Analysis
- max time kernel
150s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/08/2026, 21:32
Behavioral task
behavioral1
Sample
0342b7e8df841f87adcb0441bdfa2b258b28f8dbfdd68068ccb0e0d2896c0ca8.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 0342b7e8df841f87adcb0441bdfa2b258b28f8dbfdd68068ccb0e0d2896c0ca8.exe
- Size 1024KB
- Sample260830-1d16aasvft
- SHA256 0342b7e8df841f87adcb0441bdfa2b258b28f8dbfdd68068ccb0e0d2896c0ca8
- MD5 fa1b78ec461c256d1b8f780ca70d8dcf
- SHA1 3d2d70db99a149d5d86b8bd0df739ca8712bbc3e
- SHA512 4a51bb290620ae7031a00256c505874320440f107e5267dada6ab6516eeb18af09a64074f5ec6ac87366c7a22fd73f9ba59f515dc25ea4b0fda5e4a08bb5af24
- SSDEEP 24576:0jHPOSOkx2LFscUQPxuZ98Es8k3OH3C0rQ6+y:0TGkQy5QZuTtS0rQi
- TLSH T1F3259E31E242C03AD5A70172C6BE4BAF95687D25432961C7A3D43D762FB62D2AA3170F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3256 9325f302 - Unexpected DNS network traffic destination 18 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 293 223.5.5.5 2936 0342b7e8df841f87adcb0441bdfa2b258b28f8dbfdd68068ccb0e0d2896c0ca8.exe Destination IP 4 223.5.5.5 2936 0342b7e8df841f87adcb0441bdfa2b258b28f8dbfdd68068ccb0e0d2896c0ca8.exe Destination IP 164 114.114.114.114 2936 0342b7e8df841f87adcb0441bdfa2b258b28f8dbfdd68068ccb0e0d2896c0ca8.exe Destination IP 165 223.5.5.5 2936 0342b7e8df841f87adcb0441bdfa2b258b28f8dbfdd68068ccb0e0d2896c0ca8.exe Destination IP 292 114.114.114.114 2936 0342b7e8df841f87adcb0441bdfa2b258b28f8dbfdd68068ccb0e0d2896c0ca8.exe Destination IP 1 114.114.114.114 2936 0342b7e8df841f87adcb0441bdfa2b258b28f8dbfdd68068ccb0e0d2896c0ca8.exe Destination IP 101 114.114.114.114 2936 0342b7e8df841f87adcb0441bdfa2b258b28f8dbfdd68068ccb0e0d2896c0ca8.exe Destination IP 322 114.114.114.114 2936 0342b7e8df841f87adcb0441bdfa2b258b28f8dbfdd68068ccb0e0d2896c0ca8.exe Destination IP 376 114.114.114.114 2936 0342b7e8df841f87adcb0441bdfa2b258b28f8dbfdd68068ccb0e0d2896c0ca8.exe Destination IP 377 223.5.5.5 2936 0342b7e8df841f87adcb0441bdfa2b258b28f8dbfdd68068ccb0e0d2896c0ca8.exe Destination IP 39 114.114.114.114 2936 0342b7e8df841f87adcb0441bdfa2b258b28f8dbfdd68068ccb0e0d2896c0ca8.exe Destination IP 103 223.5.5.5 2936 0342b7e8df841f87adcb0441bdfa2b258b28f8dbfdd68068ccb0e0d2896c0ca8.exe Destination IP 235 114.114.114.114 2936 0342b7e8df841f87adcb0441bdfa2b258b28f8dbfdd68068ccb0e0d2896c0ca8.exe Destination IP 236 223.5.5.5 2936 0342b7e8df841f87adcb0441bdfa2b258b28f8dbfdd68068ccb0e0d2896c0ca8.exe Destination IP 323 223.5.5.5 2936 0342b7e8df841f87adcb0441bdfa2b258b28f8dbfdd68068ccb0e0d2896c0ca8.exe Destination IP 40 223.5.5.5 2936 0342b7e8df841f87adcb0441bdfa2b258b28f8dbfdd68068ccb0e0d2896c0ca8.exe Destination IP 94 114.114.114.114 3256 9325f302 Destination IP 95 223.5.5.5 2936 0342b7e8df841f87adcb0441bdfa2b258b28f8dbfdd68068ccb0e0d2896c0ca8.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 9325f302 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 9325f302 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 9325f302 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 9325f302 File created C:\Windows\SysWOW64\9325f302 0342b7e8df841f87adcb0441bdfa2b258b28f8dbfdd68068ccb0e0d2896c0ca8.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 9325f302 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 9325f302 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 9325f302 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 9325f302 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 9325f302 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 9325f302 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 9325f302 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 9325f302 -
resource yara_rule behavioral2/memory/2936-0-0x0000000000BB0000-0x0000000000C39000-memory.dmp upx behavioral2/files/0x000a000000019cb3-2.dat upx behavioral2/memory/3256-3-0x0000000000BD0000-0x0000000000C59000-memory.dmp upx behavioral2/memory/2936-16-0x0000000000BB0000-0x0000000000C39000-memory.dmp upx behavioral2/memory/3256-18-0x0000000000BD0000-0x0000000000C59000-memory.dmp upx behavioral2/memory/2936-41-0x0000000000BB0000-0x0000000000C39000-memory.dmp upx behavioral2/memory/3256-42-0x0000000000BD0000-0x0000000000C59000-memory.dmp upx behavioral2/memory/3256-46-0x0000000000BD0000-0x0000000000C59000-memory.dmp upx behavioral2/memory/2936-52-0x0000000000BB0000-0x0000000000C39000-memory.dmp upx behavioral2/memory/2936-53-0x0000000000BB0000-0x0000000000C39000-memory.dmp upx behavioral2/memory/2936-58-0x0000000000BB0000-0x0000000000C39000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\37be70 9325f302 File opened for modification C:\Windows\3243f0 0342b7e8df841f87adcb0441bdfa2b258b28f8dbfdd68068ccb0e0d2896c0ca8.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0342b7e8df841f87adcb0441bdfa2b258b28f8dbfdd68068ccb0e0d2896c0ca8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9325f302 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 9325f302 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 9325f302 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 9325f302 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 9325f302 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 9325f302 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 9325f302 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 9325f302 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 9325f302 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 9325f302 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 3256 9325f302 3256 9325f302 3256 9325f302 3256 9325f302 3256 9325f302 3256 9325f302 3256 9325f302 3256 9325f302 2936 0342b7e8df841f87adcb0441bdfa2b258b28f8dbfdd68068ccb0e0d2896c0ca8.exe 2936 0342b7e8df841f87adcb0441bdfa2b258b28f8dbfdd68068ccb0e0d2896c0ca8.exe 2936 0342b7e8df841f87adcb0441bdfa2b258b28f8dbfdd68068ccb0e0d2896c0ca8.exe 2936 0342b7e8df841f87adcb0441bdfa2b258b28f8dbfdd68068ccb0e0d2896c0ca8.exe 2936 0342b7e8df841f87adcb0441bdfa2b258b28f8dbfdd68068ccb0e0d2896c0ca8.exe 2936 0342b7e8df841f87adcb0441bdfa2b258b28f8dbfdd68068ccb0e0d2896c0ca8.exe 2936 0342b7e8df841f87adcb0441bdfa2b258b28f8dbfdd68068ccb0e0d2896c0ca8.exe 2936 0342b7e8df841f87adcb0441bdfa2b258b28f8dbfdd68068ccb0e0d2896c0ca8.exe 2936 0342b7e8df841f87adcb0441bdfa2b258b28f8dbfdd68068ccb0e0d2896c0ca8.exe 2936 0342b7e8df841f87adcb0441bdfa2b258b28f8dbfdd68068ccb0e0d2896c0ca8.exe 2936 0342b7e8df841f87adcb0441bdfa2b258b28f8dbfdd68068ccb0e0d2896c0ca8.exe 2936 0342b7e8df841f87adcb0441bdfa2b258b28f8dbfdd68068ccb0e0d2896c0ca8.exe 2936 0342b7e8df841f87adcb0441bdfa2b258b28f8dbfdd68068ccb0e0d2896c0ca8.exe 2936 0342b7e8df841f87adcb0441bdfa2b258b28f8dbfdd68068ccb0e0d2896c0ca8.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2936 0342b7e8df841f87adcb0441bdfa2b258b28f8dbfdd68068ccb0e0d2896c0ca8.exe Token: SeTcbPrivilege 2936 0342b7e8df841f87adcb0441bdfa2b258b28f8dbfdd68068ccb0e0d2896c0ca8.exe Token: SeDebugPrivilege 3256 9325f302 Token: SeTcbPrivilege 3256 9325f302
Processes
-
C:\Users\Admin\AppData\Local\Temp\0342b7e8df841f87adcb0441bdfa2b258b28f8dbfdd68068ccb0e0d2896c0ca8.exe"C:\Users\Admin\AppData\Local\Temp\0342b7e8df841f87adcb0441bdfa2b258b28f8dbfdd68068ccb0e0d2896c0ca8.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2936
-
C:\Windows\Syswow64\9325f302C:\Windows\Syswow64\9325f3021⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3256
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\9325f302
- Size 1024KB
- SHA256 8158f8db5e69ad1566b9c0300798b17d199982522fe38e13259deb6ac90ecd5b
- MD5 bd8f1e504adb6f7fb21d1bc2db3914e0
- SHA1 d679e67b1a4b429ef1684f777871a0f1ed974b8b
- SHA512 679bc75a67c15823fff8ba3e9579937775d3291fdc53764b93a0b581ebd2e6dd77c496b029ab17be6f213dabc231ac2a72cddf296543a5176339b2d88748683c
- SSDEEP 24576:EjHPOSOkx2LFscUQPxuZ98Es8k3OH3C0rQ6+y:ETGkQy5QZuTtS0rQi
- TLSH T146259E31E242C03AD5A70172C6BE4BAF95687D25432961C7A3D43D762FB62D2AA3170F
- MD5 SHA1 SHA512 SSDEEP TLSH