Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/08/2026, 22:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9f8540bb6f530b642d8b075509176a6b0be603567fa606cb148bf3484f8b9726.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
9f8540bb6f530b642d8b075509176a6b0be603567fa606cb148bf3484f8b9726.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 9f8540bb6f530b642d8b075509176a6b0be603567fa606cb148bf3484f8b9726.exe
- Size 547KB
- Sample260809-13877ael7x
- SHA256 9f8540bb6f530b642d8b075509176a6b0be603567fa606cb148bf3484f8b9726
- MD5 82c4e6b9cdd1b92ce9defd185c2ed9cd
- SHA1 877ca94492bed91c1cadde06a1cf555e0f2eb578
- SHA512 4669f18c4c351d48a2bdf5713785a45ac0ba1cc91499376d0951bbaf7956fd94078c19a1572e656236482e3f1a57eb2d57a410235d3976eb01725cd3f6c8ace9
- SSDEEP 6144:9cTgav1cdCTuoPbgwmOLJvKRILSFvdFDcEOkCybEaQRXr9HNdvOaxy8KARG3:9SvO2x9mONvKRILSFnOkx2LIaxy6RY
- TLSH T199C47C27B6908236C4778675C4E647A6FBB5B511BB228B8F675083190F237D3BE21B1C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1944 81df1248 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 37 223.5.5.5 2284 9f8540bb6f530b642d8b075509176a6b0be603567fa606cb148bf3484f8b9726.exe Destination IP 3 114.114.114.114 2284 9f8540bb6f530b642d8b075509176a6b0be603567fa606cb148bf3484f8b9726.exe Destination IP 4 223.5.5.5 2284 9f8540bb6f530b642d8b075509176a6b0be603567fa606cb148bf3484f8b9726.exe Destination IP 36 114.114.114.114 2284 9f8540bb6f530b642d8b075509176a6b0be603567fa606cb148bf3484f8b9726.exe - Drops file in System32 directory 19 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 81df1248 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 81df1248 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AAD646CB44373074ADE741C38400E7E1 81df1248 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AAD646CB44373074ADE741C38400E7E1 81df1248 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 81df1248 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 81df1248 File created C:\Windows\SysWOW64\81df1248 9f8540bb6f530b642d8b075509176a6b0be603567fa606cb148bf3484f8b9726.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 81df1248 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 81df1248 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 81df1248 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 81df1248 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC845F33427F1C99AF855BE8930371C 81df1248 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 81df1248 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 81df1248 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 81df1248 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 81df1248 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 81df1248 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC845F33427F1C99AF855BE8930371C 81df1248 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 81df1248 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\214830 81df1248 File opened for modification C:\Windows\271a58 9f8540bb6f530b642d8b075509176a6b0be603567fa606cb148bf3484f8b9726.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9f8540bb6f530b642d8b075509176a6b0be603567fa606cb148bf3484f8b9726.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81df1248 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 81df1248 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 81df1248 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 81df1248 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 81df1248 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 81df1248 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 81df1248 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 81df1248 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 81df1248 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 81df1248 - Modifies system certificate store 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1F24C630CDA418EF2069FFAD4FDD5F463A1B69AA 81df1248 Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1F24C630CDA418EF2069FFAD4FDD5F463A1B69AA\Blob = 5c0000000100000004000000800100000f0000000100000030000000f019c7ba12795dacd6ef1a767657deb8e41060a2ad1a6c66900a6ec16870fc06eecbaffdd3e2c986659578e7e85e535a530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003800000047006c006f00620061006c005300690067006e002000450043004300200052006f006f00740020004300410020002d002000520035000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308620000000100000020000000179fbc148a3dd00fd24ea13458cc43bfa7f59c8182d783a513f6ebec100c89241400000001000000140000003de629489bea07ca21444a26de6eded283d09f591d0000000100000010000000b647dd2a9ccadee75e8905e256cc6b147f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d7010300000001000000140000001f24c630cda418ef2069ffad4fdd5f463a1b69aa190000000100000010000000e3087c0c81f60a2a2b466b8a3e70cce82000000001000000220200003082021e308201a4a0030201020211605949e0262ebb55f90a778a71f94ad86c300a06082a8648ce3d040303305031243022060355040b131b476c6f62616c5369676e2045434320526f6f74204341202d20523531133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3132313131333030303030305a170d3338303131393033313430375a305031243022060355040b131b476c6f62616c5369676e2045434320526f6f74204341202d20523531133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e3076301006072a8648ce3d020106052b810400220362000447450e96fb7d5dbfe939d121f89f0bb6d57b1e923a48591cf062312dc07a28fe1aa75cb3b6cc97e745d458fad1776d43a2c08765340a1f7addeb3c33a1c59d4da46f4195387fc91e84ebd19e49928794870c3a854a669f9d59934d976106864aa3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604143de629489bea07ca21444a26de6eded283d09f59300a06082a8648ce3d0403030368003065023100e56912c96edbc631ba0941e197f8fbfd9ae27d12c9ed7c64d3cb05258b56d9a0e75e5d4e0b839c5b7629a00926216a62023071d2b58f5cea3be1780985a875923bc85cfd48ef0d7422a808e26ec549cec70cbca76169f1f73be12acbf92bf3669037 81df1248 - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 1944 81df1248 1944 81df1248 1944 81df1248 1944 81df1248 1944 81df1248 1944 81df1248 1944 81df1248 1944 81df1248 1944 81df1248 1944 81df1248 1944 81df1248 1944 81df1248 2284 9f8540bb6f530b642d8b075509176a6b0be603567fa606cb148bf3484f8b9726.exe 2284 9f8540bb6f530b642d8b075509176a6b0be603567fa606cb148bf3484f8b9726.exe 2284 9f8540bb6f530b642d8b075509176a6b0be603567fa606cb148bf3484f8b9726.exe 2284 9f8540bb6f530b642d8b075509176a6b0be603567fa606cb148bf3484f8b9726.exe 2284 9f8540bb6f530b642d8b075509176a6b0be603567fa606cb148bf3484f8b9726.exe 2284 9f8540bb6f530b642d8b075509176a6b0be603567fa606cb148bf3484f8b9726.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2284 9f8540bb6f530b642d8b075509176a6b0be603567fa606cb148bf3484f8b9726.exe Token: SeTcbPrivilege 2284 9f8540bb6f530b642d8b075509176a6b0be603567fa606cb148bf3484f8b9726.exe Token: SeDebugPrivilege 1944 81df1248 Token: SeTcbPrivilege 1944 81df1248
Processes
-
C:\Users\Admin\AppData\Local\Temp\9f8540bb6f530b642d8b075509176a6b0be603567fa606cb148bf3484f8b9726.exe"C:\Users\Admin\AppData\Local\Temp\9f8540bb6f530b642d8b075509176a6b0be603567fa606cb148bf3484f8b9726.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2284
-
C:\Windows\Syswow64\81df1248C:\Windows\Syswow64\81df12481⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1944
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\214830
- Size 506B
- SHA256 7335903fa024eae97578ba5350eb78e4d6159c37b635393d7daa425418fbe7e0
- MD5 297c47421d7d4ca28e1783590d2655b0
- SHA1 41bc85cfedb419dcbbed6731fcef060521b9f560
- SHA512 15757ac5857636d4093e10d78a01a17a97b0ad4543f0d77a5a7c7fb3deb71b0cf775059b424bc9d7b6925ef4a3c83aa693f27ab4600b99aedbd24a9f03385f3a
- TLSH T181F0C93EEA3A1E910ACE2D230A07A8C428B5D13D800E220D7AF2BA1A05D65671D4329C
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\81df1248
- Size 547KB
- SHA256 77372aef00c5979981f08848d9ca07e1084796a0507ebd6a8b98b795e2059da5
- MD5 3f8303d243865a85495742f5647fe564
- SHA1 0d0fc671f626b4bb615a8f22def9ec19de5afd74
- SHA512 c89a2480547a595d77a2f95f8d1448004a25cbe001c7eadac4e2ec52fc58b4c5140107e007c9a426264092308c126cb4a4c9bde2935a162281170c0b6bfcc459
- SSDEEP 6144:EcTgav1cdCTuoPbgwmOLJvKRILSFvdFDcEOkCybEaQRXr9HNdvOaxy8KARG3:ESvO2x9mONvKRILSFnOkx2LIaxy6RY
- TLSH T1D7C47C27B6908236C4778675C4E647A6FBB5B511BB228B8F675083190F237D3BE21B1C
- MD5 SHA1 SHA512 SSDEEP TLSH