Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/08/2026, 01:51
Behavioral task
behavioral1
Sample
90066037cbc9d2448714313a7e08661f085e36690f8b3d2fe5cfa370105f8d3b.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 90066037cbc9d2448714313a7e08661f085e36690f8b3d2fe5cfa370105f8d3b.exe
- Size 1024KB
- Sample260809-b97khagc82
- SHA256 90066037cbc9d2448714313a7e08661f085e36690f8b3d2fe5cfa370105f8d3b
- MD5 af5d30189f1f34607f8e3c280f515369
- SHA1 4035a6e20f1d72b99c4b6c19653e4f2634df83de
- SHA512 103b5e1c4f56b9c82ee54a7fb5e841a7e8c60473229e00f0e4856815964a371efd7b265f7de303353c11a9afa9a3157b55a9ff1c95bfbff44c9ac77413d59e2d
- SSDEEP 24576:zjHPOSOkx2LFshuZ98Es8k3OH3C0rQ6+y:zTGkQyhuTtS0rQi
- TLSH T17C25AF31E242C03AD5A70172C6BE0BAF95787D25472951C7A3D43D6A2FB22D2AE3570F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4928 3deed7f0 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 33 223.5.5.5 552 90066037cbc9d2448714313a7e08661f085e36690f8b3d2fe5cfa370105f8d3b.exe Destination IP 3 114.114.114.114 552 90066037cbc9d2448714313a7e08661f085e36690f8b3d2fe5cfa370105f8d3b.exe Destination IP 4 223.5.5.5 552 90066037cbc9d2448714313a7e08661f085e36690f8b3d2fe5cfa370105f8d3b.exe Destination IP 32 114.114.114.114 552 90066037cbc9d2448714313a7e08661f085e36690f8b3d2fe5cfa370105f8d3b.exe - Drops file in System32 directory 19 IoCs
description ioc Process File created C:\Windows\SysWOW64\3deed7f0 90066037cbc9d2448714313a7e08661f085e36690f8b3d2fe5cfa370105f8d3b.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 3deed7f0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 3deed7f0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 3deed7f0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 3deed7f0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC845F33427F1C99AF855BE8930371C 3deed7f0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 3deed7f0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 3deed7f0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AAD646CB44373074ADE741C38400E7E1 3deed7f0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 3deed7f0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 3deed7f0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 3deed7f0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 3deed7f0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AAD646CB44373074ADE741C38400E7E1 3deed7f0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 3deed7f0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC845F33427F1C99AF855BE8930371C 3deed7f0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 3deed7f0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 3deed7f0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 3deed7f0 -
resource yara_rule behavioral1/memory/552-0-0x0000000000870000-0x00000000008F9000-memory.dmp upx behavioral1/files/0x00200000000243c4-2.dat upx behavioral1/memory/4928-3-0x0000000000C50000-0x0000000000CD9000-memory.dmp upx behavioral1/memory/552-19-0x0000000000870000-0x00000000008F9000-memory.dmp upx behavioral1/memory/4928-21-0x0000000000C50000-0x0000000000CD9000-memory.dmp upx behavioral1/memory/552-40-0x0000000000870000-0x00000000008F9000-memory.dmp upx behavioral1/memory/4928-41-0x0000000000C50000-0x0000000000CD9000-memory.dmp upx behavioral1/memory/552-52-0x0000000000870000-0x00000000008F9000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\545e80 3deed7f0 File opened for modification C:\Windows\97350 90066037cbc9d2448714313a7e08661f085e36690f8b3d2fe5cfa370105f8d3b.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 90066037cbc9d2448714313a7e08661f085e36690f8b3d2fe5cfa370105f8d3b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3deed7f0 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 3deed7f0 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 3deed7f0 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 3deed7f0 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 3deed7f0 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 3deed7f0 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 3deed7f0 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 3deed7f0 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 3deed7f0 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 3deed7f0 - Modifies system certificate store 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1F24C630CDA418EF2069FFAD4FDD5F463A1B69AA 3deed7f0 Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1F24C630CDA418EF2069FFAD4FDD5F463A1B69AA\Blob = 5c0000000100000004000000800100000f0000000100000030000000f019c7ba12795dacd6ef1a767657deb8e41060a2ad1a6c66900a6ec16870fc06eecbaffdd3e2c986659578e7e85e535a530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003800000047006c006f00620061006c005300690067006e002000450043004300200052006f006f00740020004300410020002d002000520035000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308620000000100000020000000179fbc148a3dd00fd24ea13458cc43bfa7f59c8182d783a513f6ebec100c89241400000001000000140000003de629489bea07ca21444a26de6eded283d09f591d0000000100000010000000b647dd2a9ccadee75e8905e256cc6b147f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d7010300000001000000140000001f24c630cda418ef2069ffad4fdd5f463a1b69aa190000000100000010000000e3087c0c81f60a2a2b466b8a3e70cce82000000001000000220200003082021e308201a4a0030201020211605949e0262ebb55f90a778a71f94ad86c300a06082a8648ce3d040303305031243022060355040b131b476c6f62616c5369676e2045434320526f6f74204341202d20523531133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3132313131333030303030305a170d3338303131393033313430375a305031243022060355040b131b476c6f62616c5369676e2045434320526f6f74204341202d20523531133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e3076301006072a8648ce3d020106052b810400220362000447450e96fb7d5dbfe939d121f89f0bb6d57b1e923a48591cf062312dc07a28fe1aa75cb3b6cc97e745d458fad1776d43a2c08765340a1f7addeb3c33a1c59d4da46f4195387fc91e84ebd19e49928794870c3a854a669f9d59934d976106864aa3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604143de629489bea07ca21444a26de6eded283d09f59300a06082a8648ce3d0403030368003065023100e56912c96edbc631ba0941e197f8fbfd9ae27d12c9ed7c64d3cb05258b56d9a0e75e5d4e0b839c5b7629a00926216a62023071d2b58f5cea3be1780985a875923bc85cfd48ef0d7422a808e26ec549cec70cbca76169f1f73be12acbf92bf3669037 3deed7f0 - Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 4928 3deed7f0 4928 3deed7f0 4928 3deed7f0 4928 3deed7f0 4928 3deed7f0 4928 3deed7f0 4928 3deed7f0 4928 3deed7f0 4928 3deed7f0 4928 3deed7f0 4928 3deed7f0 4928 3deed7f0 4928 3deed7f0 4928 3deed7f0 4928 3deed7f0 4928 3deed7f0 4928 3deed7f0 4928 3deed7f0 4928 3deed7f0 4928 3deed7f0 552 90066037cbc9d2448714313a7e08661f085e36690f8b3d2fe5cfa370105f8d3b.exe 552 90066037cbc9d2448714313a7e08661f085e36690f8b3d2fe5cfa370105f8d3b.exe 552 90066037cbc9d2448714313a7e08661f085e36690f8b3d2fe5cfa370105f8d3b.exe 552 90066037cbc9d2448714313a7e08661f085e36690f8b3d2fe5cfa370105f8d3b.exe 552 90066037cbc9d2448714313a7e08661f085e36690f8b3d2fe5cfa370105f8d3b.exe 552 90066037cbc9d2448714313a7e08661f085e36690f8b3d2fe5cfa370105f8d3b.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 552 90066037cbc9d2448714313a7e08661f085e36690f8b3d2fe5cfa370105f8d3b.exe Token: SeTcbPrivilege 552 90066037cbc9d2448714313a7e08661f085e36690f8b3d2fe5cfa370105f8d3b.exe Token: SeDebugPrivilege 4928 3deed7f0 Token: SeTcbPrivilege 4928 3deed7f0
Processes
-
C:\Users\Admin\AppData\Local\Temp\90066037cbc9d2448714313a7e08661f085e36690f8b3d2fe5cfa370105f8d3b.exe"C:\Users\Admin\AppData\Local\Temp\90066037cbc9d2448714313a7e08661f085e36690f8b3d2fe5cfa370105f8d3b.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:552
-
C:\Windows\Syswow64\3deed7f0C:\Windows\Syswow64\3deed7f01⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4928
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\3deed7f0
- Size 1024KB
- SHA256 51c13466b7203e65c3d99424e58bbd9941a168376758b56908fb03d73737d4ce
- MD5 bc2e2ba30d095d1042a7049155557a16
- SHA1 4af465f23f5bb91358c5a58efb46a3e3169e2d82
- SHA512 c5dca8cf87d9f78abdb06692bdebf3aba330eaac3bde6fe8dc9c915444c3bb17e088aabc0a6e75fff94d55e76a9e924ea7a4d613435997ef3d5e13e4b487a623
- SSDEEP 24576:cjHPOSOkx2LFshuZ98Es8k3OH3C0rQ6+y:cTGkQyhuTtS0rQi
- TLSH T1CF25AF31E242C03AD5A70172C6BE0BAF95787D25472951C7A3D43D6A2FB22D2AE3570F
- MD5 SHA1 SHA512 SSDEEP TLSH