Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/08/2026, 22:08
Behavioral task
behavioral1
Sample
c975ca1b19e755f3a389052116391b307f08e0e1f564a91a997f618921d9fa28.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target c975ca1b19e755f3a389052116391b307f08e0e1f564a91a997f618921d9fa28.exe
- Size 766KB
- Sample260809-12leqswfpc
- SHA256 c975ca1b19e755f3a389052116391b307f08e0e1f564a91a997f618921d9fa28
- MD5 9432dd1b4bfb9939d95f24ea74cf2c7a
- SHA1 20101b2c65aff561d26531377e4b77668007cc76
- SHA512 5e94c57e3c921b4e46fd00e0f9907416b0bbb586bd5e153821bb2f0b66b745bf5916abbab64108722b1eafe1333f1a58eae343fd948ad597e871dc5b9ebc4f0f
- SSDEEP 12288:cSvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/Liw:vvO2xJKRw2kOkx2LFRvcUV
- TLSH T123F45A31E241C03AD0A74576C6FA0BAFE564BD25531155CBA3C43A6A2FB36D2BE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4340 99f0abc8 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 3 114.114.114.114 552 c975ca1b19e755f3a389052116391b307f08e0e1f564a91a997f618921d9fa28.exe Destination IP 5 223.5.5.5 552 c975ca1b19e755f3a389052116391b307f08e0e1f564a91a997f618921d9fa28.exe Destination IP 32 114.114.114.114 552 c975ca1b19e755f3a389052116391b307f08e0e1f564a91a997f618921d9fa28.exe Destination IP 33 223.5.5.5 552 c975ca1b19e755f3a389052116391b307f08e0e1f564a91a997f618921d9fa28.exe - Drops file in System32 directory 11 IoCs
description ioc Process File created C:\Windows\SysWOW64\99f0abc8 c975ca1b19e755f3a389052116391b307f08e0e1f564a91a997f618921d9fa28.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 99f0abc8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 99f0abc8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 99f0abc8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 99f0abc8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 99f0abc8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 99f0abc8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 99f0abc8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 99f0abc8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 99f0abc8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 99f0abc8 -
resource yara_rule behavioral1/memory/552-0-0x0000000000CE0000-0x0000000000D6C000-memory.dmp upx behavioral1/files/0x00200000000243c4-2.dat upx behavioral1/memory/4340-4-0x0000000000AC0000-0x0000000000B4C000-memory.dmp upx behavioral1/memory/552-17-0x0000000000CE0000-0x0000000000D6C000-memory.dmp upx behavioral1/memory/4340-18-0x0000000000AC0000-0x0000000000B4C000-memory.dmp upx behavioral1/memory/4340-33-0x0000000000AC0000-0x0000000000B4C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\4a4d68 99f0abc8 File opened for modification C:\Windows\97350 c975ca1b19e755f3a389052116391b307f08e0e1f564a91a997f618921d9fa28.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c975ca1b19e755f3a389052116391b307f08e0e1f564a91a997f618921d9fa28.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99f0abc8 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 99f0abc8 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 99f0abc8 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 99f0abc8 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 99f0abc8 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 99f0abc8 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 99f0abc8 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 99f0abc8 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 99f0abc8 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 99f0abc8 - Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 4340 99f0abc8 4340 99f0abc8 4340 99f0abc8 4340 99f0abc8 4340 99f0abc8 4340 99f0abc8 4340 99f0abc8 4340 99f0abc8 4340 99f0abc8 4340 99f0abc8 4340 99f0abc8 4340 99f0abc8 4340 99f0abc8 4340 99f0abc8 4340 99f0abc8 4340 99f0abc8 4340 99f0abc8 4340 99f0abc8 4340 99f0abc8 4340 99f0abc8 552 c975ca1b19e755f3a389052116391b307f08e0e1f564a91a997f618921d9fa28.exe 552 c975ca1b19e755f3a389052116391b307f08e0e1f564a91a997f618921d9fa28.exe 552 c975ca1b19e755f3a389052116391b307f08e0e1f564a91a997f618921d9fa28.exe 552 c975ca1b19e755f3a389052116391b307f08e0e1f564a91a997f618921d9fa28.exe 552 c975ca1b19e755f3a389052116391b307f08e0e1f564a91a997f618921d9fa28.exe 552 c975ca1b19e755f3a389052116391b307f08e0e1f564a91a997f618921d9fa28.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 552 c975ca1b19e755f3a389052116391b307f08e0e1f564a91a997f618921d9fa28.exe Token: SeTcbPrivilege 552 c975ca1b19e755f3a389052116391b307f08e0e1f564a91a997f618921d9fa28.exe Token: SeDebugPrivilege 4340 99f0abc8 Token: SeTcbPrivilege 4340 99f0abc8
Processes
-
C:\Users\Admin\AppData\Local\Temp\c975ca1b19e755f3a389052116391b307f08e0e1f564a91a997f618921d9fa28.exe"C:\Users\Admin\AppData\Local\Temp\c975ca1b19e755f3a389052116391b307f08e0e1f564a91a997f618921d9fa28.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:552
-
C:\Windows\Syswow64\99f0abc8C:\Windows\Syswow64\99f0abc81⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4340
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\99f0abc8
- Size 766KB
- SHA256 700105ef656cb395616d2b20db53148a338d2676dd13b79afd05bb24dd4d6e91
- MD5 5274d6c481f48f424c9d238588c45d06
- SHA1 e70d30bb1e5acc6a98d94a2aea7911ce97c7ff7c
- SHA512 18f5c6b41e6897a6f7b4e940c181d51ed1fb5dec5f53b0298f794fba60422937ec89239eb59e7c88b4cd1c0f1afc9fc3e714746dabadfafaa315fe0760248492
- SSDEEP 12288:fSvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/Liw:qvO2xJKRw2kOkx2LFRvcUV
- TLSH T140F45A31E241C03AD0A74576C6FA0BAFE564BD25531155CBA3C43A6A2FB36D2BE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH