Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
16/08/2026, 17:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a9769c41074f93c3a874752474be7ab87d52e58c36ad27bc73b6f8acf2639119.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
a9769c41074f93c3a874752474be7ab87d52e58c36ad27bc73b6f8acf2639119.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target a9769c41074f93c3a874752474be7ab87d52e58c36ad27bc73b6f8acf2639119.exe
- Size 1.1MB
- Sample260816-wk5ptstemf
- SHA256 a9769c41074f93c3a874752474be7ab87d52e58c36ad27bc73b6f8acf2639119
- MD5 c76aa9232c33883e03b59dce63e5491f
- SHA1 074b704bfb742e53e41d2d0d2a80a9dbacb116b5
- SHA512 4dba0bd5e699006a1441df76949be7366b6ba41f07c992ebcead26cf977f3f3c077173a9ebe34fb8ca6bc37ae62d029fbeed6b1b42de08448f3f5331da0309c0
- SSDEEP 24576:KvO2xJKRI2dOkx2LFAAX1oOYSY82e5QPJJOgufWWsYo:KHHKO2FQd1oOU82lPJ6Po
- TLSH T136359D12F7A1C072C8A7427448B6C36EA675BC152B214BCBB7C03B5E5E723D1AE36359
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4216 bf4c99f8 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 3 114.114.114.114 2132 a9769c41074f93c3a874752474be7ab87d52e58c36ad27bc73b6f8acf2639119.exe Destination IP 6 223.5.5.5 2132 a9769c41074f93c3a874752474be7ab87d52e58c36ad27bc73b6f8acf2639119.exe Destination IP 41 114.114.114.114 2132 a9769c41074f93c3a874752474be7ab87d52e58c36ad27bc73b6f8acf2639119.exe Destination IP 42 223.5.5.5 2132 a9769c41074f93c3a874752474be7ab87d52e58c36ad27bc73b6f8acf2639119.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AAD646CB44373074ADE741C38400E7E1 bf4c99f8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC845F33427F1C99AF855BE8930371C bf4c99f8 File created C:\Windows\SysWOW64\bf4c99f8 a9769c41074f93c3a874752474be7ab87d52e58c36ad27bc73b6f8acf2639119.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 bf4c99f8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE bf4c99f8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies bf4c99f8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData bf4c99f8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content bf4c99f8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AAD646CB44373074ADE741C38400E7E1 bf4c99f8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC845F33427F1C99AF855BE8930371C bf4c99f8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 bf4c99f8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft bf4c99f8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache bf4c99f8 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\248028 a9769c41074f93c3a874752474be7ab87d52e58c36ad27bc73b6f8acf2639119.exe File opened for modification C:\Windows\482df0 bf4c99f8 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a9769c41074f93c3a874752474be7ab87d52e58c36ad27bc73b6f8acf2639119.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bf4c99f8 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" bf4c99f8 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" bf4c99f8 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" bf4c99f8 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" bf4c99f8 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" bf4c99f8 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" bf4c99f8 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing bf4c99f8 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix bf4c99f8 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ bf4c99f8 - Modifies system certificate store 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1F24C630CDA418EF2069FFAD4FDD5F463A1B69AA bf4c99f8 Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1F24C630CDA418EF2069FFAD4FDD5F463A1B69AA\Blob = 5c0000000100000004000000800100000f0000000100000030000000f019c7ba12795dacd6ef1a767657deb8e41060a2ad1a6c66900a6ec16870fc06eecbaffdd3e2c986659578e7e85e535a530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003800000047006c006f00620061006c005300690067006e002000450043004300200052006f006f00740020004300410020002d002000520035000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308620000000100000020000000179fbc148a3dd00fd24ea13458cc43bfa7f59c8182d783a513f6ebec100c89241400000001000000140000003de629489bea07ca21444a26de6eded283d09f591d0000000100000010000000b647dd2a9ccadee75e8905e256cc6b147f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d7010300000001000000140000001f24c630cda418ef2069ffad4fdd5f463a1b69aa190000000100000010000000e3087c0c81f60a2a2b466b8a3e70cce82000000001000000220200003082021e308201a4a0030201020211605949e0262ebb55f90a778a71f94ad86c300a06082a8648ce3d040303305031243022060355040b131b476c6f62616c5369676e2045434320526f6f74204341202d20523531133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3132313131333030303030305a170d3338303131393033313430375a305031243022060355040b131b476c6f62616c5369676e2045434320526f6f74204341202d20523531133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e3076301006072a8648ce3d020106052b810400220362000447450e96fb7d5dbfe939d121f89f0bb6d57b1e923a48591cf062312dc07a28fe1aa75cb3b6cc97e745d458fad1776d43a2c08765340a1f7addeb3c33a1c59d4da46f4195387fc91e84ebd19e49928794870c3a854a669f9d59934d976106864aa3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604143de629489bea07ca21444a26de6eded283d09f59300a06082a8648ce3d0403030368003065023100e56912c96edbc631ba0941e197f8fbfd9ae27d12c9ed7c64d3cb05258b56d9a0e75e5d4e0b839c5b7629a00926216a62023071d2b58f5cea3be1780985a875923bc85cfd48ef0d7422a808e26ec549cec70cbca76169f1f73be12acbf92bf3669037 bf4c99f8 - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 4216 bf4c99f8 4216 bf4c99f8 4216 bf4c99f8 4216 bf4c99f8 4216 bf4c99f8 4216 bf4c99f8 4216 bf4c99f8 4216 bf4c99f8 4216 bf4c99f8 4216 bf4c99f8 4216 bf4c99f8 4216 bf4c99f8 2132 a9769c41074f93c3a874752474be7ab87d52e58c36ad27bc73b6f8acf2639119.exe 2132 a9769c41074f93c3a874752474be7ab87d52e58c36ad27bc73b6f8acf2639119.exe 2132 a9769c41074f93c3a874752474be7ab87d52e58c36ad27bc73b6f8acf2639119.exe 2132 a9769c41074f93c3a874752474be7ab87d52e58c36ad27bc73b6f8acf2639119.exe 2132 a9769c41074f93c3a874752474be7ab87d52e58c36ad27bc73b6f8acf2639119.exe 2132 a9769c41074f93c3a874752474be7ab87d52e58c36ad27bc73b6f8acf2639119.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2132 a9769c41074f93c3a874752474be7ab87d52e58c36ad27bc73b6f8acf2639119.exe Token: SeTcbPrivilege 2132 a9769c41074f93c3a874752474be7ab87d52e58c36ad27bc73b6f8acf2639119.exe Token: SeDebugPrivilege 4216 bf4c99f8 Token: SeTcbPrivilege 4216 bf4c99f8
Processes
-
C:\Users\Admin\AppData\Local\Temp\a9769c41074f93c3a874752474be7ab87d52e58c36ad27bc73b6f8acf2639119.exe"C:\Users\Admin\AppData\Local\Temp\a9769c41074f93c3a874752474be7ab87d52e58c36ad27bc73b6f8acf2639119.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2132
-
C:\Windows\Syswow64\bf4c99f8C:\Windows\Syswow64\bf4c99f81⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4216
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\bf4c99f8
- Size 1.1MB
- SHA256 758af8ec6d1b1606368d8ea950f54ceab80c959e59a1f834488c638120e5abb5
- MD5 a9a1e2a4abc6cba938b2627cb6b115a1
- SHA1 a1dc12a3195739aca5bcebb20375ee365af1c4d6
- SHA512 f63f2cadd59a1942fa36583c1f0df9874a61dfa21b0df196a25be0d300750028aded92b82a6cc5c598cc15149b6279655acd7c8facde5d765aec67aa48e3a2b8
- SSDEEP 24576:vvO2xJKRI2dOkx2LFAAX1oOYSY82e5QPJJOgufWWsYo:vHHKO2FQd1oOU82lPJ6Po
- TLSH T1CF359D12F7A1C072C8A7427448B6C36EA675BC152B214BCBB7C03B5E5E723D1AE36359
- MD5 SHA1 SHA512 SSDEEP TLSH