Analysis
- max time kernel
150s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/09/2026, 09:48
Behavioral task
behavioral1
Sample
7882174e167ade6ead17ec5989b5d38fc3a4a5b80d52b9034c1ad56cae8213ef.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 7882174e167ade6ead17ec5989b5d38fc3a4a5b80d52b9034c1ad56cae8213ef.exe
- Size 766KB
- Sample260903-ls7jaagd77
- SHA256 7882174e167ade6ead17ec5989b5d38fc3a4a5b80d52b9034c1ad56cae8213ef
- MD5 5278ace238ecb0f25835b7265c22772c
- SHA1 85c8b6033c816431f88131d98ae0471dcd1434dc
- SHA512 e1f5dd73e8cf387cb1f4989d7eacc083c5076467c2ba6281ecb717ba5e4bedbcf486990d7fcf8f8ecf789f38451472af4c331bfa660c9ae92da8e0805014a2cb
- SSDEEP 12288:SSvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/Liw:5vO2xJKRw2kOkx2LFRvcUV
- TLSH T1C9F45A31E241C03AD0A74576C6FA0BAFE564BD25531155CBA3C43A6A2FB36D2BE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3932 76fa9d74 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 1 114.114.114.114 5104 7882174e167ade6ead17ec5989b5d38fc3a4a5b80d52b9034c1ad56cae8213ef.exe Destination IP 2 223.5.5.5 5104 7882174e167ade6ead17ec5989b5d38fc3a4a5b80d52b9034c1ad56cae8213ef.exe Destination IP 9 114.114.114.114 5104 7882174e167ade6ead17ec5989b5d38fc3a4a5b80d52b9034c1ad56cae8213ef.exe Destination IP 10 223.5.5.5 5104 7882174e167ade6ead17ec5989b5d38fc3a4a5b80d52b9034c1ad56cae8213ef.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 76fa9d74 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 76fa9d74 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 76fa9d74 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 76fa9d74 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 76fa9d74 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 76fa9d74 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 76fa9d74 File created C:\Windows\SysWOW64\76fa9d74 7882174e167ade6ead17ec5989b5d38fc3a4a5b80d52b9034c1ad56cae8213ef.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 76fa9d74 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 76fa9d74 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 76fa9d74 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 76fa9d74 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 76fa9d74 -
resource yara_rule behavioral2/memory/5104-0-0x00000000004A0000-0x000000000052C000-memory.dmp upx behavioral2/files/0x001000000001b664-2.dat upx behavioral2/memory/3932-3-0x00000000004C0000-0x000000000054C000-memory.dmp upx behavioral2/memory/5104-10-0x00000000004A0000-0x000000000052C000-memory.dmp upx behavioral2/memory/3932-11-0x00000000004C0000-0x000000000054C000-memory.dmp upx behavioral2/memory/3932-24-0x00000000004C0000-0x000000000054C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\435138 76fa9d74 File opened for modification C:\Windows\5761e0 7882174e167ade6ead17ec5989b5d38fc3a4a5b80d52b9034c1ad56cae8213ef.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7882174e167ade6ead17ec5989b5d38fc3a4a5b80d52b9034c1ad56cae8213ef.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 76fa9d74 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 76fa9d74 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 76fa9d74 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 76fa9d74 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 76fa9d74 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 76fa9d74 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 76fa9d74 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 76fa9d74 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 76fa9d74 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 76fa9d74 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 3932 76fa9d74 3932 76fa9d74 3932 76fa9d74 3932 76fa9d74 3932 76fa9d74 3932 76fa9d74 3932 76fa9d74 3932 76fa9d74 5104 7882174e167ade6ead17ec5989b5d38fc3a4a5b80d52b9034c1ad56cae8213ef.exe 5104 7882174e167ade6ead17ec5989b5d38fc3a4a5b80d52b9034c1ad56cae8213ef.exe 5104 7882174e167ade6ead17ec5989b5d38fc3a4a5b80d52b9034c1ad56cae8213ef.exe 5104 7882174e167ade6ead17ec5989b5d38fc3a4a5b80d52b9034c1ad56cae8213ef.exe 5104 7882174e167ade6ead17ec5989b5d38fc3a4a5b80d52b9034c1ad56cae8213ef.exe 5104 7882174e167ade6ead17ec5989b5d38fc3a4a5b80d52b9034c1ad56cae8213ef.exe 5104 7882174e167ade6ead17ec5989b5d38fc3a4a5b80d52b9034c1ad56cae8213ef.exe 5104 7882174e167ade6ead17ec5989b5d38fc3a4a5b80d52b9034c1ad56cae8213ef.exe 5104 7882174e167ade6ead17ec5989b5d38fc3a4a5b80d52b9034c1ad56cae8213ef.exe 5104 7882174e167ade6ead17ec5989b5d38fc3a4a5b80d52b9034c1ad56cae8213ef.exe 5104 7882174e167ade6ead17ec5989b5d38fc3a4a5b80d52b9034c1ad56cae8213ef.exe 5104 7882174e167ade6ead17ec5989b5d38fc3a4a5b80d52b9034c1ad56cae8213ef.exe 5104 7882174e167ade6ead17ec5989b5d38fc3a4a5b80d52b9034c1ad56cae8213ef.exe 5104 7882174e167ade6ead17ec5989b5d38fc3a4a5b80d52b9034c1ad56cae8213ef.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 5104 7882174e167ade6ead17ec5989b5d38fc3a4a5b80d52b9034c1ad56cae8213ef.exe Token: SeTcbPrivilege 5104 7882174e167ade6ead17ec5989b5d38fc3a4a5b80d52b9034c1ad56cae8213ef.exe Token: SeDebugPrivilege 3932 76fa9d74 Token: SeTcbPrivilege 3932 76fa9d74
Processes
-
C:\Users\Admin\AppData\Local\Temp\7882174e167ade6ead17ec5989b5d38fc3a4a5b80d52b9034c1ad56cae8213ef.exe"C:\Users\Admin\AppData\Local\Temp\7882174e167ade6ead17ec5989b5d38fc3a4a5b80d52b9034c1ad56cae8213ef.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5104
-
C:\Windows\Syswow64\76fa9d74C:\Windows\Syswow64\76fa9d741⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3932
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\76fa9d74
- Size 766KB
- SHA256 48f1421525a5215e3020f178dea0e7fe5be6cc4ebc8a834d2db218468794893b
- MD5 d451629703fe5cfb536f7a75ec4f2d4d
- SHA1 0975981c61c1830a9a34388f22817ea9629a1244
- SHA512 8a0acdeae8580d9a393cfc93625b1490967aefa9744a36ac63cd85c2265ebfd53f156d5aede948c0036adf45bc9fd6c7e5562c73e330c280f3a5757c60b12542
- SSDEEP 12288:xSvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/Liw:YvO2xJKRw2kOkx2LFRvcUV
- TLSH T13CF45A31E241C03AD0A74576C6FA0BAFE564BD25531155CBA3C43A6A2FB36D2BE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH