Analysis
- max time kernel
148s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/08/2026, 23:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
827bc02a836e02aa4d29a080b220188ca6ec54c6119e6fc3605157e9318daa42.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
827bc02a836e02aa4d29a080b220188ca6ec54c6119e6fc3605157e9318daa42.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 827bc02a836e02aa4d29a080b220188ca6ec54c6119e6fc3605157e9318daa42.exe
- Size 2.7MB
- Sample260816-31dplscl2w
- SHA256 827bc02a836e02aa4d29a080b220188ca6ec54c6119e6fc3605157e9318daa42
- MD5 ab5e8ebcef26e414d276f483a0d7613f
- SHA1 22bd331bae08a6f89e45213572405c9abca556cf
- SHA512 22ef8432d603f7544cb5fac2d4217fc4511af647f7ed5f441fa00214383bf51543e7357eeb462bc97664cf73aa8768fe365dc629b4dcd4c4591fa35f0bb68894
- SSDEEP 49152:CHHKO29QG56/OJdJCXDrsOFZMjHfUTGkQy5QZuTtS0rQMYOF:CnKdVkOhCXHHFZMjHfUKkVWsM0r1F
- TLSH T115D59E31B7818036D1B7467186FA47BBA5297C211711A5CFB3C47A2A1FB36D2AE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5788 c78338d1 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 1 114.114.114.114 4200 827bc02a836e02aa4d29a080b220188ca6ec54c6119e6fc3605157e9318daa42.exe Destination IP 2 223.5.5.5 4200 827bc02a836e02aa4d29a080b220188ca6ec54c6119e6fc3605157e9318daa42.exe Destination IP 19 114.114.114.114 4200 827bc02a836e02aa4d29a080b220188ca6ec54c6119e6fc3605157e9318daa42.exe Destination IP 20 223.5.5.5 4200 827bc02a836e02aa4d29a080b220188ca6ec54c6119e6fc3605157e9318daa42.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache c78338d1 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content c78338d1 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 c78338d1 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE c78338d1 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData c78338d1 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 c78338d1 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 c78338d1 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 c78338d1 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 c78338d1 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 c78338d1 File created C:\Windows\SysWOW64\c78338d1 827bc02a836e02aa4d29a080b220188ca6ec54c6119e6fc3605157e9318daa42.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft c78338d1 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 c78338d1 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies c78338d1 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 c78338d1 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\6317b8 c78338d1 File opened for modification C:\Windows\47e7d0 827bc02a836e02aa4d29a080b220188ca6ec54c6119e6fc3605157e9318daa42.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 827bc02a836e02aa4d29a080b220188ca6ec54c6119e6fc3605157e9318daa42.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c78338d1 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" c78338d1 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ c78338d1 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" c78338d1 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" c78338d1 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" c78338d1 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix c78338d1 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" c78338d1 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" c78338d1 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing c78338d1 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 5788 c78338d1 5788 c78338d1 5788 c78338d1 5788 c78338d1 5788 c78338d1 5788 c78338d1 5788 c78338d1 5788 c78338d1 4200 827bc02a836e02aa4d29a080b220188ca6ec54c6119e6fc3605157e9318daa42.exe 4200 827bc02a836e02aa4d29a080b220188ca6ec54c6119e6fc3605157e9318daa42.exe 4200 827bc02a836e02aa4d29a080b220188ca6ec54c6119e6fc3605157e9318daa42.exe 4200 827bc02a836e02aa4d29a080b220188ca6ec54c6119e6fc3605157e9318daa42.exe 4200 827bc02a836e02aa4d29a080b220188ca6ec54c6119e6fc3605157e9318daa42.exe 4200 827bc02a836e02aa4d29a080b220188ca6ec54c6119e6fc3605157e9318daa42.exe 4200 827bc02a836e02aa4d29a080b220188ca6ec54c6119e6fc3605157e9318daa42.exe 4200 827bc02a836e02aa4d29a080b220188ca6ec54c6119e6fc3605157e9318daa42.exe 4200 827bc02a836e02aa4d29a080b220188ca6ec54c6119e6fc3605157e9318daa42.exe 4200 827bc02a836e02aa4d29a080b220188ca6ec54c6119e6fc3605157e9318daa42.exe 4200 827bc02a836e02aa4d29a080b220188ca6ec54c6119e6fc3605157e9318daa42.exe 4200 827bc02a836e02aa4d29a080b220188ca6ec54c6119e6fc3605157e9318daa42.exe 4200 827bc02a836e02aa4d29a080b220188ca6ec54c6119e6fc3605157e9318daa42.exe 4200 827bc02a836e02aa4d29a080b220188ca6ec54c6119e6fc3605157e9318daa42.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4200 827bc02a836e02aa4d29a080b220188ca6ec54c6119e6fc3605157e9318daa42.exe Token: SeTcbPrivilege 4200 827bc02a836e02aa4d29a080b220188ca6ec54c6119e6fc3605157e9318daa42.exe Token: SeDebugPrivilege 5788 c78338d1 Token: SeTcbPrivilege 5788 c78338d1
Processes
-
C:\Users\Admin\AppData\Local\Temp\827bc02a836e02aa4d29a080b220188ca6ec54c6119e6fc3605157e9318daa42.exe"C:\Users\Admin\AppData\Local\Temp\827bc02a836e02aa4d29a080b220188ca6ec54c6119e6fc3605157e9318daa42.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4200
-
C:\Windows\Syswow64\c78338d1C:\Windows\Syswow64\c78338d11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5788
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\c78338d1
- Size 2.7MB
- SHA256 ee7f6fc4739a9b59a731e40b121741278fe9867b36520d825dc38e78a6a94039
- MD5 5c2b154d21da870c8f0e7c71efc52aca
- SHA1 ba1a0f802a5ac06d46078f3c060563a4ce36177d
- SHA512 1fb8ec8ec7aad09eef004a87a774d16a76f21c8d6c626c51e0db897dd97c23dfae94b8e78d61735b0ec0df3f706de3402311b59a61d322f149ae336d4c9078a5
- SSDEEP 49152:iHHKO29QG56/OJdJCXDrsOFZMjHfUTGkQy5QZuTtS0rQMYOF:inKdVkOhCXHHFZMjHfUKkVWsM0r1F
- TLSH T1CBD59E31B7818036D1B7467186FA47BBA5297C211711A5CFB3C47A2A1FB36D2AE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH