Analysis
- max time kernel
148s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
31/08/2026, 00:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cc7d1b655fc3b40d96ffd509a50428bb58969c76cd4fde295870ce9e1736fcde.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
cc7d1b655fc3b40d96ffd509a50428bb58969c76cd4fde295870ce9e1736fcde.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target cc7d1b655fc3b40d96ffd509a50428bb58969c76cd4fde295870ce9e1736fcde.exe
- Size 1.1MB
- Sample260831-avr1tsvvht
- SHA256 cc7d1b655fc3b40d96ffd509a50428bb58969c76cd4fde295870ce9e1736fcde
- MD5 5d36a5cb4bdbac4fb0afe4bfa2b7ad7c
- SHA1 96e541a283051fd3794a252e2774b6f157bda839
- SHA512 36acd0f8ac087232e93c5b2fdeb6d6eae996d323633f349259c825b4234433c1e355e145c0b0fd452cb59cdf3c6d990e73bb78a29383bb11e548894a7351961d
- SSDEEP 24576:hvO2xJKRI2dOkx2LFAAX1oOYSY82e5QPJJOgufWWsYo:hHHKO2FQd1oOU82lPJ6Po
- TLSH T1FB359D12F7A1C072C8A7427448B6C36EA675BC152B214BCBB7C03B5E5E723D1AE36359
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3988 6888310c - Unexpected DNS network traffic destination 18 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 180 114.114.114.114 4416 cc7d1b655fc3b40d96ffd509a50428bb58969c76cd4fde295870ce9e1736fcde.exe Destination IP 376 114.114.114.114 4416 cc7d1b655fc3b40d96ffd509a50428bb58969c76cd4fde295870ce9e1736fcde.exe Destination IP 121 114.114.114.114 4416 cc7d1b655fc3b40d96ffd509a50428bb58969c76cd4fde295870ce9e1736fcde.exe Destination IP 292 114.114.114.114 4416 cc7d1b655fc3b40d96ffd509a50428bb58969c76cd4fde295870ce9e1736fcde.exe Destination IP 3 114.114.114.114 4416 cc7d1b655fc3b40d96ffd509a50428bb58969c76cd4fde295870ce9e1736fcde.exe Destination IP 95 114.114.114.114 3988 6888310c Destination IP 123 223.5.5.5 4416 cc7d1b655fc3b40d96ffd509a50428bb58969c76cd4fde295870ce9e1736fcde.exe Destination IP 322 114.114.114.114 4416 cc7d1b655fc3b40d96ffd509a50428bb58969c76cd4fde295870ce9e1736fcde.exe Destination IP 4 223.5.5.5 4416 cc7d1b655fc3b40d96ffd509a50428bb58969c76cd4fde295870ce9e1736fcde.exe Destination IP 96 223.5.5.5 4416 cc7d1b655fc3b40d96ffd509a50428bb58969c76cd4fde295870ce9e1736fcde.exe Destination IP 182 223.5.5.5 4416 cc7d1b655fc3b40d96ffd509a50428bb58969c76cd4fde295870ce9e1736fcde.exe Destination IP 235 114.114.114.114 4416 cc7d1b655fc3b40d96ffd509a50428bb58969c76cd4fde295870ce9e1736fcde.exe Destination IP 236 223.5.5.5 4416 cc7d1b655fc3b40d96ffd509a50428bb58969c76cd4fde295870ce9e1736fcde.exe Destination IP 293 223.5.5.5 4416 cc7d1b655fc3b40d96ffd509a50428bb58969c76cd4fde295870ce9e1736fcde.exe Destination IP 323 223.5.5.5 4416 cc7d1b655fc3b40d96ffd509a50428bb58969c76cd4fde295870ce9e1736fcde.exe Destination IP 377 223.5.5.5 4416 cc7d1b655fc3b40d96ffd509a50428bb58969c76cd4fde295870ce9e1736fcde.exe Destination IP 40 114.114.114.114 4416 cc7d1b655fc3b40d96ffd509a50428bb58969c76cd4fde295870ce9e1736fcde.exe Destination IP 41 223.5.5.5 4416 cc7d1b655fc3b40d96ffd509a50428bb58969c76cd4fde295870ce9e1736fcde.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 6888310c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 6888310c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 6888310c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 6888310c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 6888310c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 6888310c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 6888310c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 6888310c File created C:\Windows\SysWOW64\6888310c cc7d1b655fc3b40d96ffd509a50428bb58969c76cd4fde295870ce9e1736fcde.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 6888310c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 6888310c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 6888310c File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 6888310c - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\4446a8 6888310c File opened for modification C:\Windows\4b9a80 cc7d1b655fc3b40d96ffd509a50428bb58969c76cd4fde295870ce9e1736fcde.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cc7d1b655fc3b40d96ffd509a50428bb58969c76cd4fde295870ce9e1736fcde.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6888310c - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 6888310c Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 6888310c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 6888310c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 6888310c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 6888310c Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 6888310c Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 6888310c Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 6888310c Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 6888310c - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 3988 6888310c 3988 6888310c 3988 6888310c 3988 6888310c 3988 6888310c 3988 6888310c 3988 6888310c 3988 6888310c 4416 cc7d1b655fc3b40d96ffd509a50428bb58969c76cd4fde295870ce9e1736fcde.exe 4416 cc7d1b655fc3b40d96ffd509a50428bb58969c76cd4fde295870ce9e1736fcde.exe 4416 cc7d1b655fc3b40d96ffd509a50428bb58969c76cd4fde295870ce9e1736fcde.exe 4416 cc7d1b655fc3b40d96ffd509a50428bb58969c76cd4fde295870ce9e1736fcde.exe 4416 cc7d1b655fc3b40d96ffd509a50428bb58969c76cd4fde295870ce9e1736fcde.exe 4416 cc7d1b655fc3b40d96ffd509a50428bb58969c76cd4fde295870ce9e1736fcde.exe 4416 cc7d1b655fc3b40d96ffd509a50428bb58969c76cd4fde295870ce9e1736fcde.exe 4416 cc7d1b655fc3b40d96ffd509a50428bb58969c76cd4fde295870ce9e1736fcde.exe 4416 cc7d1b655fc3b40d96ffd509a50428bb58969c76cd4fde295870ce9e1736fcde.exe 4416 cc7d1b655fc3b40d96ffd509a50428bb58969c76cd4fde295870ce9e1736fcde.exe 4416 cc7d1b655fc3b40d96ffd509a50428bb58969c76cd4fde295870ce9e1736fcde.exe 4416 cc7d1b655fc3b40d96ffd509a50428bb58969c76cd4fde295870ce9e1736fcde.exe 4416 cc7d1b655fc3b40d96ffd509a50428bb58969c76cd4fde295870ce9e1736fcde.exe 4416 cc7d1b655fc3b40d96ffd509a50428bb58969c76cd4fde295870ce9e1736fcde.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4416 cc7d1b655fc3b40d96ffd509a50428bb58969c76cd4fde295870ce9e1736fcde.exe Token: SeTcbPrivilege 4416 cc7d1b655fc3b40d96ffd509a50428bb58969c76cd4fde295870ce9e1736fcde.exe Token: SeDebugPrivilege 3988 6888310c Token: SeTcbPrivilege 3988 6888310c
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc7d1b655fc3b40d96ffd509a50428bb58969c76cd4fde295870ce9e1736fcde.exe"C:\Users\Admin\AppData\Local\Temp\cc7d1b655fc3b40d96ffd509a50428bb58969c76cd4fde295870ce9e1736fcde.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4416
-
C:\Windows\Syswow64\6888310cC:\Windows\Syswow64\6888310c1⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3988
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\6888310c
- Size 1.1MB
- SHA256 5fa644675a52cd7099f63a60d6c215181413278a123b249cac7540c1dc03256d
- MD5 2158a5aa553b0177974b837a3f0d6f90
- SHA1 781ac2799423ecf6b9052b566776289ffd2ae045
- SHA512 27a11e7f89537e705048f67d3e21f2c61cf1c748d2b5d37f0e73ad8ca48d95db9c1c7d2653bd13903a53ef2eb5fd059a47644eae8c171022f90d8f9b35cab67d
- SSDEEP 24576:mvO2xJKRI2dOkx2LFAAX1oOYSY82e5QPJJOgufWWsYo:mHHKO2FQd1oOU82lPJ6Po
- TLSH T174359D12F7A1C072C8A7427448B6C36EA675BC152B214BCBB7C03B5E5E723D1AE36359
- MD5 SHA1 SHA512 SSDEEP TLSH