Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
18/08/2026, 19:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
756dab7f9a1da7cb978a12bbe668862178472aacdf0e4540e2998d11d88f8fa1.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
756dab7f9a1da7cb978a12bbe668862178472aacdf0e4540e2998d11d88f8fa1.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 756dab7f9a1da7cb978a12bbe668862178472aacdf0e4540e2998d11d88f8fa1.exe
- Size 511KB
- Sample260818-yjgbysyhmb
- SHA256 756dab7f9a1da7cb978a12bbe668862178472aacdf0e4540e2998d11d88f8fa1
- MD5 3a4ae07696e83486bde9e127e48b3820
- SHA1 e1990c7f180defaeaa5e8ec5706f6437792e1b45
- SHA512 4e7bcad0f2728f76d0b0fa6c6bdfc855bb645f0a87b5a557c136824f0f9260c6f45d9e936b0139888712b4da7cea1976435ce50ffbdb0ed0720410eb207b40b9
- SSDEEP 6144:AcTgav1cdCTuoPbgwmOLJvKRILSFvdFDcEOkCybEaQRXr9HNdvOax5Rv0:ASvO2x9mONvKRILSFnOkx2LIax5F0
- TLSH T137B45C26F6908036C4B34575C5F64BAAFAB4BC21631156CBA3943A6A1F737D2BD3130E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3688 ddad2b99 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 4 223.5.5.5 4940 756dab7f9a1da7cb978a12bbe668862178472aacdf0e4540e2998d11d88f8fa1.exe Destination IP 31 114.114.114.114 4940 756dab7f9a1da7cb978a12bbe668862178472aacdf0e4540e2998d11d88f8fa1.exe Destination IP 32 223.5.5.5 4940 756dab7f9a1da7cb978a12bbe668862178472aacdf0e4540e2998d11d88f8fa1.exe Destination IP 3 114.114.114.114 4940 756dab7f9a1da7cb978a12bbe668862178472aacdf0e4540e2998d11d88f8fa1.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 ddad2b99 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies ddad2b99 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft ddad2b99 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData ddad2b99 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AAD646CB44373074ADE741C38400E7E1 ddad2b99 File created C:\Windows\SysWOW64\ddad2b99 756dab7f9a1da7cb978a12bbe668862178472aacdf0e4540e2998d11d88f8fa1.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 ddad2b99 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 ddad2b99 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content ddad2b99 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 ddad2b99 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AAD646CB44373074ADE741C38400E7E1 ddad2b99 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 ddad2b99 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE ddad2b99 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache ddad2b99 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 ddad2b99 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\3f23d0 ddad2b99 File opened for modification C:\Windows\549318 756dab7f9a1da7cb978a12bbe668862178472aacdf0e4540e2998d11d88f8fa1.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 756dab7f9a1da7cb978a12bbe668862178472aacdf0e4540e2998d11d88f8fa1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddad2b99 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" ddad2b99 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ddad2b99 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ddad2b99 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix ddad2b99 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" ddad2b99 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ddad2b99 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ddad2b99 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ddad2b99 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing ddad2b99 - Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 3688 ddad2b99 3688 ddad2b99 3688 ddad2b99 3688 ddad2b99 3688 ddad2b99 3688 ddad2b99 3688 ddad2b99 3688 ddad2b99 3688 ddad2b99 3688 ddad2b99 3688 ddad2b99 3688 ddad2b99 3688 ddad2b99 3688 ddad2b99 3688 ddad2b99 3688 ddad2b99 3688 ddad2b99 3688 ddad2b99 3688 ddad2b99 3688 ddad2b99 4940 756dab7f9a1da7cb978a12bbe668862178472aacdf0e4540e2998d11d88f8fa1.exe 4940 756dab7f9a1da7cb978a12bbe668862178472aacdf0e4540e2998d11d88f8fa1.exe 4940 756dab7f9a1da7cb978a12bbe668862178472aacdf0e4540e2998d11d88f8fa1.exe 4940 756dab7f9a1da7cb978a12bbe668862178472aacdf0e4540e2998d11d88f8fa1.exe 4940 756dab7f9a1da7cb978a12bbe668862178472aacdf0e4540e2998d11d88f8fa1.exe 4940 756dab7f9a1da7cb978a12bbe668862178472aacdf0e4540e2998d11d88f8fa1.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4940 756dab7f9a1da7cb978a12bbe668862178472aacdf0e4540e2998d11d88f8fa1.exe Token: SeTcbPrivilege 4940 756dab7f9a1da7cb978a12bbe668862178472aacdf0e4540e2998d11d88f8fa1.exe Token: SeDebugPrivilege 3688 ddad2b99 Token: SeTcbPrivilege 3688 ddad2b99
Processes
-
C:\Users\Admin\AppData\Local\Temp\756dab7f9a1da7cb978a12bbe668862178472aacdf0e4540e2998d11d88f8fa1.exe"C:\Users\Admin\AppData\Local\Temp\756dab7f9a1da7cb978a12bbe668862178472aacdf0e4540e2998d11d88f8fa1.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4940
-
C:\Windows\Syswow64\ddad2b99C:\Windows\Syswow64\ddad2b991⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3688
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\3f23d0
- Size 980B
- SHA256 339115d9ff048646bfca8a178315dfecf354a8d8f5af6efc299cfe46a3bbbcc9
- MD5 da45657fc0f410b6eab155e73c89d3db
- SHA1 6a6a457038e1324bafb1404ec2b54c0202b2cc9e
- SHA512 b3d53928372debbde665cc2975f24087129658f0b98b736489c1c67c4e3e42de163ed0836f6042ec8cc473d42269aea203f82644b654457049c76f2477e695e1
- TLSH T1A311E1BFB5FE99630CA7880201329DFA7219785F84FBF579BA8364081857B24A40740F
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\ddad2b99
- Size 511KB
- SHA256 874e7a43edddc18c9bb37d97414b5bd7eef8318323d08e27246beaa43b0ca5b7
- MD5 02af23d77c67324b6ac25d14dc011b3c
- SHA1 19a57be2d73bcc3adb12b0ba82ce5999cbbb6403
- SHA512 5f212a8b02e6ba15b349da38502066d2423d37563d354bf1775ab80654f8c755933caba27f32f30b47d96efa0521c8cced5bab06c182474cdc236f7701baca53
- SSDEEP 6144:jcTgav1cdCTuoPbgwmOLJvKRILSFvdFDcEOkCybEaQRXr9HNdvOax5Rv0:jSvO2x9mONvKRILSFnOkx2LIax5F0
- TLSH T120B45C26F6908036C4B34575C5F64BAAFAB4BC21631156CBA3943A6A1F737D2BD3130E
- MD5 SHA1 SHA512 SSDEEP TLSH