Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/08/2026, 22:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
948daf878c1b2c01b9c1c4532e5f9ff0e8c93ad8e098ba48c8c7c2f8790e73b1.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
948daf878c1b2c01b9c1c4532e5f9ff0e8c93ad8e098ba48c8c7c2f8790e73b1.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 948daf878c1b2c01b9c1c4532e5f9ff0e8c93ad8e098ba48c8c7c2f8790e73b1.exe
- Size 374KB
- Sample260809-134mpsel7v
- SHA256 948daf878c1b2c01b9c1c4532e5f9ff0e8c93ad8e098ba48c8c7c2f8790e73b1
- MD5 22a3e7933e875b586dfc2e92e93437f2
- SHA1 581c6a181f6a0cca55aeed0394f0c7c3761bcbc6
- SHA512 986a39889a7350a8c33daf7f3ded5f1845b105117626951f74aa8d12620f62de1f6badb3764b8468208189e5da876c177659655426c6a6dbd8e34a743a628566
- SSDEEP 6144:qcTgav1cdCTuoPbgwmOLJvKRILSFvdFfcEOkCybEaQRXr9HNdvOaxy8K:qSvO2x9mONvKRILSFLOkx2LIaxy
- TLSH T1D3846D2AF6A0D076C4B79579C4A257AAFBB1742137204ACFA390475A1F237E2BD3530D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4412 c5090bec - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 3 114.114.114.114 5000 948daf878c1b2c01b9c1c4532e5f9ff0e8c93ad8e098ba48c8c7c2f8790e73b1.exe Destination IP 4 223.5.5.5 5000 948daf878c1b2c01b9c1c4532e5f9ff0e8c93ad8e098ba48c8c7c2f8790e73b1.exe Destination IP 32 114.114.114.114 5000 948daf878c1b2c01b9c1c4532e5f9ff0e8c93ad8e098ba48c8c7c2f8790e73b1.exe Destination IP 33 223.5.5.5 5000 948daf878c1b2c01b9c1c4532e5f9ff0e8c93ad8e098ba48c8c7c2f8790e73b1.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 c5090bec File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 c5090bec File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE c5090bec File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies c5090bec File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache c5090bec File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData c5090bec File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 c5090bec File created C:\Windows\SysWOW64\c5090bec 948daf878c1b2c01b9c1c4532e5f9ff0e8c93ad8e098ba48c8c7c2f8790e73b1.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 c5090bec File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 c5090bec File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft c5090bec File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 c5090bec File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content c5090bec - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\4b88f8 c5090bec File opened for modification C:\Windows\559a10 948daf878c1b2c01b9c1c4532e5f9ff0e8c93ad8e098ba48c8c7c2f8790e73b1.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 948daf878c1b2c01b9c1c4532e5f9ff0e8c93ad8e098ba48c8c7c2f8790e73b1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c5090bec - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix c5090bec Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" c5090bec Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ c5090bec Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" c5090bec Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" c5090bec Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" c5090bec Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing c5090bec Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" c5090bec Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" c5090bec - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 4412 c5090bec 4412 c5090bec 4412 c5090bec 4412 c5090bec 4412 c5090bec 4412 c5090bec 4412 c5090bec 4412 c5090bec 4412 c5090bec 4412 c5090bec 4412 c5090bec 4412 c5090bec 5000 948daf878c1b2c01b9c1c4532e5f9ff0e8c93ad8e098ba48c8c7c2f8790e73b1.exe 5000 948daf878c1b2c01b9c1c4532e5f9ff0e8c93ad8e098ba48c8c7c2f8790e73b1.exe 5000 948daf878c1b2c01b9c1c4532e5f9ff0e8c93ad8e098ba48c8c7c2f8790e73b1.exe 5000 948daf878c1b2c01b9c1c4532e5f9ff0e8c93ad8e098ba48c8c7c2f8790e73b1.exe 5000 948daf878c1b2c01b9c1c4532e5f9ff0e8c93ad8e098ba48c8c7c2f8790e73b1.exe 5000 948daf878c1b2c01b9c1c4532e5f9ff0e8c93ad8e098ba48c8c7c2f8790e73b1.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 5000 948daf878c1b2c01b9c1c4532e5f9ff0e8c93ad8e098ba48c8c7c2f8790e73b1.exe Token: SeTcbPrivilege 5000 948daf878c1b2c01b9c1c4532e5f9ff0e8c93ad8e098ba48c8c7c2f8790e73b1.exe Token: SeDebugPrivilege 4412 c5090bec Token: SeTcbPrivilege 4412 c5090bec
Processes
-
C:\Users\Admin\AppData\Local\Temp\948daf878c1b2c01b9c1c4532e5f9ff0e8c93ad8e098ba48c8c7c2f8790e73b1.exe"C:\Users\Admin\AppData\Local\Temp\948daf878c1b2c01b9c1c4532e5f9ff0e8c93ad8e098ba48c8c7c2f8790e73b1.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5000
-
C:\Windows\Syswow64\c5090becC:\Windows\Syswow64\c5090bec1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4412
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\c5090bec
- Size 374KB
- SHA256 7b1c0275c70d106366995f2d266e056cda86818198d37e38e2039c6ca205d45e
- MD5 a26de8932613d8011e2ff5faca867e4a
- SHA1 7e2ca33f20bc6abf3f49e55ab435cbc9c94afe93
- SHA512 c685da518de9971272dfccf4cf4a1079605b361a79f8753e0881886748b956162ba2e8961b6a80a85de72744582cbc7db048cdf266c0fe84db8eb9d0e4d837aa
- SSDEEP 6144:McTgav1cdCTuoPbgwmOLJvKRILSFvdFfcEOkCybEaQRXr9HNdvOaxy8K:MSvO2x9mONvKRILSFLOkx2LIaxy
- TLSH T151846D2AF6A0D076C4B79579C4A257AAFBB1742137204ACFA390475A1F237E2BD3530D
- MD5 SHA1 SHA512 SSDEEP TLSH