Analysis
- max time kernel
148s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 11:04
Behavioral task
behavioral1
Sample
297a73aa45d672c79f4279b5590b3f354be8853c0409365c4e66a19153378caf.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 297a73aa45d672c79f4279b5590b3f354be8853c0409365c4e66a19153378caf.exe
- Size 618KB
- Sample260810-m6k3waxcqa
- SHA256 297a73aa45d672c79f4279b5590b3f354be8853c0409365c4e66a19153378caf
- MD5 4240450bcbc45f59990e43f656afc417
- SHA1 c8bdac1438dcc3b87cc430b7326b583661aa42ac
- SHA512 c83e363b017e1addce8a76fed6c5f29c034439c159e52083a289988fafd9d81169aba14bf9b8b25a3d1fe8aea56bb6ae49246d15f6ed00c223fdf59a3fdb3456
- SSDEEP 12288:OqXUHkUXe39sOkx2LIan5FAQjU/Lik8CQ3uEW:OjHPOSOkx2LFscUQPxW
- TLSH T1BBD47C31E201C03AD0A74576C6FE0BAFA5687D25431662C7A3D479362FF72D2AA3171E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3348 e0c02700 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 18 223.5.5.5 2396 297a73aa45d672c79f4279b5590b3f354be8853c0409365c4e66a19153378caf.exe Destination IP 1 114.114.114.114 2396 297a73aa45d672c79f4279b5590b3f354be8853c0409365c4e66a19153378caf.exe Destination IP 3 223.5.5.5 2396 297a73aa45d672c79f4279b5590b3f354be8853c0409365c4e66a19153378caf.exe Destination IP 17 114.114.114.114 2396 297a73aa45d672c79f4279b5590b3f354be8853c0409365c4e66a19153378caf.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 e0c02700 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData e0c02700 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content e0c02700 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC845F33427F1C99AF855BE8930371C e0c02700 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE e0c02700 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 e0c02700 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 e0c02700 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC845F33427F1C99AF855BE8930371C e0c02700 File created C:\Windows\SysWOW64\e0c02700 297a73aa45d672c79f4279b5590b3f354be8853c0409365c4e66a19153378caf.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache e0c02700 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 e0c02700 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 e0c02700 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 e0c02700 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies e0c02700 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft e0c02700 -
resource yara_rule behavioral2/memory/2396-0-0x00000000006F0000-0x0000000000779000-memory.dmp upx behavioral2/files/0x0008000000016b4d-2.dat upx behavioral2/memory/3348-4-0x0000000000080000-0x0000000000109000-memory.dmp upx behavioral2/memory/2396-15-0x00000000006F0000-0x0000000000779000-memory.dmp upx behavioral2/memory/3348-17-0x0000000000080000-0x0000000000109000-memory.dmp upx behavioral2/memory/2396-33-0x00000000006F0000-0x0000000000779000-memory.dmp upx behavioral2/memory/3348-34-0x0000000000080000-0x0000000000109000-memory.dmp upx behavioral2/memory/3348-46-0x0000000000080000-0x0000000000109000-memory.dmp upx behavioral2/memory/2396-48-0x00000000006F0000-0x0000000000779000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\3951a8 e0c02700 File opened for modification C:\Windows\290538 297a73aa45d672c79f4279b5590b3f354be8853c0409365c4e66a19153378caf.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 297a73aa45d672c79f4279b5590b3f354be8853c0409365c4e66a19153378caf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e0c02700 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix e0c02700 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" e0c02700 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" e0c02700 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing e0c02700 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" e0c02700 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" e0c02700 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ e0c02700 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" e0c02700 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" e0c02700 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 3348 e0c02700 3348 e0c02700 3348 e0c02700 3348 e0c02700 3348 e0c02700 3348 e0c02700 3348 e0c02700 3348 e0c02700 2396 297a73aa45d672c79f4279b5590b3f354be8853c0409365c4e66a19153378caf.exe 2396 297a73aa45d672c79f4279b5590b3f354be8853c0409365c4e66a19153378caf.exe 2396 297a73aa45d672c79f4279b5590b3f354be8853c0409365c4e66a19153378caf.exe 2396 297a73aa45d672c79f4279b5590b3f354be8853c0409365c4e66a19153378caf.exe 2396 297a73aa45d672c79f4279b5590b3f354be8853c0409365c4e66a19153378caf.exe 2396 297a73aa45d672c79f4279b5590b3f354be8853c0409365c4e66a19153378caf.exe 2396 297a73aa45d672c79f4279b5590b3f354be8853c0409365c4e66a19153378caf.exe 2396 297a73aa45d672c79f4279b5590b3f354be8853c0409365c4e66a19153378caf.exe 2396 297a73aa45d672c79f4279b5590b3f354be8853c0409365c4e66a19153378caf.exe 2396 297a73aa45d672c79f4279b5590b3f354be8853c0409365c4e66a19153378caf.exe 2396 297a73aa45d672c79f4279b5590b3f354be8853c0409365c4e66a19153378caf.exe 2396 297a73aa45d672c79f4279b5590b3f354be8853c0409365c4e66a19153378caf.exe 2396 297a73aa45d672c79f4279b5590b3f354be8853c0409365c4e66a19153378caf.exe 2396 297a73aa45d672c79f4279b5590b3f354be8853c0409365c4e66a19153378caf.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2396 297a73aa45d672c79f4279b5590b3f354be8853c0409365c4e66a19153378caf.exe Token: SeTcbPrivilege 2396 297a73aa45d672c79f4279b5590b3f354be8853c0409365c4e66a19153378caf.exe Token: SeDebugPrivilege 3348 e0c02700 Token: SeTcbPrivilege 3348 e0c02700
Processes
-
C:\Users\Admin\AppData\Local\Temp\297a73aa45d672c79f4279b5590b3f354be8853c0409365c4e66a19153378caf.exe"C:\Users\Admin\AppData\Local\Temp\297a73aa45d672c79f4279b5590b3f354be8853c0409365c4e66a19153378caf.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2396
-
C:\Windows\Syswow64\e0c02700C:\Windows\Syswow64\e0c027001⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3348
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\e0c02700
- Size 618KB
- SHA256 d60e2334be36a4d0ad2596b0e72ed80149e91e6a0a49f9a3a2cd03293a71d8ea
- MD5 17d1e3a6e5e4f9d7a9d2fe033b3613ac
- SHA1 b40e92b66986173a4780d6a7df324c92e64e67ca
- SHA512 9678389ca2d52c1ddd075778e37b688cbd268a647b989dbb89758d9af0327b94d845e8e4f127b3cf3f1c6dc25a6e2b6fc1203572f88eca6428baaed6c51c59de
- SSDEEP 12288:rqXUHkUXe39sOkx2LIan5FAQjU/Lik8CQ3uEW:rjHPOSOkx2LFscUQPxW
- TLSH T12DD47C31E201C03AD0A74576C6FE0BAFA5687D25431662C7A3D479362FF72D2AA3171E
- MD5 SHA1 SHA512 SSDEEP TLSH