Analysis
- max time kernel
150s - max time network
161s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/08/2026, 12:12
Behavioral task
behavioral1
Sample
bd72997ad548b2ab77960d704a3613860c9e9459b8c756334364d042084d6912.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target bd72997ad548b2ab77960d704a3613860c9e9459b8c756334364d042084d6912.exe
- Size 560KB
- Sample260814-pc65cstsdy
- SHA256 bd72997ad548b2ab77960d704a3613860c9e9459b8c756334364d042084d6912
- MD5 7cf4f8522d8a67dd4bb258749ee3e9af
- SHA1 d10e5dc38f1f2a3f5d9e6c08760e697bad890d3f
- SHA512 830bfa59af7895234e01859383fb7808b6ca4270344fbec8294306afa6b8384a9e37bc28a7468fa023ac9ba2e77e282ddda07054fba25052a75e4313e1264350
- SSDEEP 6144:dgye71cE4poJTqvpQLXNKFyLWD1nFairGcEOkCybEaQRuy8K:dI7OE4kopQzNKFyLWDHsOkxHy
- TLSH T110C48C2AB690C076C4B7D534C5E197AAEAB17432372449CFA3D0075A1F237E2BA3570E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5096 affd6053 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 1 114.114.114.114 1772 bd72997ad548b2ab77960d704a3613860c9e9459b8c756334364d042084d6912.exe Destination IP 3 223.5.5.5 1772 bd72997ad548b2ab77960d704a3613860c9e9459b8c756334364d042084d6912.exe Destination IP 24 114.114.114.114 1772 bd72997ad548b2ab77960d704a3613860c9e9459b8c756334364d042084d6912.exe Destination IP 25 223.5.5.5 1772 bd72997ad548b2ab77960d704a3613860c9e9459b8c756334364d042084d6912.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 affd6053 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData affd6053 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content affd6053 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 affd6053 File created C:\Windows\SysWOW64\affd6053 bd72997ad548b2ab77960d704a3613860c9e9459b8c756334364d042084d6912.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE affd6053 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies affd6053 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 affd6053 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft affd6053 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 affd6053 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 affd6053 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 affd6053 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 affd6053 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 affd6053 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache affd6053 -
resource yara_rule behavioral2/memory/1772-0-0x0000000000090000-0x000000000011C000-memory.dmp upx behavioral2/files/0x000a00000000083c-2.dat upx behavioral2/memory/5096-3-0x0000000000DA0000-0x0000000000E2C000-memory.dmp upx behavioral2/memory/1772-25-0x0000000000090000-0x000000000011C000-memory.dmp upx behavioral2/memory/5096-26-0x0000000000DA0000-0x0000000000E2C000-memory.dmp upx behavioral2/memory/5096-39-0x0000000000DA0000-0x0000000000E2C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\573ed0 affd6053 File opened for modification C:\Windows\1e5658 bd72997ad548b2ab77960d704a3613860c9e9459b8c756334364d042084d6912.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bd72997ad548b2ab77960d704a3613860c9e9459b8c756334364d042084d6912.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language affd6053 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix affd6053 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" affd6053 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" affd6053 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ affd6053 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" affd6053 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" affd6053 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing affd6053 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" affd6053 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" affd6053 - Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 5096 affd6053 5096 affd6053 5096 affd6053 5096 affd6053 5096 affd6053 5096 affd6053 5096 affd6053 5096 affd6053 5096 affd6053 5096 affd6053 5096 affd6053 5096 affd6053 5096 affd6053 5096 affd6053 5096 affd6053 5096 affd6053 5096 affd6053 5096 affd6053 5096 affd6053 5096 affd6053 1772 bd72997ad548b2ab77960d704a3613860c9e9459b8c756334364d042084d6912.exe 1772 bd72997ad548b2ab77960d704a3613860c9e9459b8c756334364d042084d6912.exe 1772 bd72997ad548b2ab77960d704a3613860c9e9459b8c756334364d042084d6912.exe 1772 bd72997ad548b2ab77960d704a3613860c9e9459b8c756334364d042084d6912.exe 1772 bd72997ad548b2ab77960d704a3613860c9e9459b8c756334364d042084d6912.exe 1772 bd72997ad548b2ab77960d704a3613860c9e9459b8c756334364d042084d6912.exe 1772 bd72997ad548b2ab77960d704a3613860c9e9459b8c756334364d042084d6912.exe 1772 bd72997ad548b2ab77960d704a3613860c9e9459b8c756334364d042084d6912.exe 1772 bd72997ad548b2ab77960d704a3613860c9e9459b8c756334364d042084d6912.exe 1772 bd72997ad548b2ab77960d704a3613860c9e9459b8c756334364d042084d6912.exe 1772 bd72997ad548b2ab77960d704a3613860c9e9459b8c756334364d042084d6912.exe 1772 bd72997ad548b2ab77960d704a3613860c9e9459b8c756334364d042084d6912.exe 1772 bd72997ad548b2ab77960d704a3613860c9e9459b8c756334364d042084d6912.exe 1772 bd72997ad548b2ab77960d704a3613860c9e9459b8c756334364d042084d6912.exe 1772 bd72997ad548b2ab77960d704a3613860c9e9459b8c756334364d042084d6912.exe 1772 bd72997ad548b2ab77960d704a3613860c9e9459b8c756334364d042084d6912.exe 1772 bd72997ad548b2ab77960d704a3613860c9e9459b8c756334364d042084d6912.exe 1772 bd72997ad548b2ab77960d704a3613860c9e9459b8c756334364d042084d6912.exe 1772 bd72997ad548b2ab77960d704a3613860c9e9459b8c756334364d042084d6912.exe 1772 bd72997ad548b2ab77960d704a3613860c9e9459b8c756334364d042084d6912.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1772 bd72997ad548b2ab77960d704a3613860c9e9459b8c756334364d042084d6912.exe Token: SeTcbPrivilege 1772 bd72997ad548b2ab77960d704a3613860c9e9459b8c756334364d042084d6912.exe Token: SeDebugPrivilege 5096 affd6053 Token: SeTcbPrivilege 5096 affd6053
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd72997ad548b2ab77960d704a3613860c9e9459b8c756334364d042084d6912.exe"C:\Users\Admin\AppData\Local\Temp\bd72997ad548b2ab77960d704a3613860c9e9459b8c756334364d042084d6912.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1772
-
C:\Windows\Syswow64\affd6053C:\Windows\Syswow64\affd60531⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5096
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\573ed0
- Size 916B
- SHA256 13c95f30228efc4cda80b4fc1c924607d05c2e48c9cd5c496588403977357b65
- MD5 7a79d6dd59247bf63858c622d0a9096f
- SHA1 b5a23aa4ac1351e819b9528697d6951e955d8d3e
- SHA512 3299bf19eb05f2d5ae7059d9a63299ac3b709fe195f4a9b9bcb30b85de57067bf806f466840ba96f8c7028e45021ece4b4ccb176a6e39bff5a1d391eb0ceda5e
- TLSH T1F211C4621464DBA6ECBB427536F39CCC7F327897C6CA811708D3A1C365B3658D457052
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\affd6053
- Size 560KB
- SHA256 d1070bb8ac0a8de3d06557745ea14f7c7a8fbfa80756643438d8538eb2d8d4aa
- MD5 73e05a3b2c3bfe76eb2dbdbde6fa98d8
- SHA1 b41c42193f3da44fbf1e431cd5f058fd91abb692
- SHA512 9dc532a92d6b18dd530eeb53a4482953a4abcb6c8aa0b0f5bd9eec1d2f0a268c89366b640a8f5edfbad6ca6acd4950bd0935831364dcb8532231338919d032e2
- SSDEEP 6144:Sgye71cE4poJTqvpQLXNKFyLWD1nFairGcEOkCybEaQRuy8K:SI7OE4kopQzNKFyLWDHsOkxHy
- TLSH T13AC48C2AB690C076C4B7D534C5E197AAEAB17432372449CFA7D0075A1F237E2BA3570E
- MD5 SHA1 SHA512 SSDEEP TLSH