Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/08/2026, 23:10
Behavioral task
behavioral1
Sample
970fc822965cb37d35dd8c94723e6316d0ed3ea4a439c8235a3a88517e0c6bbe.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 970fc822965cb37d35dd8c94723e6316d0ed3ea4a439c8235a3a88517e0c6bbe.exe
- Size 560KB
- Sample260823-25n6gabl21
- SHA256 970fc822965cb37d35dd8c94723e6316d0ed3ea4a439c8235a3a88517e0c6bbe
- MD5 57f76787851c9f8d9da954afe97a6137
- SHA1 352906fa4a3aaa943a608f8a65f5d86c937c22c3
- SHA512 48a1b6136a278b6f8a84f585dfdfca97ae028d7323670b99de9c820b0ccf5062c82eaab10da9d9a3e6e2ee17bdd65a9f054d4923c591a1a45114c49b9a4ddab6
- SSDEEP 6144:Cgye71cE4poJTqvpQLXNKFyLWD1nFairGcEOkCybEaQRuy8K:CI7OE4kopQzNKFyLWDHsOkxHy
- TLSH T14DC48C2AB690C076C4B7D534C5E197AAEAB17432372449CFA3D0075A1F237E2BA3570E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3292 af5679da - Unexpected DNS network traffic destination 8 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 83 114.114.114.114 4808 970fc822965cb37d35dd8c94723e6316d0ed3ea4a439c8235a3a88517e0c6bbe.exe Destination IP 84 223.5.5.5 4808 970fc822965cb37d35dd8c94723e6316d0ed3ea4a439c8235a3a88517e0c6bbe.exe Destination IP 1 114.114.114.114 4808 970fc822965cb37d35dd8c94723e6316d0ed3ea4a439c8235a3a88517e0c6bbe.exe Destination IP 4 223.5.5.5 4808 970fc822965cb37d35dd8c94723e6316d0ed3ea4a439c8235a3a88517e0c6bbe.exe Destination IP 42 114.114.114.114 4808 970fc822965cb37d35dd8c94723e6316d0ed3ea4a439c8235a3a88517e0c6bbe.exe Destination IP 43 223.5.5.5 4808 970fc822965cb37d35dd8c94723e6316d0ed3ea4a439c8235a3a88517e0c6bbe.exe Destination IP 45 114.114.114.114 4808 970fc822965cb37d35dd8c94723e6316d0ed3ea4a439c8235a3a88517e0c6bbe.exe Destination IP 46 223.5.5.5 4808 970fc822965cb37d35dd8c94723e6316d0ed3ea4a439c8235a3a88517e0c6bbe.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 af5679da File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE af5679da File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft af5679da File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache af5679da File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData af5679da File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 af5679da File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content af5679da File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 af5679da File created C:\Windows\SysWOW64\af5679da 970fc822965cb37d35dd8c94723e6316d0ed3ea4a439c8235a3a88517e0c6bbe.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies af5679da File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 af5679da File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 af5679da File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 af5679da -
resource yara_rule behavioral2/memory/4808-0-0x0000000000DC0000-0x0000000000E4C000-memory.dmp upx behavioral2/files/0x000e000000019ca9-2.dat upx behavioral2/memory/3292-3-0x0000000000F00000-0x0000000000F8C000-memory.dmp upx behavioral2/memory/4808-16-0x0000000000DC0000-0x0000000000E4C000-memory.dmp upx behavioral2/memory/3292-17-0x0000000000F00000-0x0000000000F8C000-memory.dmp upx behavioral2/memory/3292-34-0x0000000000F00000-0x0000000000F8C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\525090 970fc822965cb37d35dd8c94723e6316d0ed3ea4a439c8235a3a88517e0c6bbe.exe File opened for modification C:\Windows\385c38 af5679da - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 970fc822965cb37d35dd8c94723e6316d0ed3ea4a439c8235a3a88517e0c6bbe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language af5679da - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" af5679da Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" af5679da Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" af5679da Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing af5679da Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" af5679da Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" af5679da Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" af5679da Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix af5679da Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ af5679da - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 3292 af5679da 3292 af5679da 3292 af5679da 3292 af5679da 3292 af5679da 3292 af5679da 3292 af5679da 3292 af5679da 4808 970fc822965cb37d35dd8c94723e6316d0ed3ea4a439c8235a3a88517e0c6bbe.exe 4808 970fc822965cb37d35dd8c94723e6316d0ed3ea4a439c8235a3a88517e0c6bbe.exe 4808 970fc822965cb37d35dd8c94723e6316d0ed3ea4a439c8235a3a88517e0c6bbe.exe 4808 970fc822965cb37d35dd8c94723e6316d0ed3ea4a439c8235a3a88517e0c6bbe.exe 4808 970fc822965cb37d35dd8c94723e6316d0ed3ea4a439c8235a3a88517e0c6bbe.exe 4808 970fc822965cb37d35dd8c94723e6316d0ed3ea4a439c8235a3a88517e0c6bbe.exe 4808 970fc822965cb37d35dd8c94723e6316d0ed3ea4a439c8235a3a88517e0c6bbe.exe 4808 970fc822965cb37d35dd8c94723e6316d0ed3ea4a439c8235a3a88517e0c6bbe.exe 4808 970fc822965cb37d35dd8c94723e6316d0ed3ea4a439c8235a3a88517e0c6bbe.exe 4808 970fc822965cb37d35dd8c94723e6316d0ed3ea4a439c8235a3a88517e0c6bbe.exe 4808 970fc822965cb37d35dd8c94723e6316d0ed3ea4a439c8235a3a88517e0c6bbe.exe 4808 970fc822965cb37d35dd8c94723e6316d0ed3ea4a439c8235a3a88517e0c6bbe.exe 4808 970fc822965cb37d35dd8c94723e6316d0ed3ea4a439c8235a3a88517e0c6bbe.exe 4808 970fc822965cb37d35dd8c94723e6316d0ed3ea4a439c8235a3a88517e0c6bbe.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4808 970fc822965cb37d35dd8c94723e6316d0ed3ea4a439c8235a3a88517e0c6bbe.exe Token: SeTcbPrivilege 4808 970fc822965cb37d35dd8c94723e6316d0ed3ea4a439c8235a3a88517e0c6bbe.exe Token: SeDebugPrivilege 3292 af5679da Token: SeTcbPrivilege 3292 af5679da
Processes
-
C:\Users\Admin\AppData\Local\Temp\970fc822965cb37d35dd8c94723e6316d0ed3ea4a439c8235a3a88517e0c6bbe.exe"C:\Users\Admin\AppData\Local\Temp\970fc822965cb37d35dd8c94723e6316d0ed3ea4a439c8235a3a88517e0c6bbe.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4808
-
C:\Windows\Syswow64\af5679daC:\Windows\Syswow64\af5679da1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3292
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\af5679da
- Size 560KB
- SHA256 f001a99c06588dffb3373ced109cf7c26e7ffaa9a0ae5097eab684015e47bdf5
- MD5 5b58f004cdf7fba59014f4c953d8bb33
- SHA1 b8cf7de13ea5f0945f95560fd5a20f49a43fcc52
- SHA512 41efbdad37382c23cb21881fb1a0bd190e4bd37f0f34dcdf8da9fd33f1600a79817bf56e83a499f6d9675f5aa4bdb3d64fe09659ab455f3d95d125d8a2419618
- SSDEEP 6144:rgye71cE4poJTqvpQLXNKFyLWD1nFairGcEOkCybEaQRuy8K:rI7OE4kopQzNKFyLWDHsOkxHy
- TLSH T141C48C2AB690C076C4B7D534C5E197AAEAB17432372449CFA3D0075A1F237E2BA3570E
- MD5 SHA1 SHA512 SSDEEP TLSH