Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/08/2026, 03:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
691f60e2f71a49f4a17f38f6f98e9b6c894b8478ed4d794e04fcee9c21313ad7.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
691f60e2f71a49f4a17f38f6f98e9b6c894b8478ed4d794e04fcee9c21313ad7.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 691f60e2f71a49f4a17f38f6f98e9b6c894b8478ed4d794e04fcee9c21313ad7.exe
- Size 1.7MB
- Sample260818-dkf3csdl3y
- SHA256 691f60e2f71a49f4a17f38f6f98e9b6c894b8478ed4d794e04fcee9c21313ad7
- MD5 015293fec62a193510485a7d6fda573b
- SHA1 94b395b09d6dcde229c44c1d3a28c22b4e149019
- SHA512 f3cd38a5cd84e91c5995ea57c9ed9c223a7d01c5743bcce54e3b67045d4f8d63b3b8a6ee5d05e36c4fa77ea5af9587a25a82d1e056aebef152fa4b5f6fcae7f1
- SSDEEP 24576:vvO2xJKRI2FOkx2LFEWcUQPxuZ98Es8k3OH3C0rQ6+8pKJJFo3Q+qdCOKIbAI:vHHKO29Qr5QZuTtS0rQMYOQ+q8CEI
- TLSH T19A858E21B351C036D4AB05758ABA47AE9578BC310B2551C7B3C47B7E6FB22D2AE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4600 75276442 - Unexpected DNS network traffic destination 18 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 90 114.114.114.114 4600 75276442 Destination IP 98 223.5.5.5 2912 691f60e2f71a49f4a17f38f6f98e9b6c894b8478ed4d794e04fcee9c21313ad7.exe Destination IP 231 114.114.114.114 2912 691f60e2f71a49f4a17f38f6f98e9b6c894b8478ed4d794e04fcee9c21313ad7.exe Destination IP 1 114.114.114.114 2912 691f60e2f71a49f4a17f38f6f98e9b6c894b8478ed4d794e04fcee9c21313ad7.exe Destination IP 160 114.114.114.114 2912 691f60e2f71a49f4a17f38f6f98e9b6c894b8478ed4d794e04fcee9c21313ad7.exe Destination IP 161 223.5.5.5 2912 691f60e2f71a49f4a17f38f6f98e9b6c894b8478ed4d794e04fcee9c21313ad7.exe Destination IP 319 223.5.5.5 2912 691f60e2f71a49f4a17f38f6f98e9b6c894b8478ed4d794e04fcee9c21313ad7.exe Destination IP 2 223.5.5.5 2912 691f60e2f71a49f4a17f38f6f98e9b6c894b8478ed4d794e04fcee9c21313ad7.exe Destination IP 35 114.114.114.114 2912 691f60e2f71a49f4a17f38f6f98e9b6c894b8478ed4d794e04fcee9c21313ad7.exe Destination IP 36 223.5.5.5 2912 691f60e2f71a49f4a17f38f6f98e9b6c894b8478ed4d794e04fcee9c21313ad7.exe Destination IP 97 114.114.114.114 2912 691f60e2f71a49f4a17f38f6f98e9b6c894b8478ed4d794e04fcee9c21313ad7.exe Destination IP 232 223.5.5.5 2912 691f60e2f71a49f4a17f38f6f98e9b6c894b8478ed4d794e04fcee9c21313ad7.exe Destination IP 289 223.5.5.5 2912 691f60e2f71a49f4a17f38f6f98e9b6c894b8478ed4d794e04fcee9c21313ad7.exe Destination IP 91 223.5.5.5 2912 691f60e2f71a49f4a17f38f6f98e9b6c894b8478ed4d794e04fcee9c21313ad7.exe Destination IP 288 114.114.114.114 2912 691f60e2f71a49f4a17f38f6f98e9b6c894b8478ed4d794e04fcee9c21313ad7.exe Destination IP 318 114.114.114.114 2912 691f60e2f71a49f4a17f38f6f98e9b6c894b8478ed4d794e04fcee9c21313ad7.exe Destination IP 372 114.114.114.114 2912 691f60e2f71a49f4a17f38f6f98e9b6c894b8478ed4d794e04fcee9c21313ad7.exe Destination IP 373 223.5.5.5 2912 691f60e2f71a49f4a17f38f6f98e9b6c894b8478ed4d794e04fcee9c21313ad7.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 75276442 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 75276442 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 75276442 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 75276442 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 75276442 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 75276442 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 75276442 File created C:\Windows\SysWOW64\75276442 691f60e2f71a49f4a17f38f6f98e9b6c894b8478ed4d794e04fcee9c21313ad7.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 75276442 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 75276442 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 75276442 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 75276442 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 75276442 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 75276442 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 75276442 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\4ec0f0 75276442 File opened for modification C:\Windows\31dac0 691f60e2f71a49f4a17f38f6f98e9b6c894b8478ed4d794e04fcee9c21313ad7.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 691f60e2f71a49f4a17f38f6f98e9b6c894b8478ed4d794e04fcee9c21313ad7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 75276442 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 75276442 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 75276442 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 75276442 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 75276442 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 75276442 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 75276442 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 75276442 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 75276442 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 75276442 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 4600 75276442 4600 75276442 4600 75276442 4600 75276442 4600 75276442 4600 75276442 4600 75276442 4600 75276442 2912 691f60e2f71a49f4a17f38f6f98e9b6c894b8478ed4d794e04fcee9c21313ad7.exe 2912 691f60e2f71a49f4a17f38f6f98e9b6c894b8478ed4d794e04fcee9c21313ad7.exe 2912 691f60e2f71a49f4a17f38f6f98e9b6c894b8478ed4d794e04fcee9c21313ad7.exe 2912 691f60e2f71a49f4a17f38f6f98e9b6c894b8478ed4d794e04fcee9c21313ad7.exe 2912 691f60e2f71a49f4a17f38f6f98e9b6c894b8478ed4d794e04fcee9c21313ad7.exe 2912 691f60e2f71a49f4a17f38f6f98e9b6c894b8478ed4d794e04fcee9c21313ad7.exe 2912 691f60e2f71a49f4a17f38f6f98e9b6c894b8478ed4d794e04fcee9c21313ad7.exe 2912 691f60e2f71a49f4a17f38f6f98e9b6c894b8478ed4d794e04fcee9c21313ad7.exe 2912 691f60e2f71a49f4a17f38f6f98e9b6c894b8478ed4d794e04fcee9c21313ad7.exe 2912 691f60e2f71a49f4a17f38f6f98e9b6c894b8478ed4d794e04fcee9c21313ad7.exe 2912 691f60e2f71a49f4a17f38f6f98e9b6c894b8478ed4d794e04fcee9c21313ad7.exe 2912 691f60e2f71a49f4a17f38f6f98e9b6c894b8478ed4d794e04fcee9c21313ad7.exe 2912 691f60e2f71a49f4a17f38f6f98e9b6c894b8478ed4d794e04fcee9c21313ad7.exe 2912 691f60e2f71a49f4a17f38f6f98e9b6c894b8478ed4d794e04fcee9c21313ad7.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2912 691f60e2f71a49f4a17f38f6f98e9b6c894b8478ed4d794e04fcee9c21313ad7.exe Token: SeTcbPrivilege 2912 691f60e2f71a49f4a17f38f6f98e9b6c894b8478ed4d794e04fcee9c21313ad7.exe Token: SeDebugPrivilege 4600 75276442 Token: SeTcbPrivilege 4600 75276442
Processes
-
C:\Users\Admin\AppData\Local\Temp\691f60e2f71a49f4a17f38f6f98e9b6c894b8478ed4d794e04fcee9c21313ad7.exe"C:\Users\Admin\AppData\Local\Temp\691f60e2f71a49f4a17f38f6f98e9b6c894b8478ed4d794e04fcee9c21313ad7.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2912
-
C:\Windows\Syswow64\75276442C:\Windows\Syswow64\752764421⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4600
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\75276442
- Size 1.7MB
- SHA256 fa71f41b55763243c8307587b78bfc0a01e6cde9f3443b2c5286c30c030511e6
- MD5 e84f06b2b196013d0dc9e41b7d3a7a48
- SHA1 55d4ea50dd8c46a4b009236789a19af100daba97
- SHA512 f28608d701bf73b180e2c5f6cc7edf1188328e4af25e10b762776590638aeb12a5a60de04d7347ef836bd9d857d49e0c6a7dcd1d0d0fae2b5c13d9578cde6abe
- SSDEEP 24576:/vO2xJKRI2FOkx2LFEWcUQPxuZ98Es8k3OH3C0rQ6+8pKJJFo3Q+qdCOKIbAI:/HHKO29Qr5QZuTtS0rQMYOQ+q8CEI
- TLSH T1DB858E21B351C036D4AB05758ABA47AE9578BC310B2551C7B3C47B7E6FB22D2AE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH