Analysis
- max time kernel
150s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/09/2026, 04:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
114baa9a6bd4cbcd3b8452a97516ec8a1ef7d03e0ffa37a5b241ac72aeef578d.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
114baa9a6bd4cbcd3b8452a97516ec8a1ef7d03e0ffa37a5b241ac72aeef578d.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 114baa9a6bd4cbcd3b8452a97516ec8a1ef7d03e0ffa37a5b241ac72aeef578d.exe
- Size 395KB
- Sample260907-e17exswzbt
- SHA256 114baa9a6bd4cbcd3b8452a97516ec8a1ef7d03e0ffa37a5b241ac72aeef578d
- MD5 e6e82a7bc9f7f01cb3eba95654a8716b
- SHA1 3d7941bc739bca67703398301182c3c2d309e262
- SHA512 cc479f29a4cdc608ec7734ccb86b92b9990e58760f22c88c24b841fb11e366032decb61cf89ad1cfd3afc032f13bc1bda5e5b31a532a134e1d406d7421a4091a
- SSDEEP 6144:NQtK91cOo9qoiTpppLeIUfdLyO2QFicEOkCybEaQRXr9HNdvOaxy8K:N39OFaPpKIUfdLyO8Okx2LIaxy
- TLSH T1D6847D2AB7A0D076C4B79579C49247AAFEB1B42137204ACFA390475A1F237E2BD3570D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1632 dff871e0 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 17 223.5.5.5 1380 114baa9a6bd4cbcd3b8452a97516ec8a1ef7d03e0ffa37a5b241ac72aeef578d.exe Destination IP 1 114.114.114.114 1380 114baa9a6bd4cbcd3b8452a97516ec8a1ef7d03e0ffa37a5b241ac72aeef578d.exe Destination IP 4 223.5.5.5 1380 114baa9a6bd4cbcd3b8452a97516ec8a1ef7d03e0ffa37a5b241ac72aeef578d.exe Destination IP 16 114.114.114.114 1380 114baa9a6bd4cbcd3b8452a97516ec8a1ef7d03e0ffa37a5b241ac72aeef578d.exe - Drops file in System32 directory 15 IoCs
description ioc Process File created C:\Windows\SysWOW64\dff871e0 114baa9a6bd4cbcd3b8452a97516ec8a1ef7d03e0ffa37a5b241ac72aeef578d.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData dff871e0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 dff871e0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 dff871e0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE dff871e0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 dff871e0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft dff871e0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache dff871e0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 dff871e0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 dff871e0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies dff871e0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC845F33427F1C99AF855BE8930371C dff871e0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 dff871e0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content dff871e0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC845F33427F1C99AF855BE8930371C dff871e0 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\1bf0c0 dff871e0 File opened for modification C:\Windows\17a048 114baa9a6bd4cbcd3b8452a97516ec8a1ef7d03e0ffa37a5b241ac72aeef578d.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 114baa9a6bd4cbcd3b8452a97516ec8a1ef7d03e0ffa37a5b241ac72aeef578d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dff871e0 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix dff871e0 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" dff871e0 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ dff871e0 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" dff871e0 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" dff871e0 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" dff871e0 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing dff871e0 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" dff871e0 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" dff871e0 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 1632 dff871e0 1632 dff871e0 1632 dff871e0 1632 dff871e0 1632 dff871e0 1632 dff871e0 1632 dff871e0 1632 dff871e0 1380 114baa9a6bd4cbcd3b8452a97516ec8a1ef7d03e0ffa37a5b241ac72aeef578d.exe 1380 114baa9a6bd4cbcd3b8452a97516ec8a1ef7d03e0ffa37a5b241ac72aeef578d.exe 1380 114baa9a6bd4cbcd3b8452a97516ec8a1ef7d03e0ffa37a5b241ac72aeef578d.exe 1380 114baa9a6bd4cbcd3b8452a97516ec8a1ef7d03e0ffa37a5b241ac72aeef578d.exe 1380 114baa9a6bd4cbcd3b8452a97516ec8a1ef7d03e0ffa37a5b241ac72aeef578d.exe 1380 114baa9a6bd4cbcd3b8452a97516ec8a1ef7d03e0ffa37a5b241ac72aeef578d.exe 1380 114baa9a6bd4cbcd3b8452a97516ec8a1ef7d03e0ffa37a5b241ac72aeef578d.exe 1380 114baa9a6bd4cbcd3b8452a97516ec8a1ef7d03e0ffa37a5b241ac72aeef578d.exe 1380 114baa9a6bd4cbcd3b8452a97516ec8a1ef7d03e0ffa37a5b241ac72aeef578d.exe 1380 114baa9a6bd4cbcd3b8452a97516ec8a1ef7d03e0ffa37a5b241ac72aeef578d.exe 1380 114baa9a6bd4cbcd3b8452a97516ec8a1ef7d03e0ffa37a5b241ac72aeef578d.exe 1380 114baa9a6bd4cbcd3b8452a97516ec8a1ef7d03e0ffa37a5b241ac72aeef578d.exe 1380 114baa9a6bd4cbcd3b8452a97516ec8a1ef7d03e0ffa37a5b241ac72aeef578d.exe 1380 114baa9a6bd4cbcd3b8452a97516ec8a1ef7d03e0ffa37a5b241ac72aeef578d.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1380 114baa9a6bd4cbcd3b8452a97516ec8a1ef7d03e0ffa37a5b241ac72aeef578d.exe Token: SeTcbPrivilege 1380 114baa9a6bd4cbcd3b8452a97516ec8a1ef7d03e0ffa37a5b241ac72aeef578d.exe Token: SeDebugPrivilege 1632 dff871e0 Token: SeTcbPrivilege 1632 dff871e0
Processes
-
C:\Users\Admin\AppData\Local\Temp\114baa9a6bd4cbcd3b8452a97516ec8a1ef7d03e0ffa37a5b241ac72aeef578d.exe"C:\Users\Admin\AppData\Local\Temp\114baa9a6bd4cbcd3b8452a97516ec8a1ef7d03e0ffa37a5b241ac72aeef578d.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1380
-
C:\Windows\Syswow64\dff871e0C:\Windows\Syswow64\dff871e01⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1632
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\dff871e0
- Size 395KB
- SHA256 ad329387f21c3ba32c4ac5754ff85b030fe64347df49d327785622601da79633
- MD5 48c51b4ee4361c4df3e322eb59d1e71d
- SHA1 1f1425972d47c9747c5464f5f26fcdc76d5b0250
- SHA512 40a0c0ab5ea4841a88283e8ad34ca9a0ef0b154077fd66fd91e645fd5f0e22e3fd399b1b26c0160082bdf94b3be7136ab05c1b80ee086a682843778443f9f03a
- SSDEEP 6144:rQtK91cOo9qoiTpppLeIUfdLyO2QFicEOkCybEaQRXr9HNdvOaxy8K:r39OFaPpKIUfdLyO8Okx2LIaxy
- TLSH T14C847D2AB7A0D076C4B79579C49247AAFEB1B42137204ACFA390475A1F237E2BD3570D
- MD5 SHA1 SHA512 SSDEEP TLSH