Analysis
- max time kernel
149s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/08/2026, 00:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b80041285906e501e1a5a60a6ed7419d1437177155db5aa7449065b2fc7021a8.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
b80041285906e501e1a5a60a6ed7419d1437177155db5aa7449065b2fc7021a8.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target b80041285906e501e1a5a60a6ed7419d1437177155db5aa7449065b2fc7021a8.exe
- Size 615KB
- Sample260824-av41dsbr2x
- SHA256 b80041285906e501e1a5a60a6ed7419d1437177155db5aa7449065b2fc7021a8
- MD5 49d3f5a223bab2c26c38dc01af0d4816
- SHA1 d0e070234d329e31d170b0be0d5a4464fa055036
- SHA512 229ea74b6e2a158adbb75ca59df649219bf3ba163cdd0dc27e9ad8962d839a55f38cc7ca1014c24ed57b4ceb84f377987c61d9a04cbc7c03ee573719ba33d7e0
- SSDEEP 12288:ZSvO2x9mONvKRILSFnOkx2LIax5FAQjU/Liw:gvO2xJKRI2FOkx2LFicUV
- TLSH T108D44A31E241C03AD4A74576C6FA0BAFE5647D25531165CBA3C43A2A2FB36D2BE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3540 9aeb0162 - Unexpected DNS network traffic destination 18 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 231 223.5.5.5 3220 b80041285906e501e1a5a60a6ed7419d1437177155db5aa7449065b2fc7021a8.exe Destination IP 1 114.114.114.114 3220 b80041285906e501e1a5a60a6ed7419d1437177155db5aa7449065b2fc7021a8.exe Destination IP 2 223.5.5.5 3220 b80041285906e501e1a5a60a6ed7419d1437177155db5aa7449065b2fc7021a8.exe Destination IP 35 114.114.114.114 3220 b80041285906e501e1a5a60a6ed7419d1437177155db5aa7449065b2fc7021a8.exe Destination IP 91 114.114.114.114 3220 b80041285906e501e1a5a60a6ed7419d1437177155db5aa7449065b2fc7021a8.exe Destination IP 92 223.5.5.5 3220 b80041285906e501e1a5a60a6ed7419d1437177155db5aa7449065b2fc7021a8.exe Destination IP 98 223.5.5.5 3220 b80041285906e501e1a5a60a6ed7419d1437177155db5aa7449065b2fc7021a8.exe Destination IP 318 114.114.114.114 3220 b80041285906e501e1a5a60a6ed7419d1437177155db5aa7449065b2fc7021a8.exe Destination IP 90 114.114.114.114 3540 9aeb0162 Destination IP 150 114.114.114.114 3220 b80041285906e501e1a5a60a6ed7419d1437177155db5aa7449065b2fc7021a8.exe Destination IP 230 114.114.114.114 3220 b80041285906e501e1a5a60a6ed7419d1437177155db5aa7449065b2fc7021a8.exe Destination IP 289 223.5.5.5 3220 b80041285906e501e1a5a60a6ed7419d1437177155db5aa7449065b2fc7021a8.exe Destination IP 319 223.5.5.5 3220 b80041285906e501e1a5a60a6ed7419d1437177155db5aa7449065b2fc7021a8.exe Destination IP 288 114.114.114.114 3220 b80041285906e501e1a5a60a6ed7419d1437177155db5aa7449065b2fc7021a8.exe Destination IP 372 114.114.114.114 3220 b80041285906e501e1a5a60a6ed7419d1437177155db5aa7449065b2fc7021a8.exe Destination IP 373 223.5.5.5 3220 b80041285906e501e1a5a60a6ed7419d1437177155db5aa7449065b2fc7021a8.exe Destination IP 36 223.5.5.5 3220 b80041285906e501e1a5a60a6ed7419d1437177155db5aa7449065b2fc7021a8.exe Destination IP 152 223.5.5.5 3220 b80041285906e501e1a5a60a6ed7419d1437177155db5aa7449065b2fc7021a8.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 9aeb0162 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 9aeb0162 File created C:\Windows\SysWOW64\9aeb0162 b80041285906e501e1a5a60a6ed7419d1437177155db5aa7449065b2fc7021a8.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 9aeb0162 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 9aeb0162 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 9aeb0162 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 9aeb0162 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 9aeb0162 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 9aeb0162 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 9aeb0162 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 9aeb0162 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 9aeb0162 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 9aeb0162 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 9aeb0162 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 9aeb0162 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\3c9b28 9aeb0162 File opened for modification C:\Windows\3720a8 b80041285906e501e1a5a60a6ed7419d1437177155db5aa7449065b2fc7021a8.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b80041285906e501e1a5a60a6ed7419d1437177155db5aa7449065b2fc7021a8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9aeb0162 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 9aeb0162 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 9aeb0162 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 9aeb0162 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 9aeb0162 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 9aeb0162 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 9aeb0162 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 9aeb0162 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 9aeb0162 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 9aeb0162 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 3540 9aeb0162 3540 9aeb0162 3540 9aeb0162 3540 9aeb0162 3540 9aeb0162 3540 9aeb0162 3540 9aeb0162 3540 9aeb0162 3220 b80041285906e501e1a5a60a6ed7419d1437177155db5aa7449065b2fc7021a8.exe 3220 b80041285906e501e1a5a60a6ed7419d1437177155db5aa7449065b2fc7021a8.exe 3220 b80041285906e501e1a5a60a6ed7419d1437177155db5aa7449065b2fc7021a8.exe 3220 b80041285906e501e1a5a60a6ed7419d1437177155db5aa7449065b2fc7021a8.exe 3220 b80041285906e501e1a5a60a6ed7419d1437177155db5aa7449065b2fc7021a8.exe 3220 b80041285906e501e1a5a60a6ed7419d1437177155db5aa7449065b2fc7021a8.exe 3220 b80041285906e501e1a5a60a6ed7419d1437177155db5aa7449065b2fc7021a8.exe 3220 b80041285906e501e1a5a60a6ed7419d1437177155db5aa7449065b2fc7021a8.exe 3220 b80041285906e501e1a5a60a6ed7419d1437177155db5aa7449065b2fc7021a8.exe 3220 b80041285906e501e1a5a60a6ed7419d1437177155db5aa7449065b2fc7021a8.exe 3220 b80041285906e501e1a5a60a6ed7419d1437177155db5aa7449065b2fc7021a8.exe 3220 b80041285906e501e1a5a60a6ed7419d1437177155db5aa7449065b2fc7021a8.exe 3220 b80041285906e501e1a5a60a6ed7419d1437177155db5aa7449065b2fc7021a8.exe 3220 b80041285906e501e1a5a60a6ed7419d1437177155db5aa7449065b2fc7021a8.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3220 b80041285906e501e1a5a60a6ed7419d1437177155db5aa7449065b2fc7021a8.exe Token: SeTcbPrivilege 3220 b80041285906e501e1a5a60a6ed7419d1437177155db5aa7449065b2fc7021a8.exe Token: SeDebugPrivilege 3540 9aeb0162 Token: SeTcbPrivilege 3540 9aeb0162
Processes
-
C:\Users\Admin\AppData\Local\Temp\b80041285906e501e1a5a60a6ed7419d1437177155db5aa7449065b2fc7021a8.exe"C:\Users\Admin\AppData\Local\Temp\b80041285906e501e1a5a60a6ed7419d1437177155db5aa7449065b2fc7021a8.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3220
-
C:\Windows\Syswow64\9aeb0162C:\Windows\Syswow64\9aeb01621⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3540
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\9aeb0162
- Size 615KB
- SHA256 43b754501845b348511203d797cc83fa1f1e0c8efa430618dbdd90119c7e55fd
- MD5 3d117df950039a7cbeb5679d9ab88d18
- SHA1 a992f0e0cb65dfb070a4f719e21bea0393b0965f
- SHA512 790120d786652e993f4c80d8a09097ead8605ac4096eea4ed36fbf4e97b41b8ac275f27403ec0b2cedbd467a2c802707bfd89e600285eb36c8119267d75ee04d
- SSDEEP 12288:cSvO2x9mONvKRILSFnOkx2LIax5FAQjU/Liw:vvO2xJKRI2FOkx2LFicUV
- TLSH T114D44A31E241C03AD4A74576C6FA0BAFE5647D25531165CBA3C43A2A2FB36D2BE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH