076C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\29a300 10bc5b79 File opened for modification C:\Windows\572d48 2fde7209fa80749b0f5bed5868bd23bdc770a3d9bda7bba7b861f66d03032937.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10bc5b79 Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2fde7209fa80749b0f5bed5868bd23bdc770a3d9bda7bba7b861f66d03032937.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 10bc5b79 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 10bc5b79 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 10bc5b79 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 10bc5b79 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 10bc5b79 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 10bc5b79 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 10bc5b79 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 10bc5b79 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 10bc5b79 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 2432 10bc5b79 2432 10bc5b79 2432 10bc5b79 2432 10bc5b79 2432 10bc5b79 2432 10bc5b79 2432 10bc5b79 2432 10bc5b79 5092 2fde7209fa80749b0f5bed5868bd23bdc770a3d9bda7bba7b861f66d03032937.exe 5092 2fde7209fa80749b0f5bed5868bd23bdc770a3d9bda7bba7b861f66d03032937.exe 5092 2fde7209fa80749b0f5bed5868bd23bdc770a3d9bda7bba7b861f66d03032937.exe 5092 2fde7209fa80749b0f5bed5868bd23bdc770a3d9bda7bba7b861f66d03032937.exe 5092 2fde7209fa80749b0f5bed5868bd23bdc770a3d9bda7bba7b861f66d03032937.exe 5092 2fde7209fa80749b0f5bed5868bd23bdc770a3d9bda7bba7b861f66d03032937.exe 5092 2fde7209fa80749b0f5bed5868bd23bdc770a3d9bda7bba7b861f66d03032937.exe 5092 2fde7209fa80749b0f5bed5868bd23bdc770a3d9bda7bba7b861f66d03032937.exe 5092 2fde7209fa80749b0f5bed5868bd23bdc770a3d9bda7bba7b861f66d03032937.exe 5092 2fde7209fa80749b0f5bed5868bd23bdc770a3d9bda7bba7b861f66d03032937.exe 5092 2fde7209fa80749b0f5bed5868bd23bdc770a3d9bda7bba7b861f66d03032937.exe 5092 2fde7209fa80749b0f5bed5868bd23bdc770a3d9bda7bba7b861f66d03032937.exe 5092 2fde7209fa80749b0f5bed5868bd23bdc770a3d9bda7bba7b861f66d03032937.exe 5092 2fde7209fa80749b0f5bed5868bd23bdc770a3d9bda7bba7b861f66d03032937.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 5092 2fde7209fa80749b0f5bed5868bd23bdc770a3d9bda7bba7b861f66d03032937.exe Token: SeTcbPrivilege 5092 2fde7209fa80749b0f5bed5868bd23bdc770a3d9bda7bba7b861f66d03032937.exe Token: SeDebugPrivilege 2432 10bc5b79 Token: SeTcbPrivilege 2432 10bc5b79
Processes
-
C:\Users\Admin\AppData\Local\Temp\2fde7209fa80749b0f5bed5868bd23bdc770a3d9bda7bba7b861f66d03032937.exe"C:\Users\Admin\AppData\Local\Temp\2fde7209fa80749b0f5bed5868bd23bdc770a3d9bda7bba7b861f66d03032937.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5092
-
C:\Windows\Syswow64\10bc5b79C:\Windows\Syswow64\10bc5b791⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2432
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\10bc5b79
- Size 766KB
- SHA256 a017e17fdf7d2a8f0f188d28ff0227b163c6d41261172d6a8ef62b96521e6556
- MD5 af0233236bededaf2ffe3dd8f9c178d7
- SHA1 a1f4549db30c64affbae20ffe589a9f5d5f03033
- SHA512 8d0463ba12cf1c5064462810f31decdbef487f5c46afa0429561747a02e3409dbe2a4e64862863defbd9bdfe96f2739710d8827dbf2dfc845d8fb40535373672
- SSDEEP 12288:7SvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/Liw:OvO2xJKRw2kOkx2LFRvcUV
- TLSH T160F45A31E241C03AD0A74576C6FA0BAFE564BD25531155CBA3C43A6A2FB36D2BE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH