Analysis
- max time kernel
148s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/08/2026, 03:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7fa17a90ad41c99a6075dcb0c38e09553c8bcda3d9d2581631d3f4c4206fc655.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
7fa17a90ad41c99a6075dcb0c38e09553c8bcda3d9d2581631d3f4c4206fc655.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 7fa17a90ad41c99a6075dcb0c38e09553c8bcda3d9d2581631d3f4c4206fc655.exe
- Size 1.7MB
- Sample260818-dkvkravdmd
- SHA256 7fa17a90ad41c99a6075dcb0c38e09553c8bcda3d9d2581631d3f4c4206fc655
- MD5 53d1dd678d95444eb33e7df25d21820e
- SHA1 0c571131ec9958b6fd1269b4772d1b7903552320
- SHA512 4dd522a9096ccfec58f8a977b9016e16f1041c30155b4072e13b1559bc68147c3727054d434aa92d9a4819cc249b222b1836598d26fbfced4410f3c538ad7fcf
- SSDEEP 24576:1vO2xJKRI2FOkx2LFEWcUQPxuZ98Es8k3OH3C0rQ6+8pKJJFo3Q+qdCOKIbAI:1HHKO29Qr5QZuTtS0rQMYOQ+q8CEI
- TLSH T174858E21B351C036D4AB05758ABA47AE9578BC310B2551C7B3C47B7E6FB22D2AE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5272 b8004938 - Unexpected DNS network traffic destination 10 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 164 114.114.114.114 1012 7fa17a90ad41c99a6075dcb0c38e09553c8bcda3d9d2581631d3f4c4206fc655.exe Destination IP 165 223.5.5.5 1012 7fa17a90ad41c99a6075dcb0c38e09553c8bcda3d9d2581631d3f4c4206fc655.exe Destination IP 1 114.114.114.114 1012 7fa17a90ad41c99a6075dcb0c38e09553c8bcda3d9d2581631d3f4c4206fc655.exe Destination IP 42 223.5.5.5 1012 7fa17a90ad41c99a6075dcb0c38e09553c8bcda3d9d2581631d3f4c4206fc655.exe Destination IP 45 223.5.5.5 1012 7fa17a90ad41c99a6075dcb0c38e09553c8bcda3d9d2581631d3f4c4206fc655.exe Destination IP 105 114.114.114.114 1012 7fa17a90ad41c99a6075dcb0c38e09553c8bcda3d9d2581631d3f4c4206fc655.exe Destination IP 108 223.5.5.5 1012 7fa17a90ad41c99a6075dcb0c38e09553c8bcda3d9d2581631d3f4c4206fc655.exe Destination IP 7 223.5.5.5 1012 7fa17a90ad41c99a6075dcb0c38e09553c8bcda3d9d2581631d3f4c4206fc655.exe Destination IP 40 114.114.114.114 1012 7fa17a90ad41c99a6075dcb0c38e09553c8bcda3d9d2581631d3f4c4206fc655.exe Destination IP 41 114.114.114.114 1012 7fa17a90ad41c99a6075dcb0c38e09553c8bcda3d9d2581631d3f4c4206fc655.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 b8004938 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 b8004938 File created C:\Windows\SysWOW64\b8004938 7fa17a90ad41c99a6075dcb0c38e09553c8bcda3d9d2581631d3f4c4206fc655.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 b8004938 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE b8004938 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache b8004938 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData b8004938 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content b8004938 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 b8004938 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies b8004938 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 b8004938 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft b8004938 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 b8004938 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\5a4230 b8004938 File opened for modification C:\Windows\115368 7fa17a90ad41c99a6075dcb0c38e09553c8bcda3d9d2581631d3f4c4206fc655.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7fa17a90ad41c99a6075dcb0c38e09553c8bcda3d9d2581631d3f4c4206fc655.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b8004938 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix b8004938 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" b8004938 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ b8004938 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" b8004938 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" b8004938 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" b8004938 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" b8004938 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" b8004938 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing b8004938 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 5272 b8004938 5272 b8004938 5272 b8004938 5272 b8004938 5272 b8004938 5272 b8004938 5272 b8004938 5272 b8004938 1012 7fa17a90ad41c99a6075dcb0c38e09553c8bcda3d9d2581631d3f4c4206fc655.exe 1012 7fa17a90ad41c99a6075dcb0c38e09553c8bcda3d9d2581631d3f4c4206fc655.exe 1012 7fa17a90ad41c99a6075dcb0c38e09553c8bcda3d9d2581631d3f4c4206fc655.exe 1012 7fa17a90ad41c99a6075dcb0c38e09553c8bcda3d9d2581631d3f4c4206fc655.exe 1012 7fa17a90ad41c99a6075dcb0c38e09553c8bcda3d9d2581631d3f4c4206fc655.exe 1012 7fa17a90ad41c99a6075dcb0c38e09553c8bcda3d9d2581631d3f4c4206fc655.exe 1012 7fa17a90ad41c99a6075dcb0c38e09553c8bcda3d9d2581631d3f4c4206fc655.exe 1012 7fa17a90ad41c99a6075dcb0c38e09553c8bcda3d9d2581631d3f4c4206fc655.exe 1012 7fa17a90ad41c99a6075dcb0c38e09553c8bcda3d9d2581631d3f4c4206fc655.exe 1012 7fa17a90ad41c99a6075dcb0c38e09553c8bcda3d9d2581631d3f4c4206fc655.exe 1012 7fa17a90ad41c99a6075dcb0c38e09553c8bcda3d9d2581631d3f4c4206fc655.exe 1012 7fa17a90ad41c99a6075dcb0c38e09553c8bcda3d9d2581631d3f4c4206fc655.exe 1012 7fa17a90ad41c99a6075dcb0c38e09553c8bcda3d9d2581631d3f4c4206fc655.exe 1012 7fa17a90ad41c99a6075dcb0c38e09553c8bcda3d9d2581631d3f4c4206fc655.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1012 7fa17a90ad41c99a6075dcb0c38e09553c8bcda3d9d2581631d3f4c4206fc655.exe Token: SeTcbPrivilege 1012 7fa17a90ad41c99a6075dcb0c38e09553c8bcda3d9d2581631d3f4c4206fc655.exe Token: SeDebugPrivilege 5272 b8004938 Token: SeTcbPrivilege 5272 b8004938
Processes
-
C:\Users\Admin\AppData\Local\Temp\7fa17a90ad41c99a6075dcb0c38e09553c8bcda3d9d2581631d3f4c4206fc655.exe"C:\Users\Admin\AppData\Local\Temp\7fa17a90ad41c99a6075dcb0c38e09553c8bcda3d9d2581631d3f4c4206fc655.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1012
-
C:\Windows\Syswow64\b8004938C:\Windows\Syswow64\b80049381⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5272
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\b8004938
- Size 1.7MB
- SHA256 c3fba139eeeacc0233d98689a40bc03bb6db1fbaa40e20d7f92f67d140521239
- MD5 fe60c8013e1b39c491200bb01d026548
- SHA1 79dde229fbc4a5491543d2d0008f176b6fb97ae9
- SHA512 3a5733e8b82d954981008749b9eb331fef1adf3dfbd71ec1b3da1672671c3f6642a836b6a3be8682407c37b6267385e76b64d46c3165a347e2a4ccc221c1a4a9
- SSDEEP 24576:dvO2xJKRI2FOkx2LFEWcUQPxuZ98Es8k3OH3C0rQ6+8pKJJFo3Q+qdCOKIbAI:dHHKO29Qr5QZuTtS0rQMYOQ+q8CEI
- TLSH T1CF858E21B351C036D4AB05758ABA47AE9578BC310B2551C7B3C47B7E6FB22D2AE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH