Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/08/2026, 08:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a09716b518a080958113fc8d6e571268e2cecde85309ded02f21958d09108d21.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
a09716b518a080958113fc8d6e571268e2cecde85309ded02f21958d09108d21.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target a09716b518a080958113fc8d6e571268e2cecde85309ded02f21958d09108d21.exe
- Size 704KB
- Sample260824-j6saeavbph
- SHA256 a09716b518a080958113fc8d6e571268e2cecde85309ded02f21958d09108d21
- MD5 353437f217084a7fa96a81e6d13fd077
- SHA1 93c348117b34885bd0e75f305ff507d7e9a849e5
- SHA512 15393faae175d493fad8ff14c8339586d33b6390209b1bfbc31f3288edab11e3b44b6c274ff39cfc733f7a0e1699d90cfc38fec671608d14e9d420d589865ebc
- SSDEEP 12288:JSvO2x9mONvKRILSFnOkx2LIaxy6RJ05r:wvO2xJKRI2FOkx2LFEF
- TLSH T1D1E46C26B7908136C477463585AB47A6EBB5BD11AB228B8F6340731D0F73793AE31B1C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3640 31dc044a - Unexpected DNS network traffic destination 18 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 40 223.5.5.5 5156 a09716b518a080958113fc8d6e571268e2cecde85309ded02f21958d09108d21.exe Destination IP 96 223.5.5.5 5156 a09716b518a080958113fc8d6e571268e2cecde85309ded02f21958d09108d21.exe Destination IP 157 114.114.114.114 5156 a09716b518a080958113fc8d6e571268e2cecde85309ded02f21958d09108d21.exe Destination IP 235 114.114.114.114 5156 a09716b518a080958113fc8d6e571268e2cecde85309ded02f21958d09108d21.exe Destination IP 322 114.114.114.114 5156 a09716b518a080958113fc8d6e571268e2cecde85309ded02f21958d09108d21.exe Destination IP 376 114.114.114.114 5156 a09716b518a080958113fc8d6e571268e2cecde85309ded02f21958d09108d21.exe Destination IP 39 114.114.114.114 5156 a09716b518a080958113fc8d6e571268e2cecde85309ded02f21958d09108d21.exe Destination IP 95 114.114.114.114 5156 a09716b518a080958113fc8d6e571268e2cecde85309ded02f21958d09108d21.exe Destination IP 159 223.5.5.5 5156 a09716b518a080958113fc8d6e571268e2cecde85309ded02f21958d09108d21.exe Destination IP 293 223.5.5.5 5156 a09716b518a080958113fc8d6e571268e2cecde85309ded02f21958d09108d21.exe Destination IP 3 223.5.5.5 5156 a09716b518a080958113fc8d6e571268e2cecde85309ded02f21958d09108d21.exe Destination IP 94 114.114.114.114 3640 31dc044a Destination IP 98 223.5.5.5 5156 a09716b518a080958113fc8d6e571268e2cecde85309ded02f21958d09108d21.exe Destination IP 292 114.114.114.114 5156 a09716b518a080958113fc8d6e571268e2cecde85309ded02f21958d09108d21.exe Destination IP 323 223.5.5.5 5156 a09716b518a080958113fc8d6e571268e2cecde85309ded02f21958d09108d21.exe Destination IP 377 223.5.5.5 5156 a09716b518a080958113fc8d6e571268e2cecde85309ded02f21958d09108d21.exe Destination IP 1 114.114.114.114 5156 a09716b518a080958113fc8d6e571268e2cecde85309ded02f21958d09108d21.exe Destination IP 237 223.5.5.5 5156 a09716b518a080958113fc8d6e571268e2cecde85309ded02f21958d09108d21.exe - Drops file in System32 directory 13 IoCs
description ioc Process File created C:\Windows\SysWOW64\31dc044a a09716b518a080958113fc8d6e571268e2cecde85309ded02f21958d09108d21.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 31dc044a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 31dc044a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 31dc044a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 31dc044a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 31dc044a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 31dc044a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 31dc044a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 31dc044a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 31dc044a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 31dc044a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 31dc044a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 31dc044a - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\3e5170 31dc044a File opened for modification C:\Windows\5845c8 a09716b518a080958113fc8d6e571268e2cecde85309ded02f21958d09108d21.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a09716b518a080958113fc8d6e571268e2cecde85309ded02f21958d09108d21.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 31dc044a - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 31dc044a Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 31dc044a Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 31dc044a Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 31dc044a Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 31dc044a Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 31dc044a Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 31dc044a Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 31dc044a Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 31dc044a - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 3640 31dc044a 3640 31dc044a 3640 31dc044a 3640 31dc044a 3640 31dc044a 3640 31dc044a 3640 31dc044a 3640 31dc044a 5156 a09716b518a080958113fc8d6e571268e2cecde85309ded02f21958d09108d21.exe 5156 a09716b518a080958113fc8d6e571268e2cecde85309ded02f21958d09108d21.exe 5156 a09716b518a080958113fc8d6e571268e2cecde85309ded02f21958d09108d21.exe 5156 a09716b518a080958113fc8d6e571268e2cecde85309ded02f21958d09108d21.exe 5156 a09716b518a080958113fc8d6e571268e2cecde85309ded02f21958d09108d21.exe 5156 a09716b518a080958113fc8d6e571268e2cecde85309ded02f21958d09108d21.exe 5156 a09716b518a080958113fc8d6e571268e2cecde85309ded02f21958d09108d21.exe 5156 a09716b518a080958113fc8d6e571268e2cecde85309ded02f21958d09108d21.exe 5156 a09716b518a080958113fc8d6e571268e2cecde85309ded02f21958d09108d21.exe 5156 a09716b518a080958113fc8d6e571268e2cecde85309ded02f21958d09108d21.exe 5156 a09716b518a080958113fc8d6e571268e2cecde85309ded02f21958d09108d21.exe 5156 a09716b518a080958113fc8d6e571268e2cecde85309ded02f21958d09108d21.exe 5156 a09716b518a080958113fc8d6e571268e2cecde85309ded02f21958d09108d21.exe 5156 a09716b518a080958113fc8d6e571268e2cecde85309ded02f21958d09108d21.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 5156 a09716b518a080958113fc8d6e571268e2cecde85309ded02f21958d09108d21.exe Token: SeTcbPrivilege 5156 a09716b518a080958113fc8d6e571268e2cecde85309ded02f21958d09108d21.exe Token: SeDebugPrivilege 3640 31dc044a Token: SeTcbPrivilege 3640 31dc044a
Processes
-
C:\Users\Admin\AppData\Local\Temp\a09716b518a080958113fc8d6e571268e2cecde85309ded02f21958d09108d21.exe"C:\Users\Admin\AppData\Local\Temp\a09716b518a080958113fc8d6e571268e2cecde85309ded02f21958d09108d21.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5156
-
C:\Windows\Syswow64\31dc044aC:\Windows\Syswow64\31dc044a1⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3640
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\31dc044a
- Size 704KB
- SHA256 a7ae3d2c1f8cff3e92520ca3047ff3a4b7ac5e3fd057196d032082681ff53bfa
- MD5 5b106223ee2b37df91da6a03b866029f
- SHA1 269adc760013c224d28f0fc34ce04c34e8f54af1
- SHA512 22c02ceca173681e446280f63f772b3267ab8bb567c569809b86aa885dc5cb382ac05304b1f544c49f94fb11a37833dbcb3fa9b0150f2a7995af586efa006e4a
- SSDEEP 12288:dSvO2x9mONvKRILSFnOkx2LIaxy6RJ05r:8vO2xJKRI2FOkx2LFEF
- TLSH T103E46C26B7908136C477463585AB47A6EBB5BD11AB228B8F6340731D0F73793AE31B1C
- MD5 SHA1 SHA512 SSDEEP TLSH