Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
23/08/2026, 23:19
Behavioral task
behavioral1
Sample
af87ee8bc37f1c91617bd1b83fc8eb75f79aeb4d6e36cb5656a03ae00d19bbd4.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target af87ee8bc37f1c91617bd1b83fc8eb75f79aeb4d6e36cb5656a03ae00d19bbd4.exe
- Size 560KB
- Sample260823-3a3wtabe33
- SHA256 af87ee8bc37f1c91617bd1b83fc8eb75f79aeb4d6e36cb5656a03ae00d19bbd4
- MD5 42e971dc33440eb97380009314781a2e
- SHA1 68a87cf3b87ca183f47a901df8fc0088b6fd9462
- SHA512 0048da2f3c525b9196728bff2234b2f592a27491902120f944056e84001f54ee201a628702dde14456a028571caff1de56c2e6dab70cd6da87d34d475ea92a19
- SSDEEP 6144:l6UE71cqQEoMr5C2iKLJChYSvL+8xPFxirGcEOkCybEaQRXr9HNdvOa+y8K:lO7OqQs42iKFChYSvL+8AsOkx2LIa+y
- TLSH T126C46C26B6A0D076C4B79574C4A28BA6FFB1742227244BCFA39047561F637E2BE3530D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4024 ad48a720 - Unexpected DNS network traffic destination 6 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 36 223.5.5.5 4592 af87ee8bc37f1c91617bd1b83fc8eb75f79aeb4d6e36cb5656a03ae00d19bbd4.exe Destination IP 75 114.114.114.114 4592 af87ee8bc37f1c91617bd1b83fc8eb75f79aeb4d6e36cb5656a03ae00d19bbd4.exe Destination IP 76 223.5.5.5 4592 af87ee8bc37f1c91617bd1b83fc8eb75f79aeb4d6e36cb5656a03ae00d19bbd4.exe Destination IP 3 114.114.114.114 4592 af87ee8bc37f1c91617bd1b83fc8eb75f79aeb4d6e36cb5656a03ae00d19bbd4.exe Destination IP 4 223.5.5.5 4592 af87ee8bc37f1c91617bd1b83fc8eb75f79aeb4d6e36cb5656a03ae00d19bbd4.exe Destination IP 35 114.114.114.114 4592 af87ee8bc37f1c91617bd1b83fc8eb75f79aeb4d6e36cb5656a03ae00d19bbd4.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 ad48a720 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE ad48a720 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 ad48a720 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 ad48a720 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 ad48a720 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies ad48a720 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft ad48a720 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache ad48a720 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AAD646CB44373074ADE741C38400E7E1 ad48a720 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AAD646CB44373074ADE741C38400E7E1 ad48a720 File created C:\Windows\SysWOW64\ad48a720 af87ee8bc37f1c91617bd1b83fc8eb75f79aeb4d6e36cb5656a03ae00d19bbd4.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC845F33427F1C99AF855BE8930371C ad48a720 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData ad48a720 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content ad48a720 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC845F33427F1C99AF855BE8930371C ad48a720 -
resource yara_rule behavioral1/memory/4592-0-0x00000000004D0000-0x000000000055C000-memory.dmp upx behavioral1/files/0x0006000000009dd1-2.dat upx behavioral1/memory/4024-3-0x0000000000C30000-0x0000000000CBC000-memory.dmp upx behavioral1/memory/4592-12-0x00000000004D0000-0x000000000055C000-memory.dmp upx behavioral1/memory/4024-13-0x0000000000C30000-0x0000000000CBC000-memory.dmp upx behavioral1/memory/4024-36-0x0000000000C30000-0x0000000000CBC000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\44e470 ad48a720 File opened for modification C:\Windows\4e9de0 af87ee8bc37f1c91617bd1b83fc8eb75f79aeb4d6e36cb5656a03ae00d19bbd4.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language af87ee8bc37f1c91617bd1b83fc8eb75f79aeb4d6e36cb5656a03ae00d19bbd4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ad48a720 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ad48a720 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ad48a720 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ad48a720 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ad48a720 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ad48a720 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing ad48a720 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix ad48a720 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" ad48a720 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" ad48a720 - Modifies system certificate store 2 TTPs 2 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1F24C630CDA418EF2069FFAD4FDD5F463A1B69AA\Blob = 5c0000000100000004000000800100000400000001000000100000009fad3b1c021e8aba177438810ca2bc080f0000000100000030000000f019c7ba12795dacd6ef1a767657deb8e41060a2ad1a6c66900a6ec16870fc06eecbaffdd3e2c986659578e7e85e535a530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003800000047006c006f00620061006c005300690067006e002000450043004300200052006f006f00740020004300410020002d002000520035000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308620000000100000020000000179fbc148a3dd00fd24ea13458cc43bfa7f59c8182d783a513f6ebec100c89241400000001000000140000003de629489bea07ca21444a26de6eded283d09f591d0000000100000010000000b647dd2a9ccadee75e8905e256cc6b147f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d7010300000001000000140000001f24c630cda418ef2069ffad4fdd5f463a1b69aa190000000100000010000000e3087c0c81f60a2a2b466b8a3e70cce82000000001000000220200003082021e308201a4a0030201020211605949e0262ebb55f90a778a71f94ad86c300a06082a8648ce3d040303305031243022060355040b131b476c6f62616c5369676e2045434320526f6f74204341202d20523531133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3132313131333030303030305a170d3338303131393033313430375a305031243022060355040b131b476c6f62616c5369676e2045434320526f6f74204341202d20523531133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e3076301006072a8648ce3d020106052b810400220362000447450e96fb7d5dbfe939d121f89f0bb6d57b1e923a48591cf062312dc07a28fe1aa75cb3b6cc97e745d458fad1776d43a2c08765340a1f7addeb3c33a1c59d4da46f4195387fc91e84ebd19e49928794870c3a854a669f9d59934d976106864aa3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604143de629489bea07ca21444a26de6eded283d09f59300a06082a8648ce3d0403030368003065023100e56912c96edbc631ba0941e197f8fbfd9ae27d12c9ed7c64d3cb05258b56d9a0e75e5d4e0b839c5b7629a00926216a62023071d2b58f5cea3be1780985a875923bc85cfd48ef0d7422a808e26ec549cec70cbca76169f1f73be12acbf92bf3669037 ad48a720 Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1F24C630CDA418EF2069FFAD4FDD5F463A1B69AA ad48a720 - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 4024 ad48a720 4024 ad48a720 4024 ad48a720 4024 ad48a720 4024 ad48a720 4024 ad48a720 4024 ad48a720 4024 ad48a720 4024 ad48a720 4024 ad48a720 4024 ad48a720 4024 ad48a720 4592 af87ee8bc37f1c91617bd1b83fc8eb75f79aeb4d6e36cb5656a03ae00d19bbd4.exe 4592 af87ee8bc37f1c91617bd1b83fc8eb75f79aeb4d6e36cb5656a03ae00d19bbd4.exe 4592 af87ee8bc37f1c91617bd1b83fc8eb75f79aeb4d6e36cb5656a03ae00d19bbd4.exe 4592 af87ee8bc37f1c91617bd1b83fc8eb75f79aeb4d6e36cb5656a03ae00d19bbd4.exe 4592 af87ee8bc37f1c91617bd1b83fc8eb75f79aeb4d6e36cb5656a03ae00d19bbd4.exe 4592 af87ee8bc37f1c91617bd1b83fc8eb75f79aeb4d6e36cb5656a03ae00d19bbd4.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4592 af87ee8bc37f1c91617bd1b83fc8eb75f79aeb4d6e36cb5656a03ae00d19bbd4.exe Token: SeTcbPrivilege 4592 af87ee8bc37f1c91617bd1b83fc8eb75f79aeb4d6e36cb5656a03ae00d19bbd4.exe Token: SeDebugPrivilege 4024 ad48a720 Token: SeTcbPrivilege 4024 ad48a720
Processes
-
C:\Users\Admin\AppData\Local\Temp\af87ee8bc37f1c91617bd1b83fc8eb75f79aeb4d6e36cb5656a03ae00d19bbd4.exe"C:\Users\Admin\AppData\Local\Temp\af87ee8bc37f1c91617bd1b83fc8eb75f79aeb4d6e36cb5656a03ae00d19bbd4.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4592
-
C:\Windows\Syswow64\ad48a720C:\Windows\Syswow64\ad48a7201⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4024
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\ad48a720
- Size 560KB
- SHA256 57e94a84262873935933e94bf75222a2974f29d30f6d6a023d74d222d0a97875
- MD5 6a009687c8f8a677322858e0ed12af60
- SHA1 8fd52efbd222d35c4c7dfebccb17f4e3d4ceadba
- SHA512 cfbadd474bc6271206c02b997d27c784fd112455f20a18ee6a1aaffad3efb5cac2621a9965b0abc66294ee3e977b95ec6fba8d52a23024e91dcf5d23fa4abe46
- SSDEEP 6144:ti6UE71cqQEoMr5C2iKLJChYSvL+8xPFxirGcEOkCybEaQRXr9HNdvOa+y8K:cO7OqQs42iKFChYSvL+8AsOkx2LIa+y
- TLSH T135C46C26B6A0D076C4B79574C4A28BA6FFB1742227244BCFA39047561F637E2BE3530D
- MD5 SHA1 SHA512 SSDEEP TLSH