Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
20/08/2026, 20:53
Behavioral task
behavioral1
Sample
ea96caecfb337aa59bfe2f4a6aa3614088c609858004aa3a395c39bdf27a9f9d.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target ea96caecfb337aa59bfe2f4a6aa3614088c609858004aa3a395c39bdf27a9f9d.exe
- Size 560KB
- Sample260820-zpcrdsysfs
- SHA256 ea96caecfb337aa59bfe2f4a6aa3614088c609858004aa3a395c39bdf27a9f9d
- MD5 85e742334561f2ecd29c1ff5f8b7daed
- SHA1 c5e9e94a0f0a88a7f738861e335988b7fea53047
- SHA512 600bb672ff0236f0e353c5ca07701c11ccef125dd697210f8b28be57b7cb03ecf40d8b3244aa627ce62fdd7cfecee969815b74e5d33a22e354161364b0f8adaf
- SSDEEP 6144:+UJJuV1cdhIoA7vJ0CLoCgvDLe4AmFvirGcEOkCybEaQRuy8K:+YsVOdhElvkCgvDLe4usOkxHy
- TLSH T161C48D29B6D0C036C5B39574C4A186BAEAB17432372549CFA3D5475A0F337E2BA7930E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1964 19d9f85e - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 1 114.114.114.114 4468 ea96caecfb337aa59bfe2f4a6aa3614088c609858004aa3a395c39bdf27a9f9d.exe Destination IP 4 223.5.5.5 4468 ea96caecfb337aa59bfe2f4a6aa3614088c609858004aa3a395c39bdf27a9f9d.exe Destination IP 29 114.114.114.114 4468 ea96caecfb337aa59bfe2f4a6aa3614088c609858004aa3a395c39bdf27a9f9d.exe Destination IP 30 223.5.5.5 4468 ea96caecfb337aa59bfe2f4a6aa3614088c609858004aa3a395c39bdf27a9f9d.exe - Drops file in System32 directory 17 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 19d9f85e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 19d9f85e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 19d9f85e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AAD646CB44373074ADE741C38400E7E1 19d9f85e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 19d9f85e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 19d9f85e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC845F33427F1C99AF855BE8930371C 19d9f85e File created C:\Windows\SysWOW64\19d9f85e ea96caecfb337aa59bfe2f4a6aa3614088c609858004aa3a395c39bdf27a9f9d.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC845F33427F1C99AF855BE8930371C 19d9f85e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 19d9f85e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 19d9f85e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 19d9f85e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 19d9f85e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 19d9f85e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 19d9f85e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AAD646CB44373074ADE741C38400E7E1 19d9f85e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 19d9f85e -
resource yara_rule behavioral1/memory/4468-0-0x0000000000060000-0x00000000000EC000-memory.dmp upx behavioral1/memory/1964-4-0x0000000000410000-0x000000000049C000-memory.dmp upx behavioral1/files/0x000a0000000004e9-3.dat upx behavioral1/memory/4468-14-0x0000000000060000-0x00000000000EC000-memory.dmp upx behavioral1/memory/1964-15-0x0000000000410000-0x000000000049C000-memory.dmp upx behavioral1/memory/1964-36-0x0000000000410000-0x000000000049C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\219fd8 19d9f85e File opened for modification C:\Windows\4c7e68 ea96caecfb337aa59bfe2f4a6aa3614088c609858004aa3a395c39bdf27a9f9d.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ea96caecfb337aa59bfe2f4a6aa3614088c609858004aa3a395c39bdf27a9f9d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19d9f85e - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 19d9f85e Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 19d9f85e Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 19d9f85e Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 19d9f85e Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 19d9f85e Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 19d9f85e Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 19d9f85e Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 19d9f85e Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 19d9f85e - Modifies system certificate store 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1F24C630CDA418EF2069FFAD4FDD5F463A1B69AA 19d9f85e Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1F24C630CDA418EF2069FFAD4FDD5F463A1B69AA\Blob = 5c0000000100000004000000800100000f0000000100000030000000f019c7ba12795dacd6ef1a767657deb8e41060a2ad1a6c66900a6ec16870fc06eecbaffdd3e2c986659578e7e85e535a530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003800000047006c006f00620061006c005300690067006e002000450043004300200052006f006f00740020004300410020002d002000520035000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308620000000100000020000000179fbc148a3dd00fd24ea13458cc43bfa7f59c8182d783a513f6ebec100c89241400000001000000140000003de629489bea07ca21444a26de6eded283d09f591d0000000100000010000000b647dd2a9ccadee75e8905e256cc6b147f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d7010300000001000000140000001f24c630cda418ef2069ffad4fdd5f463a1b69aa190000000100000010000000e3087c0c81f60a2a2b466b8a3e70cce82000000001000000220200003082021e308201a4a0030201020211605949e0262ebb55f90a778a71f94ad86c300a06082a8648ce3d040303305031243022060355040b131b476c6f62616c5369676e2045434320526f6f74204341202d20523531133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3132313131333030303030305a170d3338303131393033313430375a305031243022060355040b131b476c6f62616c5369676e2045434320526f6f74204341202d20523531133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e3076301006072a8648ce3d020106052b810400220362000447450e96fb7d5dbfe939d121f89f0bb6d57b1e923a48591cf062312dc07a28fe1aa75cb3b6cc97e745d458fad1776d43a2c08765340a1f7addeb3c33a1c59d4da46f4195387fc91e84ebd19e49928794870c3a854a669f9d59934d976106864aa3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604143de629489bea07ca21444a26de6eded283d09f59300a06082a8648ce3d0403030368003065023100e56912c96edbc631ba0941e197f8fbfd9ae27d12c9ed7c64d3cb05258b56d9a0e75e5d4e0b839c5b7629a00926216a62023071d2b58f5cea3be1780985a875923bc85cfd48ef0d7422a808e26ec549cec70cbca76169f1f73be12acbf92bf3669037 19d9f85e - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 1964 19d9f85e 1964 19d9f85e 1964 19d9f85e 1964 19d9f85e 1964 19d9f85e 1964 19d9f85e 1964 19d9f85e 1964 19d9f85e 1964 19d9f85e 1964 19d9f85e 1964 19d9f85e 1964 19d9f85e 4468 ea96caecfb337aa59bfe2f4a6aa3614088c609858004aa3a395c39bdf27a9f9d.exe 4468 ea96caecfb337aa59bfe2f4a6aa3614088c609858004aa3a395c39bdf27a9f9d.exe 4468 ea96caecfb337aa59bfe2f4a6aa3614088c609858004aa3a395c39bdf27a9f9d.exe 4468 ea96caecfb337aa59bfe2f4a6aa3614088c609858004aa3a395c39bdf27a9f9d.exe 4468 ea96caecfb337aa59bfe2f4a6aa3614088c609858004aa3a395c39bdf27a9f9d.exe 4468 ea96caecfb337aa59bfe2f4a6aa3614088c609858004aa3a395c39bdf27a9f9d.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4468 ea96caecfb337aa59bfe2f4a6aa3614088c609858004aa3a395c39bdf27a9f9d.exe Token: SeTcbPrivilege 4468 ea96caecfb337aa59bfe2f4a6aa3614088c609858004aa3a395c39bdf27a9f9d.exe Token: SeDebugPrivilege 1964 19d9f85e Token: SeTcbPrivilege 1964 19d9f85e
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea96caecfb337aa59bfe2f4a6aa3614088c609858004aa3a395c39bdf27a9f9d.exe"C:\Users\Admin\AppData\Local\Temp\ea96caecfb337aa59bfe2f4a6aa3614088c609858004aa3a395c39bdf27a9f9d.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4468
-
C:\Windows\Syswow64\19d9f85eC:\Windows\Syswow64\19d9f85e1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1964
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\219fd8
- Size 506B
- SHA256 42ddafb5961d03389b9ce77a61db00945df5524b2051c863d345dee5049f6a52
- MD5 4f58b6539e2fa1691952d400688bfde6
- SHA1 12fd8e88e8346fefb4c1574a6d8ab39c2ea99577
- SHA512 ac703b049a06c4a854e244876ece82ac62b03d7cff5361e67d0da422e54f5c8cec5c90d8fde94ef311c666cd86458e6e2c4a2a1829d608d6feade0dbdad97d06
- TLSH T1F2F0C0FA9C2122790EAB1672451BF88611B5613EC02F21A299C3F18494422426DC3540
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\19d9f85e
- Size 560KB
- SHA256 45315175aa25d41c435977052ad5ba07462e9e175325dd8e5f3217f29ee2b97f
- MD5 c2eb4047a0f80d7ce200dc0c13badde1
- SHA1 2305572d497a3d41533f91344d6cfdb31be21d80
- SHA512 cd4dea2f9427097ae34d91abf6dd3b138023c91ae02b6feb9fe48c36394deb5543ce22124b10a3723046d31086c91fe3beb2f8c4f98adde2f56f3bad873f1f01
- SSDEEP 6144:vUJJuV1cdhIoA7vJ0CLoCgvDLe4AmFvirGcEOkCybEaQRuy8K:vYsVOdhElvkCgvDLe4usOkxHy
- TLSH T181C48D29B6D0C036C5B39574C4A186BAEAB17432372549CFA3D5475A0F337E2BA7930E
- MD5 SHA1 SHA512 SSDEEP TLSH