Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
26/08/2026, 21:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bf8317c50f6d21d8d5948bc57230f07aa641ff86141b6ab0fc6ad50273d319b5.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
bf8317c50f6d21d8d5948bc57230f07aa641ff86141b6ab0fc6ad50273d319b5.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target bf8317c50f6d21d8d5948bc57230f07aa641ff86141b6ab0fc6ad50273d319b5.exe
- Size 1.2MB
- Sample260826-1menmsff22
- SHA256 bf8317c50f6d21d8d5948bc57230f07aa641ff86141b6ab0fc6ad50273d319b5
- MD5 cb41e2cb6f03f90b77b5cebc399071cf
- SHA1 7ef36deaa44313ad3a62da44c8be1627896ef61b
- SHA512 f688d10df88aebb421609ecbfe2ff1bade76bea446032264459f9bddae170ce6546e0a1db39a4e0599cc52f9cf4225b95d0adefdb08ed4b52dc9140af43a11f9
- SSDEEP 24576:avO2xJKRI2FOkx2LFEvcUQPxuZ98Es8k3OH3C0rQ6+8pKJ3:aHHKO29QG5QZuTtS0rQMY9
- TLSH T17F557D21F741C036D5AB017186B94BAFA578BD61072555C7B3C87E3A2FB22D2AE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5096 d1dd1f65 - Unexpected DNS network traffic destination 6 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 21 114.114.114.114 2992 bf8317c50f6d21d8d5948bc57230f07aa641ff86141b6ab0fc6ad50273d319b5.exe Destination IP 22 223.5.5.5 2992 bf8317c50f6d21d8d5948bc57230f07aa641ff86141b6ab0fc6ad50273d319b5.exe Destination IP 57 114.114.114.114 2992 bf8317c50f6d21d8d5948bc57230f07aa641ff86141b6ab0fc6ad50273d319b5.exe Destination IP 58 223.5.5.5 2992 bf8317c50f6d21d8d5948bc57230f07aa641ff86141b6ab0fc6ad50273d319b5.exe Destination IP 2 114.114.114.114 2992 bf8317c50f6d21d8d5948bc57230f07aa641ff86141b6ab0fc6ad50273d319b5.exe Destination IP 5 223.5.5.5 2992 bf8317c50f6d21d8d5948bc57230f07aa641ff86141b6ab0fc6ad50273d319b5.exe - Drops file in System32 directory 13 IoCs
description ioc Process File created C:\Windows\SysWOW64\d1dd1f65 bf8317c50f6d21d8d5948bc57230f07aa641ff86141b6ab0fc6ad50273d319b5.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 d1dd1f65 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE d1dd1f65 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache d1dd1f65 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData d1dd1f65 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content d1dd1f65 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 d1dd1f65 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 d1dd1f65 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies d1dd1f65 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 d1dd1f65 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft d1dd1f65 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 d1dd1f65 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 d1dd1f65 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\573ed0 d1dd1f65 File opened for modification C:\Windows\333960 bf8317c50f6d21d8d5948bc57230f07aa641ff86141b6ab0fc6ad50273d319b5.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bf8317c50f6d21d8d5948bc57230f07aa641ff86141b6ab0fc6ad50273d319b5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d1dd1f65 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ d1dd1f65 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" d1dd1f65 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" d1dd1f65 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" d1dd1f65 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" d1dd1f65 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" d1dd1f65 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" d1dd1f65 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing d1dd1f65 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix d1dd1f65 - Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 5096 d1dd1f65 5096 d1dd1f65 5096 d1dd1f65 5096 d1dd1f65 5096 d1dd1f65 5096 d1dd1f65 5096 d1dd1f65 5096 d1dd1f65 5096 d1dd1f65 5096 d1dd1f65 5096 d1dd1f65 5096 d1dd1f65 5096 d1dd1f65 5096 d1dd1f65 5096 d1dd1f65 5096 d1dd1f65 5096 d1dd1f65 5096 d1dd1f65 5096 d1dd1f65 5096 d1dd1f65 2992 bf8317c50f6d21d8d5948bc57230f07aa641ff86141b6ab0fc6ad50273d319b5.exe 2992 bf8317c50f6d21d8d5948bc57230f07aa641ff86141b6ab0fc6ad50273d319b5.exe 2992 bf8317c50f6d21d8d5948bc57230f07aa641ff86141b6ab0fc6ad50273d319b5.exe 2992 bf8317c50f6d21d8d5948bc57230f07aa641ff86141b6ab0fc6ad50273d319b5.exe 2992 bf8317c50f6d21d8d5948bc57230f07aa641ff86141b6ab0fc6ad50273d319b5.exe 2992 bf8317c50f6d21d8d5948bc57230f07aa641ff86141b6ab0fc6ad50273d319b5.exe 2992 bf8317c50f6d21d8d5948bc57230f07aa641ff86141b6ab0fc6ad50273d319b5.exe 2992 bf8317c50f6d21d8d5948bc57230f07aa641ff86141b6ab0fc6ad50273d319b5.exe 2992 bf8317c50f6d21d8d5948bc57230f07aa641ff86141b6ab0fc6ad50273d319b5.exe 2992 bf8317c50f6d21d8d5948bc57230f07aa641ff86141b6ab0fc6ad50273d319b5.exe 2992 bf8317c50f6d21d8d5948bc57230f07aa641ff86141b6ab0fc6ad50273d319b5.exe 2992 bf8317c50f6d21d8d5948bc57230f07aa641ff86141b6ab0fc6ad50273d319b5.exe 2992 bf8317c50f6d21d8d5948bc57230f07aa641ff86141b6ab0fc6ad50273d319b5.exe 2992 bf8317c50f6d21d8d5948bc57230f07aa641ff86141b6ab0fc6ad50273d319b5.exe 2992 bf8317c50f6d21d8d5948bc57230f07aa641ff86141b6ab0fc6ad50273d319b5.exe 2992 bf8317c50f6d21d8d5948bc57230f07aa641ff86141b6ab0fc6ad50273d319b5.exe 2992 bf8317c50f6d21d8d5948bc57230f07aa641ff86141b6ab0fc6ad50273d319b5.exe 2992 bf8317c50f6d21d8d5948bc57230f07aa641ff86141b6ab0fc6ad50273d319b5.exe 2992 bf8317c50f6d21d8d5948bc57230f07aa641ff86141b6ab0fc6ad50273d319b5.exe 2992 bf8317c50f6d21d8d5948bc57230f07aa641ff86141b6ab0fc6ad50273d319b5.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2992 bf8317c50f6d21d8d5948bc57230f07aa641ff86141b6ab0fc6ad50273d319b5.exe Token: SeTcbPrivilege 2992 bf8317c50f6d21d8d5948bc57230f07aa641ff86141b6ab0fc6ad50273d319b5.exe Token: SeDebugPrivilege 5096 d1dd1f65 Token: SeTcbPrivilege 5096 d1dd1f65
Processes
-
C:\Users\Admin\AppData\Local\Temp\bf8317c50f6d21d8d5948bc57230f07aa641ff86141b6ab0fc6ad50273d319b5.exe"C:\Users\Admin\AppData\Local\Temp\bf8317c50f6d21d8d5948bc57230f07aa641ff86141b6ab0fc6ad50273d319b5.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2992
-
C:\Windows\Syswow64\d1dd1f65C:\Windows\Syswow64\d1dd1f651⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5096
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\573ed0
- Size 916B
- SHA256 3921870fe4ccae4eaa28ac652c9e24d192dc08b45d6992f34dcc77327a79032c
- MD5 f2c1180a3af1c94ef70f42bb4be9c603
- SHA1 d445e1f2be6273f718101fdf5a9a1ed695aa28ec
- SHA512 d8a17ec40d557a4639d8df189bdae0509de1cd9f2545f4e304fae9011d30483b69cb9eca51675f86b5a8aafbba87886dc85d64cba8736510d49b89f018d37a5a
- TLSH T14711B2A614A4DAE3ECBB01747AE319CC7E3138D687CB611388A351C365A275AC652052
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\d1dd1f65
- Size 1.2MB
- SHA256 b64686af124400fa3c955dc16d4070ddea3e686cc58b380aa6db5e0d34484771
- MD5 e59e859a9e2dcd0352496b3f86ff6c7a
- SHA1 bfe62c7a3fc1b4d2798632a83002da23007f0b50
- SHA512 d793cb41fb4400dcc411009968465d8923a11154ff32596411fc5908b26bafa5bb88b16ed80d196994c5926210c310a10fb916c769e53ec18a1a226cc13a9fd9
- SSDEEP 24576:BvO2xJKRI2FOkx2LFEvcUQPxuZ98Es8k3OH3C0rQ6+8pKJ3:BHHKO29QG5QZuTtS0rQMY9
- TLSH T1C8557D21F741C036D5AB017186B94BAFA578BD61072555C7B3C87E3A2FB22D2AE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH