Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
18/08/2026, 06:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
65d11488a573496cda8ce21f16a2ccf69c64809c7e7deb65a5dfee001922ac7a.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
65d11488a573496cda8ce21f16a2ccf69c64809c7e7deb65a5dfee001922ac7a.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 65d11488a573496cda8ce21f16a2ccf69c64809c7e7deb65a5dfee001922ac7a.exe
- Size 743KB
- Sample260818-hpkcssxhpf
- SHA256 65d11488a573496cda8ce21f16a2ccf69c64809c7e7deb65a5dfee001922ac7a
- MD5 f5bd9bf548f75d525710a387d0e2e9a4
- SHA1 cf01d6d5d26ba3cdf9f7b49747d38a6d31fd1e98
- SHA512 c5928faa7d8285f634c4e766ffe075bd4054b581f3fddc2e2ec9e1cec38ff0ae910318d44ac77302f0e11862eadeb2fb178bedeb89cc3f865d006af84a861a08
- SSDEEP 12288:ASvO2x9mONvKRILSFnOkx2LIaxya5FAQjU/LikG8:bvO2xJKRI2FOkx2LFEvcU68
- TLSH T1DFF45A31E2418036D5B34576C6FA0BBFB5647D25131165CBA3C8BA262FB36D2BA3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1108 d4099a82 - Unexpected DNS network traffic destination 16 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 164 114.114.114.114 5080 65d11488a573496cda8ce21f16a2ccf69c64809c7e7deb65a5dfee001922ac7a.exe Destination IP 332 114.114.114.114 5080 65d11488a573496cda8ce21f16a2ccf69c64809c7e7deb65a5dfee001922ac7a.exe Destination IP 333 223.5.5.5 5080 65d11488a573496cda8ce21f16a2ccf69c64809c7e7deb65a5dfee001922ac7a.exe Destination IP 363 114.114.114.114 5080 65d11488a573496cda8ce21f16a2ccf69c64809c7e7deb65a5dfee001922ac7a.exe Destination IP 146 114.114.114.114 1108 d4099a82 Destination IP 3 114.114.114.114 5080 65d11488a573496cda8ce21f16a2ccf69c64809c7e7deb65a5dfee001922ac7a.exe Destination IP 5 223.5.5.5 5080 65d11488a573496cda8ce21f16a2ccf69c64809c7e7deb65a5dfee001922ac7a.exe Destination IP 51 223.5.5.5 5080 65d11488a573496cda8ce21f16a2ccf69c64809c7e7deb65a5dfee001922ac7a.exe Destination IP 266 223.5.5.5 5080 65d11488a573496cda8ce21f16a2ccf69c64809c7e7deb65a5dfee001922ac7a.exe Destination IP 364 223.5.5.5 5080 65d11488a573496cda8ce21f16a2ccf69c64809c7e7deb65a5dfee001922ac7a.exe Destination IP 50 114.114.114.114 5080 65d11488a573496cda8ce21f16a2ccf69c64809c7e7deb65a5dfee001922ac7a.exe Destination IP 98 114.114.114.114 5080 65d11488a573496cda8ce21f16a2ccf69c64809c7e7deb65a5dfee001922ac7a.exe Destination IP 100 223.5.5.5 5080 65d11488a573496cda8ce21f16a2ccf69c64809c7e7deb65a5dfee001922ac7a.exe Destination IP 153 223.5.5.5 5080 65d11488a573496cda8ce21f16a2ccf69c64809c7e7deb65a5dfee001922ac7a.exe Destination IP 165 223.5.5.5 5080 65d11488a573496cda8ce21f16a2ccf69c64809c7e7deb65a5dfee001922ac7a.exe Destination IP 265 114.114.114.114 5080 65d11488a573496cda8ce21f16a2ccf69c64809c7e7deb65a5dfee001922ac7a.exe - Drops file in System32 directory 13 IoCs
description ioc Process File created C:\Windows\SysWOW64\d4099a82 65d11488a573496cda8ce21f16a2ccf69c64809c7e7deb65a5dfee001922ac7a.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE d4099a82 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies d4099a82 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft d4099a82 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache d4099a82 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData d4099a82 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 d4099a82 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content d4099a82 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 d4099a82 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 d4099a82 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 d4099a82 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 d4099a82 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 d4099a82 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\12f828 d4099a82 File opened for modification C:\Windows\56f8b0 65d11488a573496cda8ce21f16a2ccf69c64809c7e7deb65a5dfee001922ac7a.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65d11488a573496cda8ce21f16a2ccf69c64809c7e7deb65a5dfee001922ac7a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d4099a82 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" d4099a82 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing d4099a82 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" d4099a82 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" d4099a82 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix d4099a82 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" d4099a82 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ d4099a82 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" d4099a82 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" d4099a82 - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 1108 d4099a82 1108 d4099a82 1108 d4099a82 1108 d4099a82 1108 d4099a82 1108 d4099a82 1108 d4099a82 1108 d4099a82 5080 65d11488a573496cda8ce21f16a2ccf69c64809c7e7deb65a5dfee001922ac7a.exe 5080 65d11488a573496cda8ce21f16a2ccf69c64809c7e7deb65a5dfee001922ac7a.exe 5080 65d11488a573496cda8ce21f16a2ccf69c64809c7e7deb65a5dfee001922ac7a.exe 5080 65d11488a573496cda8ce21f16a2ccf69c64809c7e7deb65a5dfee001922ac7a.exe 5080 65d11488a573496cda8ce21f16a2ccf69c64809c7e7deb65a5dfee001922ac7a.exe 5080 65d11488a573496cda8ce21f16a2ccf69c64809c7e7deb65a5dfee001922ac7a.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 5080 65d11488a573496cda8ce21f16a2ccf69c64809c7e7deb65a5dfee001922ac7a.exe Token: SeTcbPrivilege 5080 65d11488a573496cda8ce21f16a2ccf69c64809c7e7deb65a5dfee001922ac7a.exe Token: SeDebugPrivilege 1108 d4099a82 Token: SeTcbPrivilege 1108 d4099a82
Processes
-
C:\Users\Admin\AppData\Local\Temp\65d11488a573496cda8ce21f16a2ccf69c64809c7e7deb65a5dfee001922ac7a.exe"C:\Users\Admin\AppData\Local\Temp\65d11488a573496cda8ce21f16a2ccf69c64809c7e7deb65a5dfee001922ac7a.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5080
-
C:\Windows\Syswow64\d4099a82C:\Windows\Syswow64\d4099a821⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1108
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\d4099a82
- Size 743KB
- SHA256 8325f99b4f648264895feb3b2ead3cfc9b82831af3d4262849d1d366e881f1b6
- MD5 7061aee3fc8a4bd5e997087d08c3b5cd
- SHA1 6a67c6566db23c36a62da53ff147963c8bf6cf73
- SHA512 b812ff12f98620881d1d5969a9952513fcfe1c07ce4a30eb3e5bbd1aad6e1a6662292680ed17e580094d5f5e0de79e632f762e2493116179409aa38b3104e0ac
- SSDEEP 12288:3SvO2x9mONvKRILSFnOkx2LIaxya5FAQjU/LikG8:CvO2xJKRI2FOkx2LFEvcU68
- TLSH T141F45A31E2418036D5B34576C6FA0BBFB5647D25131165CBA3C8BA262FB36D2BA3170E
- MD5 SHA1 SHA512 SSDEEP TLSH