Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/08/2026, 04:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
56b690a9b07a4b472130fba4ab84517eea35b98e7cc9eaa10ffe0d64b9cfd503.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
56b690a9b07a4b472130fba4ab84517eea35b98e7cc9eaa10ffe0d64b9cfd503.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 56b690a9b07a4b472130fba4ab84517eea35b98e7cc9eaa10ffe0d64b9cfd503.exe
- Size 395KB
- Sample260818-enb39afc64
- SHA256 56b690a9b07a4b472130fba4ab84517eea35b98e7cc9eaa10ffe0d64b9cfd503
- MD5 a06dd4f57c391aa0251bbf3b380eefa1
- SHA1 ce1f82e284714fab3d5a3f9d941955a2983ecd37
- SHA512 8380992bd3bbfe2a0580acd358bac838aff0ea494365ea08f09c12faa8bc7bae4007ea0a8248787bad4391c302107240c443943ca780c3f8c176e25a9fb49c49
- SSDEEP 6144:eWVrC1c2oonALgPLj7vfFLKlOIFGcEOkCybEaQRXr9HNdvOaxy8K:ekCO2zVPX7vfFLKlwOkx2LIaxy
- TLSH T17F846B2AB6A0D036C4779574C4A257AAFFB1B42237204ACFA390475A1F237E2BD7531D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4564 539cd759 - Unexpected DNS network traffic destination 16 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 82 114.114.114.114 2572 56b690a9b07a4b472130fba4ab84517eea35b98e7cc9eaa10ffe0d64b9cfd503.exe Destination IP 140 223.5.5.5 2572 56b690a9b07a4b472130fba4ab84517eea35b98e7cc9eaa10ffe0d64b9cfd503.exe Destination IP 317 223.5.5.5 2572 56b690a9b07a4b472130fba4ab84517eea35b98e7cc9eaa10ffe0d64b9cfd503.exe Destination IP 41 223.5.5.5 2572 56b690a9b07a4b472130fba4ab84517eea35b98e7cc9eaa10ffe0d64b9cfd503.exe Destination IP 230 114.114.114.114 2572 56b690a9b07a4b472130fba4ab84517eea35b98e7cc9eaa10ffe0d64b9cfd503.exe Destination IP 287 223.5.5.5 2572 56b690a9b07a4b472130fba4ab84517eea35b98e7cc9eaa10ffe0d64b9cfd503.exe Destination IP 1 114.114.114.114 2572 56b690a9b07a4b472130fba4ab84517eea35b98e7cc9eaa10ffe0d64b9cfd503.exe Destination IP 40 114.114.114.114 2572 56b690a9b07a4b472130fba4ab84517eea35b98e7cc9eaa10ffe0d64b9cfd503.exe Destination IP 111 114.114.114.114 4564 539cd759 Destination IP 119 223.5.5.5 2572 56b690a9b07a4b472130fba4ab84517eea35b98e7cc9eaa10ffe0d64b9cfd503.exe Destination IP 138 114.114.114.114 2572 56b690a9b07a4b472130fba4ab84517eea35b98e7cc9eaa10ffe0d64b9cfd503.exe Destination IP 231 223.5.5.5 2572 56b690a9b07a4b472130fba4ab84517eea35b98e7cc9eaa10ffe0d64b9cfd503.exe Destination IP 316 114.114.114.114 2572 56b690a9b07a4b472130fba4ab84517eea35b98e7cc9eaa10ffe0d64b9cfd503.exe Destination IP 3 223.5.5.5 2572 56b690a9b07a4b472130fba4ab84517eea35b98e7cc9eaa10ffe0d64b9cfd503.exe Destination IP 83 223.5.5.5 2572 56b690a9b07a4b472130fba4ab84517eea35b98e7cc9eaa10ffe0d64b9cfd503.exe Destination IP 286 114.114.114.114 2572 56b690a9b07a4b472130fba4ab84517eea35b98e7cc9eaa10ffe0d64b9cfd503.exe - Drops file in System32 directory 13 IoCs
description ioc Process File created C:\Windows\SysWOW64\539cd759 56b690a9b07a4b472130fba4ab84517eea35b98e7cc9eaa10ffe0d64b9cfd503.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 539cd759 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 539cd759 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 539cd759 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 539cd759 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 539cd759 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 539cd759 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 539cd759 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 539cd759 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 539cd759 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 539cd759 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 539cd759 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 539cd759 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\2c0898 56b690a9b07a4b472130fba4ab84517eea35b98e7cc9eaa10ffe0d64b9cfd503.exe File opened for modification C:\Windows\4e2328 539cd759 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 56b690a9b07a4b472130fba4ab84517eea35b98e7cc9eaa10ffe0d64b9cfd503.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 539cd759 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 539cd759 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 539cd759 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 539cd759 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 539cd759 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 539cd759 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 539cd759 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 539cd759 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 539cd759 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 539cd759 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 4564 539cd759 4564 539cd759 4564 539cd759 4564 539cd759 4564 539cd759 4564 539cd759 4564 539cd759 4564 539cd759 2572 56b690a9b07a4b472130fba4ab84517eea35b98e7cc9eaa10ffe0d64b9cfd503.exe 2572 56b690a9b07a4b472130fba4ab84517eea35b98e7cc9eaa10ffe0d64b9cfd503.exe 2572 56b690a9b07a4b472130fba4ab84517eea35b98e7cc9eaa10ffe0d64b9cfd503.exe 2572 56b690a9b07a4b472130fba4ab84517eea35b98e7cc9eaa10ffe0d64b9cfd503.exe 2572 56b690a9b07a4b472130fba4ab84517eea35b98e7cc9eaa10ffe0d64b9cfd503.exe 2572 56b690a9b07a4b472130fba4ab84517eea35b98e7cc9eaa10ffe0d64b9cfd503.exe 2572 56b690a9b07a4b472130fba4ab84517eea35b98e7cc9eaa10ffe0d64b9cfd503.exe 2572 56b690a9b07a4b472130fba4ab84517eea35b98e7cc9eaa10ffe0d64b9cfd503.exe 2572 56b690a9b07a4b472130fba4ab84517eea35b98e7cc9eaa10ffe0d64b9cfd503.exe 2572 56b690a9b07a4b472130fba4ab84517eea35b98e7cc9eaa10ffe0d64b9cfd503.exe 2572 56b690a9b07a4b472130fba4ab84517eea35b98e7cc9eaa10ffe0d64b9cfd503.exe 2572 56b690a9b07a4b472130fba4ab84517eea35b98e7cc9eaa10ffe0d64b9cfd503.exe 2572 56b690a9b07a4b472130fba4ab84517eea35b98e7cc9eaa10ffe0d64b9cfd503.exe 2572 56b690a9b07a4b472130fba4ab84517eea35b98e7cc9eaa10ffe0d64b9cfd503.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2572 56b690a9b07a4b472130fba4ab84517eea35b98e7cc9eaa10ffe0d64b9cfd503.exe Token: SeTcbPrivilege 2572 56b690a9b07a4b472130fba4ab84517eea35b98e7cc9eaa10ffe0d64b9cfd503.exe Token: SeDebugPrivilege 4564 539cd759 Token: SeTcbPrivilege 4564 539cd759
Processes
-
C:\Users\Admin\AppData\Local\Temp\56b690a9b07a4b472130fba4ab84517eea35b98e7cc9eaa10ffe0d64b9cfd503.exe"C:\Users\Admin\AppData\Local\Temp\56b690a9b07a4b472130fba4ab84517eea35b98e7cc9eaa10ffe0d64b9cfd503.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2572
-
C:\Windows\Syswow64\539cd759C:\Windows\Syswow64\539cd7591⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4564
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\539cd759
- Size 395KB
- SHA256 b1656b0cf94ea621a7a1a96e0820a1f3e998107be33ffdbc478cd5666fc727ea
- MD5 8ac8bd870b44eab053b3b58151b9fcdc
- SHA1 0f5eba182fd49a6a87bd841265dd8aa20453db08
- SHA512 975941b1496a520624d9c8b0f2e5675584d5a6f6ce2a69499042c47228bb40917f0c6dc57773142f715622c97d545127a63f115db01f7f4cbf9eae1cb738665d
- SSDEEP 6144:uWVrC1c2oonALgPLj7vfFLKlOIFGcEOkCybEaQRXr9HNdvOaxy8K:ukCO2zVPX7vfFLKlwOkx2LIaxy
- TLSH T14E846B2AB6A0D036C4779574C4A257AAFFB1B42237204ACFA390475A1F237E2BD7531D
- MD5 SHA1 SHA512 SSDEEP TLSH