Analysis
- max time kernel
148s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
26/08/2026, 21:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
27d059ff889359e98854c8c35db40d951a7198f2f385f33fc40d44adc272351e.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
27d059ff889359e98854c8c35db40d951a7198f2f385f33fc40d44adc272351e.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 27d059ff889359e98854c8c35db40d951a7198f2f385f33fc40d44adc272351e.exe
- Size 1.1MB
- Sample260826-1pcxtsff37
- SHA256 27d059ff889359e98854c8c35db40d951a7198f2f385f33fc40d44adc272351e
- MD5 b469e13d5d54ba38a7426f6ba74c14a1
- SHA1 8fe3070ee7325171ae44c80bf2e3eb6303700034
- SHA512 a3735fd30c95adf5afac4303a8ffc8cf040accdd1b4311a3e3ac3d467d70a12d54b4a30800b1a84ca33900dcd781af54e02e00ec7cc3ec7a78a507c684b1abf0
- SSDEEP 24576:5vO2xJKRI2dOkx2LFAAX1oOYSY82e5QPJJOgufWWsYo:5HHKO2FQd1oOU82lPJ6Po
- TLSH T15C359D12F7A1C072C8A7427448B6C36EA675BC152B214BCBB7C03B5E5E723D1AE36359
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4840 e1f69700 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 1 114.114.114.114 1208 27d059ff889359e98854c8c35db40d951a7198f2f385f33fc40d44adc272351e.exe Destination IP 4 223.5.5.5 1208 27d059ff889359e98854c8c35db40d951a7198f2f385f33fc40d44adc272351e.exe Destination IP 26 114.114.114.114 1208 27d059ff889359e98854c8c35db40d951a7198f2f385f33fc40d44adc272351e.exe Destination IP 27 223.5.5.5 1208 27d059ff889359e98854c8c35db40d951a7198f2f385f33fc40d44adc272351e.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft e1f69700 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache e1f69700 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 e1f69700 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content e1f69700 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 e1f69700 File created C:\Windows\SysWOW64\e1f69700 27d059ff889359e98854c8c35db40d951a7198f2f385f33fc40d44adc272351e.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE e1f69700 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies e1f69700 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 e1f69700 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData e1f69700 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 e1f69700 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 e1f69700 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 e1f69700 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\14ae70 27d059ff889359e98854c8c35db40d951a7198f2f385f33fc40d44adc272351e.exe File opened for modification C:\Windows\52dcd0 e1f69700 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27d059ff889359e98854c8c35db40d951a7198f2f385f33fc40d44adc272351e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e1f69700 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" e1f69700 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing e1f69700 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix e1f69700 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" e1f69700 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ e1f69700 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" e1f69700 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" e1f69700 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" e1f69700 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" e1f69700 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 4840 e1f69700 4840 e1f69700 4840 e1f69700 4840 e1f69700 4840 e1f69700 4840 e1f69700 4840 e1f69700 4840 e1f69700 1208 27d059ff889359e98854c8c35db40d951a7198f2f385f33fc40d44adc272351e.exe 1208 27d059ff889359e98854c8c35db40d951a7198f2f385f33fc40d44adc272351e.exe 1208 27d059ff889359e98854c8c35db40d951a7198f2f385f33fc40d44adc272351e.exe 1208 27d059ff889359e98854c8c35db40d951a7198f2f385f33fc40d44adc272351e.exe 1208 27d059ff889359e98854c8c35db40d951a7198f2f385f33fc40d44adc272351e.exe 1208 27d059ff889359e98854c8c35db40d951a7198f2f385f33fc40d44adc272351e.exe 1208 27d059ff889359e98854c8c35db40d951a7198f2f385f33fc40d44adc272351e.exe 1208 27d059ff889359e98854c8c35db40d951a7198f2f385f33fc40d44adc272351e.exe 1208 27d059ff889359e98854c8c35db40d951a7198f2f385f33fc40d44adc272351e.exe 1208 27d059ff889359e98854c8c35db40d951a7198f2f385f33fc40d44adc272351e.exe 1208 27d059ff889359e98854c8c35db40d951a7198f2f385f33fc40d44adc272351e.exe 1208 27d059ff889359e98854c8c35db40d951a7198f2f385f33fc40d44adc272351e.exe 1208 27d059ff889359e98854c8c35db40d951a7198f2f385f33fc40d44adc272351e.exe 1208 27d059ff889359e98854c8c35db40d951a7198f2f385f33fc40d44adc272351e.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1208 27d059ff889359e98854c8c35db40d951a7198f2f385f33fc40d44adc272351e.exe Token: SeTcbPrivilege 1208 27d059ff889359e98854c8c35db40d951a7198f2f385f33fc40d44adc272351e.exe Token: SeDebugPrivilege 4840 e1f69700 Token: SeTcbPrivilege 4840 e1f69700
Processes
-
C:\Users\Admin\AppData\Local\Temp\27d059ff889359e98854c8c35db40d951a7198f2f385f33fc40d44adc272351e.exe"C:\Users\Admin\AppData\Local\Temp\27d059ff889359e98854c8c35db40d951a7198f2f385f33fc40d44adc272351e.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1208
-
C:\Windows\Syswow64\e1f69700C:\Windows\Syswow64\e1f697001⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4840
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\e1f69700
- Size 1.1MB
- SHA256 23f9db768a7adf0619c25c48ab4b01377569f0f034a8a4fda84577ecac29591c
- MD5 23c9ac7773dc9a8441ead19bd70be251
- SHA1 c012049c15ddb1fe10351c7dc7fe20a898fdc51f
- SHA512 2f9fcf210032b4cabced3c8ca613b3e192536e404fc437bc4dc154703a2e3f2a9bf483b79da861ef8719fea056b85549bb32a481c236984ba8be7f3771a9e1f9
- SSDEEP 24576:ovO2xJKRI2dOkx2LFAAX1oOYSY82e5QPJJOgufWWsYo:oHHKO2FQd1oOU82lPJ6Po
- TLSH T1B5359D12F7A1C072C8A7427448B6C36EA675BC152B214BCBB7C03B5E5E723D1AE36359
- MD5 SHA1 SHA512 SSDEEP TLSH