Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
11/08/2026, 04:36
Behavioral task
behavioral1
Sample
35e9e5e10a56726e23d75d991dc216232c4adc199ce2e56cfb902d42a1cf98b6.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 35e9e5e10a56726e23d75d991dc216232c4adc199ce2e56cfb902d42a1cf98b6.exe
- Size 766KB
- Sample260811-e8fbeawbrb
- SHA256 35e9e5e10a56726e23d75d991dc216232c4adc199ce2e56cfb902d42a1cf98b6
- MD5 ccb933d20e09453aff1619083a6968f6
- SHA1 85736804aec297c8a1f84ce8c59c8f7c983ef713
- SHA512 14e7188d9d7faecf0c5b332a4cd48544e3e37f94f06ee5e2094e040774d34bd221ce866444771c99744852f8e008c024de0f724b864a2ed473e6be51f3388dde
- SSDEEP 12288:nSvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/Liw:SvO2xJKRw2kOkx2LFRvcUV
- TLSH T10AF45A31E241C03AD0A74576C6FA0BAFE564BD25531155CBA3C43A6A2FB36D2BE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1732 faf4af92 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 3 114.114.114.114 1676 35e9e5e10a56726e23d75d991dc216232c4adc199ce2e56cfb902d42a1cf98b6.exe Destination IP 6 223.5.5.5 1676 35e9e5e10a56726e23d75d991dc216232c4adc199ce2e56cfb902d42a1cf98b6.exe Destination IP 55 114.114.114.114 1676 35e9e5e10a56726e23d75d991dc216232c4adc199ce2e56cfb902d42a1cf98b6.exe Destination IP 59 223.5.5.5 1676 35e9e5e10a56726e23d75d991dc216232c4adc199ce2e56cfb902d42a1cf98b6.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE faf4af92 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies faf4af92 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 faf4af92 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 faf4af92 File created C:\Windows\SysWOW64\faf4af92 35e9e5e10a56726e23d75d991dc216232c4adc199ce2e56cfb902d42a1cf98b6.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 faf4af92 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 faf4af92 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft faf4af92 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content faf4af92 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 faf4af92 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 faf4af92 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 faf4af92 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache faf4af92 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData faf4af92 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 faf4af92 -
resource yara_rule behavioral1/memory/1676-0-0x0000000000430000-0x00000000004BC000-memory.dmp upx behavioral1/memory/1732-4-0x00000000006B0000-0x000000000073C000-memory.dmp upx behavioral1/files/0x000a00000002437c-3.dat upx behavioral1/memory/1676-18-0x0000000000430000-0x00000000004BC000-memory.dmp upx behavioral1/memory/1732-19-0x00000000006B0000-0x000000000073C000-memory.dmp upx behavioral1/memory/1732-24-0x00000000006B0000-0x000000000073C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\1da708 faf4af92 File opened for modification C:\Windows\1cb198 35e9e5e10a56726e23d75d991dc216232c4adc199ce2e56cfb902d42a1cf98b6.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35e9e5e10a56726e23d75d991dc216232c4adc199ce2e56cfb902d42a1cf98b6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language faf4af92 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix faf4af92 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" faf4af92 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ faf4af92 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" faf4af92 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" faf4af92 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing faf4af92 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" faf4af92 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" faf4af92 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" faf4af92 - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 1732 faf4af92 1732 faf4af92 1732 faf4af92 1732 faf4af92 1732 faf4af92 1732 faf4af92 1732 faf4af92 1732 faf4af92 1676 35e9e5e10a56726e23d75d991dc216232c4adc199ce2e56cfb902d42a1cf98b6.exe 1676 35e9e5e10a56726e23d75d991dc216232c4adc199ce2e56cfb902d42a1cf98b6.exe 1676 35e9e5e10a56726e23d75d991dc216232c4adc199ce2e56cfb902d42a1cf98b6.exe 1676 35e9e5e10a56726e23d75d991dc216232c4adc199ce2e56cfb902d42a1cf98b6.exe 1676 35e9e5e10a56726e23d75d991dc216232c4adc199ce2e56cfb902d42a1cf98b6.exe 1676 35e9e5e10a56726e23d75d991dc216232c4adc199ce2e56cfb902d42a1cf98b6.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1676 35e9e5e10a56726e23d75d991dc216232c4adc199ce2e56cfb902d42a1cf98b6.exe Token: SeTcbPrivilege 1676 35e9e5e10a56726e23d75d991dc216232c4adc199ce2e56cfb902d42a1cf98b6.exe Token: SeDebugPrivilege 1732 faf4af92 Token: SeTcbPrivilege 1732 faf4af92
Processes
-
C:\Users\Admin\AppData\Local\Temp\35e9e5e10a56726e23d75d991dc216232c4adc199ce2e56cfb902d42a1cf98b6.exe"C:\Users\Admin\AppData\Local\Temp\35e9e5e10a56726e23d75d991dc216232c4adc199ce2e56cfb902d42a1cf98b6.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1676
-
C:\Windows\Syswow64\faf4af92C:\Windows\Syswow64\faf4af921⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1732
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\faf4af92
- Size 766KB
- SHA256 4b6f4af43e53edb908d189b6fa69c0167750af138e5c9a526f6ec3c190531e75
- MD5 8c6f697dee71d69d620db8f303f492d7
- SHA1 79e4a4e942be0be7a304b1ac0bcabf21b66eebd5
- SHA512 4112b148f90988b83f1a8532653b1db775675f2aff6a310257ef37b564eb19fafad2cbe9984a7ef3800405c1fd7a2e25931badbac2af6de0aa4cda19afb83683
- SSDEEP 12288:MSvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/Liw:/vO2xJKRw2kOkx2LFRvcUV
- TLSH T107F45A31E241C03AD0A74576C6FA0BAFE564BD25531155CBA3C43A6A2FB36D2BE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH