Analysis
- max time kernel
148s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/08/2026, 20:51
Behavioral task
behavioral1
Sample
cc7a1cf436dce1fbf5419946702bf6d82a9520ba6be642f1e19607345f980fd7.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target cc7a1cf436dce1fbf5419946702bf6d82a9520ba6be642f1e19607345f980fd7.exe
- Size 576KB
- Sample260818-znl9fabd49
- SHA256 cc7a1cf436dce1fbf5419946702bf6d82a9520ba6be642f1e19607345f980fd7
- MD5 33e57b39d043641b7c622d13a6b81d06
- SHA1 cdf707321bd42e0983e2cd7c0b1ebc372da63b5b
- SHA512 c865b998e967c335b4f11273bd7c4161f0b2d046cba5c3eadd88457ea733714da2508ed31c346f70acac6e35b6e8e315f4d22a1ab2e6e607603cf18b07cb6335
- SSDEEP 6144:6cTgav1cdCTuoPbgwmOLJvKRwLSFXdFwirGcEOkCybEaQRXr9HNdvOa+y8K/:6SvO2x9mONvKRwLSFtsOkx2LIa+yx
- TLSH T178C46D26B6908072C4779578C4A257AAFBB1BC2127204ACFA390775A1F737D2BE3570D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4764 d5ea4486 - Unexpected DNS network traffic destination 18 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 36 223.5.5.5 1204 cc7a1cf436dce1fbf5419946702bf6d82a9520ba6be642f1e19607345f980fd7.exe Destination IP 177 114.114.114.114 1204 cc7a1cf436dce1fbf5419946702bf6d82a9520ba6be642f1e19607345f980fd7.exe Destination IP 232 223.5.5.5 1204 cc7a1cf436dce1fbf5419946702bf6d82a9520ba6be642f1e19607345f980fd7.exe Destination IP 289 223.5.5.5 1204 cc7a1cf436dce1fbf5419946702bf6d82a9520ba6be642f1e19607345f980fd7.exe Destination IP 90 114.114.114.114 4764 d5ea4486 Destination IP 91 223.5.5.5 1204 cc7a1cf436dce1fbf5419946702bf6d82a9520ba6be642f1e19607345f980fd7.exe Destination IP 116 114.114.114.114 1204 cc7a1cf436dce1fbf5419946702bf6d82a9520ba6be642f1e19607345f980fd7.exe Destination IP 288 114.114.114.114 1204 cc7a1cf436dce1fbf5419946702bf6d82a9520ba6be642f1e19607345f980fd7.exe Destination IP 372 114.114.114.114 1204 cc7a1cf436dce1fbf5419946702bf6d82a9520ba6be642f1e19607345f980fd7.exe Destination IP 373 223.5.5.5 1204 cc7a1cf436dce1fbf5419946702bf6d82a9520ba6be642f1e19607345f980fd7.exe Destination IP 1 114.114.114.114 1204 cc7a1cf436dce1fbf5419946702bf6d82a9520ba6be642f1e19607345f980fd7.exe Destination IP 35 114.114.114.114 1204 cc7a1cf436dce1fbf5419946702bf6d82a9520ba6be642f1e19607345f980fd7.exe Destination IP 178 223.5.5.5 1204 cc7a1cf436dce1fbf5419946702bf6d82a9520ba6be642f1e19607345f980fd7.exe Destination IP 318 114.114.114.114 1204 cc7a1cf436dce1fbf5419946702bf6d82a9520ba6be642f1e19607345f980fd7.exe Destination IP 118 223.5.5.5 1204 cc7a1cf436dce1fbf5419946702bf6d82a9520ba6be642f1e19607345f980fd7.exe Destination IP 231 114.114.114.114 1204 cc7a1cf436dce1fbf5419946702bf6d82a9520ba6be642f1e19607345f980fd7.exe Destination IP 319 223.5.5.5 1204 cc7a1cf436dce1fbf5419946702bf6d82a9520ba6be642f1e19607345f980fd7.exe Destination IP 2 223.5.5.5 1204 cc7a1cf436dce1fbf5419946702bf6d82a9520ba6be642f1e19607345f980fd7.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 d5ea4486 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 d5ea4486 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 d5ea4486 File created C:\Windows\SysWOW64\d5ea4486 cc7a1cf436dce1fbf5419946702bf6d82a9520ba6be642f1e19607345f980fd7.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies d5ea4486 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache d5ea4486 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content d5ea4486 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 d5ea4486 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 d5ea4486 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 d5ea4486 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 d5ea4486 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE d5ea4486 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft d5ea4486 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 d5ea4486 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData d5ea4486 -
resource yara_rule behavioral2/memory/1204-0-0x00000000008A0000-0x000000000092C000-memory.dmp upx behavioral2/files/0x000500000001b851-2.dat upx behavioral2/memory/4764-3-0x0000000000D30000-0x0000000000DBC000-memory.dmp upx behavioral2/memory/1204-18-0x00000000008A0000-0x000000000092C000-memory.dmp upx behavioral2/memory/4764-21-0x0000000000D30000-0x0000000000DBC000-memory.dmp upx behavioral2/memory/4764-42-0x0000000000D30000-0x0000000000DBC000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\518fb8 d5ea4486 File opened for modification C:\Windows\149ce8 cc7a1cf436dce1fbf5419946702bf6d82a9520ba6be642f1e19607345f980fd7.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cc7a1cf436dce1fbf5419946702bf6d82a9520ba6be642f1e19607345f980fd7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d5ea4486 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ d5ea4486 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" d5ea4486 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" d5ea4486 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix d5ea4486 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" d5ea4486 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" d5ea4486 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing d5ea4486 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" d5ea4486 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" d5ea4486 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 4764 d5ea4486 4764 d5ea4486 4764 d5ea4486 4764 d5ea4486 4764 d5ea4486 4764 d5ea4486 4764 d5ea4486 4764 d5ea4486 1204 cc7a1cf436dce1fbf5419946702bf6d82a9520ba6be642f1e19607345f980fd7.exe 1204 cc7a1cf436dce1fbf5419946702bf6d82a9520ba6be642f1e19607345f980fd7.exe 1204 cc7a1cf436dce1fbf5419946702bf6d82a9520ba6be642f1e19607345f980fd7.exe 1204 cc7a1cf436dce1fbf5419946702bf6d82a9520ba6be642f1e19607345f980fd7.exe 1204 cc7a1cf436dce1fbf5419946702bf6d82a9520ba6be642f1e19607345f980fd7.exe 1204 cc7a1cf436dce1fbf5419946702bf6d82a9520ba6be642f1e19607345f980fd7.exe 1204 cc7a1cf436dce1fbf5419946702bf6d82a9520ba6be642f1e19607345f980fd7.exe 1204 cc7a1cf436dce1fbf5419946702bf6d82a9520ba6be642f1e19607345f980fd7.exe 1204 cc7a1cf436dce1fbf5419946702bf6d82a9520ba6be642f1e19607345f980fd7.exe 1204 cc7a1cf436dce1fbf5419946702bf6d82a9520ba6be642f1e19607345f980fd7.exe 1204 cc7a1cf436dce1fbf5419946702bf6d82a9520ba6be642f1e19607345f980fd7.exe 1204 cc7a1cf436dce1fbf5419946702bf6d82a9520ba6be642f1e19607345f980fd7.exe 1204 cc7a1cf436dce1fbf5419946702bf6d82a9520ba6be642f1e19607345f980fd7.exe 1204 cc7a1cf436dce1fbf5419946702bf6d82a9520ba6be642f1e19607345f980fd7.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1204 cc7a1cf436dce1fbf5419946702bf6d82a9520ba6be642f1e19607345f980fd7.exe Token: SeTcbPrivilege 1204 cc7a1cf436dce1fbf5419946702bf6d82a9520ba6be642f1e19607345f980fd7.exe Token: SeDebugPrivilege 4764 d5ea4486 Token: SeTcbPrivilege 4764 d5ea4486
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc7a1cf436dce1fbf5419946702bf6d82a9520ba6be642f1e19607345f980fd7.exe"C:\Users\Admin\AppData\Local\Temp\cc7a1cf436dce1fbf5419946702bf6d82a9520ba6be642f1e19607345f980fd7.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1204
-
C:\Windows\Syswow64\d5ea4486C:\Windows\Syswow64\d5ea44861⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4764
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:2532
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\d5ea4486
- Size 576KB
- SHA256 7e14fb860375847b2c4114e71a681c39909e02420ed8f389a373855a64eadbcb
- MD5 2378c4a14457d478bc1c338c6635b012
- SHA1 4a570ea73de127efd2d8dfd3354b5cfbabe52ca5
- SHA512 927f3254c1b30bf67447043cdbc7f632ca7838d2561e83e81b80baf9378fa9095756c836cfff0baca1e5d1e2d826d31e37f7d8b41682c22d58980a4bf55c7fac
- SSDEEP 6144:WcTgav1cdCTuoPbgwmOLJvKRwLSFXdFwirGcEOkCybEaQRXr9HNdvOa+y8K/:WSvO2x9mONvKRwLSFtsOkx2LIa+yx
- TLSH T17BC46D26B6908072C4779578C4A257AAFBB1BC2127204ACFA390775A1F737D2BE3570D
- MD5 SHA1 SHA512 SSDEEP TLSH