Analysis
- max time kernel
148s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/08/2026, 19:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5c480d22e3c6799c5eb0002df1fdbcadc6cfed0b4baef89762d2c745669333b1.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
5c480d22e3c6799c5eb0002df1fdbcadc6cfed0b4baef89762d2c745669333b1.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 5c480d22e3c6799c5eb0002df1fdbcadc6cfed0b4baef89762d2c745669333b1.exe
- Size 374KB
- Sample260811-ya4e5axsgx
- SHA256 5c480d22e3c6799c5eb0002df1fdbcadc6cfed0b4baef89762d2c745669333b1
- MD5 22c64acb16b03424c3d1c9c632562518
- SHA1 8cb41c206a989d527df1f918b84d6fc57b39c812
- SHA512 355246f2dd2da8ff73dd4849638bc29317368e14d6f7ab052b87ce350be8dbac09f0fdfc004579dbb2786c02979e9be736af8fe0a9b4eabbb864dfa5059e3e97
- SSDEEP 6144:5cTgav1cdCTuoPbgwmOLJvKRILSFvdFfcEOkCybEaQRXr9HNdvOaxy8K:5SvO2x9mONvKRILSFLOkx2LIaxy
- TLSH T1A0846D2AF6A0D076C4B79579C4A257AAFBB1742137204ACFA390475A1F237E2BD3530D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1548 5223e380 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 1 114.114.114.114 1168 5c480d22e3c6799c5eb0002df1fdbcadc6cfed0b4baef89762d2c745669333b1.exe Destination IP 4 223.5.5.5 1168 5c480d22e3c6799c5eb0002df1fdbcadc6cfed0b4baef89762d2c745669333b1.exe Destination IP 18 114.114.114.114 1168 5c480d22e3c6799c5eb0002df1fdbcadc6cfed0b4baef89762d2c745669333b1.exe Destination IP 19 223.5.5.5 1168 5c480d22e3c6799c5eb0002df1fdbcadc6cfed0b4baef89762d2c745669333b1.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 5223e380 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 5223e380 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 5223e380 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC845F33427F1C99AF855BE8930371C 5223e380 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 5223e380 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 5223e380 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC845F33427F1C99AF855BE8930371C 5223e380 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 5223e380 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 5223e380 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 5223e380 File created C:\Windows\SysWOW64\5223e380 5c480d22e3c6799c5eb0002df1fdbcadc6cfed0b4baef89762d2c745669333b1.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 5223e380 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 5223e380 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 5223e380 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 5223e380 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\13ff20 5c480d22e3c6799c5eb0002df1fdbcadc6cfed0b4baef89762d2c745669333b1.exe File opened for modification C:\Windows\1a8098 5223e380 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5c480d22e3c6799c5eb0002df1fdbcadc6cfed0b4baef89762d2c745669333b1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5223e380 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 5223e380 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 5223e380 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 5223e380 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 5223e380 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 5223e380 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 5223e380 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 5223e380 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 5223e380 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 5223e380 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 1548 5223e380 1548 5223e380 1548 5223e380 1548 5223e380 1548 5223e380 1548 5223e380 1548 5223e380 1548 5223e380 1168 5c480d22e3c6799c5eb0002df1fdbcadc6cfed0b4baef89762d2c745669333b1.exe 1168 5c480d22e3c6799c5eb0002df1fdbcadc6cfed0b4baef89762d2c745669333b1.exe 1168 5c480d22e3c6799c5eb0002df1fdbcadc6cfed0b4baef89762d2c745669333b1.exe 1168 5c480d22e3c6799c5eb0002df1fdbcadc6cfed0b4baef89762d2c745669333b1.exe 1168 5c480d22e3c6799c5eb0002df1fdbcadc6cfed0b4baef89762d2c745669333b1.exe 1168 5c480d22e3c6799c5eb0002df1fdbcadc6cfed0b4baef89762d2c745669333b1.exe 1168 5c480d22e3c6799c5eb0002df1fdbcadc6cfed0b4baef89762d2c745669333b1.exe 1168 5c480d22e3c6799c5eb0002df1fdbcadc6cfed0b4baef89762d2c745669333b1.exe 1168 5c480d22e3c6799c5eb0002df1fdbcadc6cfed0b4baef89762d2c745669333b1.exe 1168 5c480d22e3c6799c5eb0002df1fdbcadc6cfed0b4baef89762d2c745669333b1.exe 1168 5c480d22e3c6799c5eb0002df1fdbcadc6cfed0b4baef89762d2c745669333b1.exe 1168 5c480d22e3c6799c5eb0002df1fdbcadc6cfed0b4baef89762d2c745669333b1.exe 1168 5c480d22e3c6799c5eb0002df1fdbcadc6cfed0b4baef89762d2c745669333b1.exe 1168 5c480d22e3c6799c5eb0002df1fdbcadc6cfed0b4baef89762d2c745669333b1.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1168 5c480d22e3c6799c5eb0002df1fdbcadc6cfed0b4baef89762d2c745669333b1.exe Token: SeTcbPrivilege 1168 5c480d22e3c6799c5eb0002df1fdbcadc6cfed0b4baef89762d2c745669333b1.exe Token: SeDebugPrivilege 1548 5223e380 Token: SeTcbPrivilege 1548 5223e380
Processes
-
C:\Users\Admin\AppData\Local\Temp\5c480d22e3c6799c5eb0002df1fdbcadc6cfed0b4baef89762d2c745669333b1.exe"C:\Users\Admin\AppData\Local\Temp\5c480d22e3c6799c5eb0002df1fdbcadc6cfed0b4baef89762d2c745669333b1.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1168
-
C:\Windows\Syswow64\5223e380C:\Windows\Syswow64\5223e3801⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1548
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\5223e380
- Size 374KB
- SHA256 d479c3d94399fd47c3174c919bce5d7cc4bcec229ff259fa2ea0b29713ddc8d3
- MD5 d6f1de3db9deb56775b38fa969a9d2f5
- SHA1 0c74efc5f05ad902bf44a65d1277c1378108dc40
- SHA512 8e34214838d4c7b29aeb12ba6c8acd8a8d60fa4606dfe6e731ede0716fb3b8a7ce8d6e84529e4876199cc6ea7e04de82f749292aebc8eb0456b87f934d34a862
- SSDEEP 6144:qcTgav1cdCTuoPbgwmOLJvKRILSFvdFfcEOkCybEaQRXr9HNdvOaxy8K:qSvO2x9mONvKRILSFLOkx2LIaxy
- TLSH T18D846D2AF6A0D076C4B79579C4A257AAFBB1742137204ACFA390475A1F237E2BD3530D
- MD5 SHA1 SHA512 SSDEEP TLSH