Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/08/2026, 23:55
Behavioral task
behavioral1
Sample
63450fb6e2ebd040d78d00fccd3c398b53530d8a4021185a80a90e9184876a87.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
63450fb6e2ebd040d78d00fccd3c398b53530d8a4021185a80a90e9184876a87.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 63450fb6e2ebd040d78d00fccd3c398b53530d8a4021185a80a90e9184876a87.exe
- Size 560KB
- Sample260808-3yjsvazzev
- SHA256 63450fb6e2ebd040d78d00fccd3c398b53530d8a4021185a80a90e9184876a87
- MD5 1b31c7c43d9846e3b7dc1b0f14158717
- SHA1 844fe9876dab20260c12b4975c3724d98d3727d4
- SHA512 a2a0f85c954f2d5b0f770b3b5f8c3cb600b871c4c82a7c6eccd88115e3b66d2096c205eb9d62df6277bab777424447e4d88e9f14e2aa383e49d1172531627688
- SSDEEP 6144:J4ZaN1cb90oOTFmIFLq0cvnXhLCqj2EFNirGcEOkCybEaQRuy8K:JrNOb9+sIF+0cvnXhLCqEsOkxHy
- TLSH T186C48D29B6E0C076C4B79578C4A186B6FAB17832372459CFA394075A1F337E2BA3570D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3060 31694253 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 5 114.114.114.114 4916 63450fb6e2ebd040d78d00fccd3c398b53530d8a4021185a80a90e9184876a87.exe Destination IP 6 223.5.5.5 4916 63450fb6e2ebd040d78d00fccd3c398b53530d8a4021185a80a90e9184876a87.exe Destination IP 33 114.114.114.114 4916 63450fb6e2ebd040d78d00fccd3c398b53530d8a4021185a80a90e9184876a87.exe Destination IP 34 223.5.5.5 4916 63450fb6e2ebd040d78d00fccd3c398b53530d8a4021185a80a90e9184876a87.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 31694253 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 31694253 File created C:\Windows\SysWOW64\31694253 63450fb6e2ebd040d78d00fccd3c398b53530d8a4021185a80a90e9184876a87.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 31694253 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 31694253 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 31694253 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 31694253 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 31694253 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 31694253 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 31694253 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 31694253 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 31694253 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 31694253 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 31694253 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 31694253 -
resource yara_rule behavioral1/memory/4916-0-0x0000000000B50000-0x0000000000BDC000-memory.dmp upx behavioral1/files/0x000a0000000242fc-2.dat upx behavioral1/memory/3060-4-0x0000000000140000-0x00000000001CC000-memory.dmp upx behavioral1/memory/4916-25-0x0000000000B50000-0x0000000000BDC000-memory.dmp upx behavioral1/memory/3060-26-0x0000000000140000-0x00000000001CC000-memory.dmp upx behavioral1/memory/3060-31-0x0000000000140000-0x00000000001CC000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\346368 31694253 File opened for modification C:\Windows\5429e8 63450fb6e2ebd040d78d00fccd3c398b53530d8a4021185a80a90e9184876a87.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 31694253 Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 63450fb6e2ebd040d78d00fccd3c398b53530d8a4021185a80a90e9184876a87.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 31694253 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 31694253 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 31694253 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 31694253 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 31694253 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 31694253 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 31694253 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 31694253 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 31694253 - Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 3060 31694253 3060 31694253 3060 31694253 3060 31694253 3060 31694253 3060 31694253 3060 31694253 3060 31694253 3060 31694253 3060 31694253 3060 31694253 3060 31694253 3060 31694253 3060 31694253 3060 31694253 3060 31694253 3060 31694253 3060 31694253 3060 31694253 3060 31694253 4916 63450fb6e2ebd040d78d00fccd3c398b53530d8a4021185a80a90e9184876a87.exe 4916 63450fb6e2ebd040d78d00fccd3c398b53530d8a4021185a80a90e9184876a87.exe 4916 63450fb6e2ebd040d78d00fccd3c398b53530d8a4021185a80a90e9184876a87.exe 4916 63450fb6e2ebd040d78d00fccd3c398b53530d8a4021185a80a90e9184876a87.exe 4916 63450fb6e2ebd040d78d00fccd3c398b53530d8a4021185a80a90e9184876a87.exe 4916 63450fb6e2ebd040d78d00fccd3c398b53530d8a4021185a80a90e9184876a87.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4916 63450fb6e2ebd040d78d00fccd3c398b53530d8a4021185a80a90e9184876a87.exe Token: SeTcbPrivilege 4916 63450fb6e2ebd040d78d00fccd3c398b53530d8a4021185a80a90e9184876a87.exe Token: SeDebugPrivilege 3060 31694253 Token: SeTcbPrivilege 3060 31694253
Processes
-
C:\Users\Admin\AppData\Local\Temp\63450fb6e2ebd040d78d00fccd3c398b53530d8a4021185a80a90e9184876a87.exe"C:\Users\Admin\AppData\Local\Temp\63450fb6e2ebd040d78d00fccd3c398b53530d8a4021185a80a90e9184876a87.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4916
-
C:\Windows\Syswow64\31694253C:\Windows\Syswow64\316942531⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3060
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\346368
- Size 912B
- SHA256 ff2090a26a973c43919915228552c7bde23f567dc8db66b10035cd92022f16f6
- MD5 2230c424240fc326d2b8845ce0b6f0a3
- SHA1 399ed662a1f66538923d9a91e46300c7748f772a
- SHA512 4d2e2af6ac7151ae0adf24993f480a3ab759516aa57fa228fb0b43f7bfbfa692f313dd3f01281a10e7adfd6d046406a59bafc9755baa3d6ebb94680fa978af4d
- TLSH T18D11C03FB47A38941EB814308155AAAD0E09773C4E2E77246D87EE420295F1AEE4E947
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\31694253
- Size 560KB
- SHA256 353093ce7a204b4c8ced0280f8e52e14217369001b7a3fa7aa103382cb219751
- MD5 9eb39e424914e4ccf141f745cf19b295
- SHA1 7fe2b5062b1f8f6a8cfe965feeb64d8dbd970bc7
- SHA512 eda319b08541689fa7f2c857ba33309064852371b2e74ce8ea06ca9e6bc5d208fec34771368ed060a75a6804df3f51519c141de7ca2fe68e8869c26f9cebad88
- SSDEEP 6144:c4ZaN1cb90oOTFmIFLq0cvnXhLCqj2EFNirGcEOkCybEaQRuy8K:crNOb9+sIF+0cvnXhLCqEsOkxHy
- TLSH T171C48D29B6E0C076C4B79578C4A186B6FAB17832372459CFA394075A1F337E2BA3570D
- MD5 SHA1 SHA512 SSDEEP TLSH