Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
23/08/2026, 06:52
Behavioral task
behavioral1
Sample
137060da4c51e808351ef23fd2515a112e0ea59df2eec7bf9d72132f7709d016.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 137060da4c51e808351ef23fd2515a112e0ea59df2eec7bf9d72132f7709d016.exe
- Size 761KB
- Sample260823-hm18jaywfz
- SHA256 137060da4c51e808351ef23fd2515a112e0ea59df2eec7bf9d72132f7709d016
- MD5 d8dbeb27792cccf82ec8c5679236da9e
- SHA1 c6d388bd7986f8ab9b69954d594eb129dadc56c9
- SHA512 d592c6f17e028b47811468302d06408c22cffab1f23d43879b7c510d5280ad137fef925894a9cdf3bc77276ef5d74a8e32795c2aa866b15be21a86be51fa5830
- SSDEEP 12288:WSvO2x9mONvKRwLSFtsOkxHya5hYIW0p98B:VvO2xJKRw2kOkxSkW298B
- TLSH T1EFF49E35A2808036C0B34532C6F94AABF9797D35631565CBA3843B662F737D2BA3570E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1552 acf49338 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 34 114.114.114.114 408 137060da4c51e808351ef23fd2515a112e0ea59df2eec7bf9d72132f7709d016.exe Destination IP 37 223.5.5.5 408 137060da4c51e808351ef23fd2515a112e0ea59df2eec7bf9d72132f7709d016.exe Destination IP 3 114.114.114.114 408 137060da4c51e808351ef23fd2515a112e0ea59df2eec7bf9d72132f7709d016.exe Destination IP 4 223.5.5.5 408 137060da4c51e808351ef23fd2515a112e0ea59df2eec7bf9d72132f7709d016.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 acf49338 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 acf49338 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData acf49338 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 acf49338 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE acf49338 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies acf49338 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache acf49338 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content acf49338 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AAD646CB44373074ADE741C38400E7E1 acf49338 File created C:\Windows\SysWOW64\acf49338 137060da4c51e808351ef23fd2515a112e0ea59df2eec7bf9d72132f7709d016.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 acf49338 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 acf49338 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AAD646CB44373074ADE741C38400E7E1 acf49338 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft acf49338 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 acf49338 -
resource yara_rule behavioral1/memory/408-0-0x0000000000250000-0x00000000002DC000-memory.dmp upx behavioral1/files/0x0012000000024381-2.dat upx behavioral1/memory/1552-4-0x00000000004A0000-0x000000000052C000-memory.dmp upx behavioral1/memory/408-14-0x0000000000250000-0x00000000002DC000-memory.dmp upx behavioral1/memory/1552-15-0x00000000004A0000-0x000000000052C000-memory.dmp upx behavioral1/memory/1552-31-0x00000000004A0000-0x000000000052C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\1a9220 acf49338 File opened for modification C:\Windows\6fc30 137060da4c51e808351ef23fd2515a112e0ea59df2eec7bf9d72132f7709d016.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language acf49338 Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 137060da4c51e808351ef23fd2515a112e0ea59df2eec7bf9d72132f7709d016.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" acf49338 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" acf49338 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" acf49338 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" acf49338 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ acf49338 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing acf49338 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix acf49338 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" acf49338 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" acf49338 - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 1552 acf49338 1552 acf49338 1552 acf49338 1552 acf49338 1552 acf49338 1552 acf49338 1552 acf49338 1552 acf49338 1552 acf49338 1552 acf49338 1552 acf49338 1552 acf49338 408 137060da4c51e808351ef23fd2515a112e0ea59df2eec7bf9d72132f7709d016.exe 408 137060da4c51e808351ef23fd2515a112e0ea59df2eec7bf9d72132f7709d016.exe 408 137060da4c51e808351ef23fd2515a112e0ea59df2eec7bf9d72132f7709d016.exe 408 137060da4c51e808351ef23fd2515a112e0ea59df2eec7bf9d72132f7709d016.exe 408 137060da4c51e808351ef23fd2515a112e0ea59df2eec7bf9d72132f7709d016.exe 408 137060da4c51e808351ef23fd2515a112e0ea59df2eec7bf9d72132f7709d016.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 408 137060da4c51e808351ef23fd2515a112e0ea59df2eec7bf9d72132f7709d016.exe Token: SeTcbPrivilege 408 137060da4c51e808351ef23fd2515a112e0ea59df2eec7bf9d72132f7709d016.exe Token: SeDebugPrivilege 1552 acf49338 Token: SeTcbPrivilege 1552 acf49338
Processes
-
C:\Users\Admin\AppData\Local\Temp\137060da4c51e808351ef23fd2515a112e0ea59df2eec7bf9d72132f7709d016.exe"C:\Users\Admin\AppData\Local\Temp\137060da4c51e808351ef23fd2515a112e0ea59df2eec7bf9d72132f7709d016.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:408
-
C:\Windows\Syswow64\acf49338C:\Windows\Syswow64\acf493381⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1552
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\acf49338
- Size 761KB
- SHA256 c135d380aec0cb296b3ff452fb8d524f17486d434de3ad83683ca32359446eb6
- MD5 829fb8a6dab7bf985ee07beb68201482
- SHA1 a6d1990d33b8cc47553995875cbb870e9a0c638a
- SHA512 15464edca5db94366f45e0d6bfa392516846441c6ba86b3c3973edf869d06ac15246a32ce0cbe5f439bf87b98fe654fb108e5c21001fb067d059980eeac97718
- SSDEEP 12288:jSvO2x9mONvKRwLSFtsOkxHya5hYIW0p98B:WvO2xJKRw2kOkxSkW298B
- TLSH T170F49E35A2808036C0B34532C6F94AABF9797D35631565CBA3843B662F737D2BA3570E
- MD5 SHA1 SHA512 SSDEEP TLSH