Analysis
- max time kernel
148s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 03:53
Behavioral task
behavioral1
Sample
310b9f105d9092df361c9b85a2b85888353fc2169915afba8b4b734be4b1c687.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 310b9f105d9092df361c9b85a2b85888353fc2169915afba8b4b734be4b1c687.exe
- Size 2.5MB
- Sample260809-ef3agagr8v
- SHA256 310b9f105d9092df361c9b85a2b85888353fc2169915afba8b4b734be4b1c687
- MD5 fd44edd6779375797c985c61844cc6b8
- SHA1 c2406920d5aae2aa67538cf3ed6ae1fd8d7c1fcd
- SHA512 ab4b437ac1c5790dbf11f07e54a1f46f0a503501e6cb6651f7b4a46e445ac71a0c1916dfc0543628240738ff79e7d5b5a761d8e34efc7b99ee1bcaf31271ead8
- SSDEEP 49152:rHHKe2WQX56/OJdJCXDrsOFZMjHfUTGkQy5QZuTtN:rnKGEkOhCXHHFZMjHfUKkVWsT
- TLSH T113C58E31E6818136D1B34671C6FA57BBA5247C211721A5CFA3C87A2A1F736D3AE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4820 ca2cd00a - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 3 114.114.114.114 5976 310b9f105d9092df361c9b85a2b85888353fc2169915afba8b4b734be4b1c687.exe Destination IP 4 223.5.5.5 5976 310b9f105d9092df361c9b85a2b85888353fc2169915afba8b4b734be4b1c687.exe Destination IP 23 114.114.114.114 5976 310b9f105d9092df361c9b85a2b85888353fc2169915afba8b4b734be4b1c687.exe Destination IP 24 223.5.5.5 5976 310b9f105d9092df361c9b85a2b85888353fc2169915afba8b4b734be4b1c687.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 ca2cd00a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 ca2cd00a File created C:\Windows\SysWOW64\ca2cd00a 310b9f105d9092df361c9b85a2b85888353fc2169915afba8b4b734be4b1c687.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 ca2cd00a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE ca2cd00a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache ca2cd00a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 ca2cd00a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content ca2cd00a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 ca2cd00a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies ca2cd00a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 ca2cd00a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft ca2cd00a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData ca2cd00a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 ca2cd00a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 ca2cd00a -
resource yara_rule behavioral2/memory/5976-0-0x00000000002C0000-0x000000000034C000-memory.dmp upx behavioral2/files/0x000500000000053e-2.dat upx behavioral2/memory/4820-4-0x00000000003F0000-0x000000000047C000-memory.dmp upx behavioral2/memory/5976-10-0x00000000002C0000-0x000000000034C000-memory.dmp upx behavioral2/memory/4820-11-0x00000000003F0000-0x000000000047C000-memory.dmp upx behavioral2/memory/4820-34-0x00000000003F0000-0x000000000047C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\664fb0 310b9f105d9092df361c9b85a2b85888353fc2169915afba8b4b734be4b1c687.exe File opened for modification C:\Windows\528528 ca2cd00a - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 310b9f105d9092df361c9b85a2b85888353fc2169915afba8b4b734be4b1c687.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ca2cd00a - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ca2cd00a Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix ca2cd00a Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" ca2cd00a Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ca2cd00a Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ca2cd00a Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing ca2cd00a Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" ca2cd00a Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ca2cd00a Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ca2cd00a - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 4820 ca2cd00a 4820 ca2cd00a 4820 ca2cd00a 4820 ca2cd00a 4820 ca2cd00a 4820 ca2cd00a 4820 ca2cd00a 4820 ca2cd00a 5976 310b9f105d9092df361c9b85a2b85888353fc2169915afba8b4b734be4b1c687.exe 5976 310b9f105d9092df361c9b85a2b85888353fc2169915afba8b4b734be4b1c687.exe 5976 310b9f105d9092df361c9b85a2b85888353fc2169915afba8b4b734be4b1c687.exe 5976 310b9f105d9092df361c9b85a2b85888353fc2169915afba8b4b734be4b1c687.exe 5976 310b9f105d9092df361c9b85a2b85888353fc2169915afba8b4b734be4b1c687.exe 5976 310b9f105d9092df361c9b85a2b85888353fc2169915afba8b4b734be4b1c687.exe 5976 310b9f105d9092df361c9b85a2b85888353fc2169915afba8b4b734be4b1c687.exe 5976 310b9f105d9092df361c9b85a2b85888353fc2169915afba8b4b734be4b1c687.exe 5976 310b9f105d9092df361c9b85a2b85888353fc2169915afba8b4b734be4b1c687.exe 5976 310b9f105d9092df361c9b85a2b85888353fc2169915afba8b4b734be4b1c687.exe 5976 310b9f105d9092df361c9b85a2b85888353fc2169915afba8b4b734be4b1c687.exe 5976 310b9f105d9092df361c9b85a2b85888353fc2169915afba8b4b734be4b1c687.exe 5976 310b9f105d9092df361c9b85a2b85888353fc2169915afba8b4b734be4b1c687.exe 5976 310b9f105d9092df361c9b85a2b85888353fc2169915afba8b4b734be4b1c687.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 5976 310b9f105d9092df361c9b85a2b85888353fc2169915afba8b4b734be4b1c687.exe Token: SeTcbPrivilege 5976 310b9f105d9092df361c9b85a2b85888353fc2169915afba8b4b734be4b1c687.exe Token: SeDebugPrivilege 4820 ca2cd00a Token: SeTcbPrivilege 4820 ca2cd00a
Processes
-
C:\Users\Admin\AppData\Local\Temp\310b9f105d9092df361c9b85a2b85888353fc2169915afba8b4b734be4b1c687.exe"C:\Users\Admin\AppData\Local\Temp\310b9f105d9092df361c9b85a2b85888353fc2169915afba8b4b734be4b1c687.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5976
-
C:\Windows\Syswow64\ca2cd00aC:\Windows\Syswow64\ca2cd00a1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4820
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\ca2cd00a
- Size 2.5MB
- SHA256 38a7174439542a03aa091a02afd95fde238bcb55730ff21380c17246b6d99f78
- MD5 c3de7310cde8a45e338431907454e60d
- SHA1 42b1d14e53b1143e40ec3f1296ac06455bf156a2
- SHA512 567bf1a0b8eb51f494d19bf14fb9b6371654433c2a0009bcabbaacc55938dd63596b6a8ac429218bb73687cce3975d7903ea7ea9056e7d9ef3168513cc69af9f
- SSDEEP 49152:cHHKe2WQX56/OJdJCXDrsOFZMjHfUTGkQy5QZuTtN:cnKGEkOhCXHHFZMjHfUKkVWsT
- TLSH T192C58E31E6818136D1B34671C6FA57BBA5247C211721A5CFA3C87A2A1F736D3AE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH