Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
31/08/2026, 02:57
Behavioral task
behavioral1
Sample
2fddbc75a1f997e9184720edb828866745a32ead0700cc0745a0b33b86f42e91.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 2fddbc75a1f997e9184720edb828866745a32ead0700cc0745a0b33b86f42e91.exe
- Size 618KB
- Sample260831-dfphyawwgx
- SHA256 2fddbc75a1f997e9184720edb828866745a32ead0700cc0745a0b33b86f42e91
- MD5 98662477bc88951d4c61417f20452e36
- SHA1 bbcd70f377503db291f4daa1fcc238a0ef9e8dfc
- SHA512 ab14213783ab58a5998a82d2ec7c0b6210612c3d557981aed746a69e3f98906887d6777361f76600f7ea0a21c2538ed551400af2441c992045aed80463959f12
- SSDEEP 12288:7qXUHkUXe39sOkx2LIan5FAQjU/Lik8CQ3uEW:7jHPOSOkx2LFscUQPxW
- TLSH T1EBD47C31E201C03AD0A74576C6FE0BAFA5687D25431662C7A3D479362FF72D2AA3171E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2496 8c33e832 - Unexpected DNS network traffic destination 18 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 293 223.5.5.5 944 2fddbc75a1f997e9184720edb828866745a32ead0700cc0745a0b33b86f42e91.exe Destination IP 323 223.5.5.5 944 2fddbc75a1f997e9184720edb828866745a32ead0700cc0745a0b33b86f42e91.exe Destination IP 377 223.5.5.5 944 2fddbc75a1f997e9184720edb828866745a32ead0700cc0745a0b33b86f42e91.exe Destination IP 1 114.114.114.114 944 2fddbc75a1f997e9184720edb828866745a32ead0700cc0745a0b33b86f42e91.exe Destination IP 101 114.114.114.114 944 2fddbc75a1f997e9184720edb828866745a32ead0700cc0745a0b33b86f42e91.exe Destination IP 164 114.114.114.114 944 2fddbc75a1f997e9184720edb828866745a32ead0700cc0745a0b33b86f42e91.exe Destination IP 165 223.5.5.5 944 2fddbc75a1f997e9184720edb828866745a32ead0700cc0745a0b33b86f42e91.exe Destination IP 235 114.114.114.114 944 2fddbc75a1f997e9184720edb828866745a32ead0700cc0745a0b33b86f42e91.exe Destination IP 236 223.5.5.5 944 2fddbc75a1f997e9184720edb828866745a32ead0700cc0745a0b33b86f42e91.exe Destination IP 3 223.5.5.5 944 2fddbc75a1f997e9184720edb828866745a32ead0700cc0745a0b33b86f42e91.exe Destination IP 40 114.114.114.114 944 2fddbc75a1f997e9184720edb828866745a32ead0700cc0745a0b33b86f42e91.exe Destination IP 41 223.5.5.5 944 2fddbc75a1f997e9184720edb828866745a32ead0700cc0745a0b33b86f42e91.exe Destination IP 103 223.5.5.5 944 2fddbc75a1f997e9184720edb828866745a32ead0700cc0745a0b33b86f42e91.exe Destination IP 322 114.114.114.114 944 2fddbc75a1f997e9184720edb828866745a32ead0700cc0745a0b33b86f42e91.exe Destination IP 95 114.114.114.114 2496 8c33e832 Destination IP 292 114.114.114.114 944 2fddbc75a1f997e9184720edb828866745a32ead0700cc0745a0b33b86f42e91.exe Destination IP 376 114.114.114.114 944 2fddbc75a1f997e9184720edb828866745a32ead0700cc0745a0b33b86f42e91.exe Destination IP 96 223.5.5.5 944 2fddbc75a1f997e9184720edb828866745a32ead0700cc0745a0b33b86f42e91.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 8c33e832 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 8c33e832 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 8c33e832 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 8c33e832 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 8c33e832 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 8c33e832 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 8c33e832 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 8c33e832 File created C:\Windows\SysWOW64\8c33e832 2fddbc75a1f997e9184720edb828866745a32ead0700cc0745a0b33b86f42e91.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 8c33e832 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 8c33e832 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 8c33e832 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 8c33e832 -
resource yara_rule behavioral2/memory/944-0-0x0000000000D00000-0x0000000000D89000-memory.dmp upx behavioral2/files/0x000f00000001b1d0-2.dat upx behavioral2/memory/2496-3-0x0000000000960000-0x00000000009E9000-memory.dmp upx behavioral2/memory/944-16-0x0000000000D00000-0x0000000000D89000-memory.dmp upx behavioral2/memory/2496-18-0x0000000000960000-0x00000000009E9000-memory.dmp upx behavioral2/memory/944-41-0x0000000000D00000-0x0000000000D89000-memory.dmp upx behavioral2/memory/2496-42-0x0000000000960000-0x00000000009E9000-memory.dmp upx behavioral2/memory/944-45-0x0000000000D00000-0x0000000000D89000-memory.dmp upx behavioral2/memory/2496-46-0x0000000000960000-0x00000000009E9000-memory.dmp upx behavioral2/memory/944-52-0x0000000000D00000-0x0000000000D89000-memory.dmp upx behavioral2/memory/944-53-0x0000000000D00000-0x0000000000D89000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\2abb80 8c33e832 File opened for modification C:\Windows\102960 2fddbc75a1f997e9184720edb828866745a32ead0700cc0745a0b33b86f42e91.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c33e832 Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2fddbc75a1f997e9184720edb828866745a32ead0700cc0745a0b33b86f42e91.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 8c33e832 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 8c33e832 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 8c33e832 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 8c33e832 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 8c33e832 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 8c33e832 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 8c33e832 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 8c33e832 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 8c33e832 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 2496 8c33e832 2496 8c33e832 2496 8c33e832 2496 8c33e832 2496 8c33e832 2496 8c33e832 2496 8c33e832 2496 8c33e832 944 2fddbc75a1f997e9184720edb828866745a32ead0700cc0745a0b33b86f42e91.exe 944 2fddbc75a1f997e9184720edb828866745a32ead0700cc0745a0b33b86f42e91.exe 944 2fddbc75a1f997e9184720edb828866745a32ead0700cc0745a0b33b86f42e91.exe 944 2fddbc75a1f997e9184720edb828866745a32ead0700cc0745a0b33b86f42e91.exe 944 2fddbc75a1f997e9184720edb828866745a32ead0700cc0745a0b33b86f42e91.exe 944 2fddbc75a1f997e9184720edb828866745a32ead0700cc0745a0b33b86f42e91.exe 944 2fddbc75a1f997e9184720edb828866745a32ead0700cc0745a0b33b86f42e91.exe 944 2fddbc75a1f997e9184720edb828866745a32ead0700cc0745a0b33b86f42e91.exe 944 2fddbc75a1f997e9184720edb828866745a32ead0700cc0745a0b33b86f42e91.exe 944 2fddbc75a1f997e9184720edb828866745a32ead0700cc0745a0b33b86f42e91.exe 944 2fddbc75a1f997e9184720edb828866745a32ead0700cc0745a0b33b86f42e91.exe 944 2fddbc75a1f997e9184720edb828866745a32ead0700cc0745a0b33b86f42e91.exe 944 2fddbc75a1f997e9184720edb828866745a32ead0700cc0745a0b33b86f42e91.exe 944 2fddbc75a1f997e9184720edb828866745a32ead0700cc0745a0b33b86f42e91.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 944 2fddbc75a1f997e9184720edb828866745a32ead0700cc0745a0b33b86f42e91.exe Token: SeTcbPrivilege 944 2fddbc75a1f997e9184720edb828866745a32ead0700cc0745a0b33b86f42e91.exe Token: SeDebugPrivilege 2496 8c33e832 Token: SeTcbPrivilege 2496 8c33e832
Processes
-
C:\Users\Admin\AppData\Local\Temp\2fddbc75a1f997e9184720edb828866745a32ead0700cc0745a0b33b86f42e91.exe"C:\Users\Admin\AppData\Local\Temp\2fddbc75a1f997e9184720edb828866745a32ead0700cc0745a0b33b86f42e91.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:944
-
C:\Windows\Syswow64\8c33e832C:\Windows\Syswow64\8c33e8321⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2496
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\8c33e832
- Size 618KB
- SHA256 0c930b9303b937f58d74c8c3fc7d696d84c4350d4390f15932b73d796822a4af
- MD5 71b692b0c7bcea72dd61846adfea7436
- SHA1 dfb92e8efa60bfb4a7dde26341d47e4da4e15aed
- SHA512 c3b119fc2e1ac1712986667d9b7cea9bb29c3d87e1553499568bcae2311c3a95dac4af11cb7321df8d441b19d1a6c58b5b48daa791ff3a6f947a2eac9aa97439
- SSDEEP 12288:dqXUHkUXe39sOkx2LIan5FAQjU/Lik8CQ3uEW:djHPOSOkx2LFscUQPxW
- TLSH T142D47C31E201C03AD0A74576C6FE0BAFA5687D25431662C7A3D479362FF72D2AA3171E
- MD5 SHA1 SHA512 SSDEEP TLSH