Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
07/09/2026, 04:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ad76c3c4652f7be5c07c59e473289e53085eafea16cc3fb9344a4db2b6ff983f.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
ad76c3c4652f7be5c07c59e473289e53085eafea16cc3fb9344a4db2b6ff983f.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target ad76c3c4652f7be5c07c59e473289e53085eafea16cc3fb9344a4db2b6ff983f.exe
- Size 395KB
- Sample260907-e4y8qaydmf
- SHA256 ad76c3c4652f7be5c07c59e473289e53085eafea16cc3fb9344a4db2b6ff983f
- MD5 087d96a34b4f7d6c8a4189f352082022
- SHA1 e361dfbc27eb83fe0d0c6dd267dd0d164f64c02c
- SHA512 fd6ddab0c2654408b788311681b4659bd31e356e3ed7bd7cb2e558a896e4a018eed734dd6ac096a971784442fe5cfcc64fff26d4cedc5c22baf56389349eac7c
- SSDEEP 6144:pQtK91cOo9qoiTpppLeIUfdLyO2QFicEOkCybEaQRXr9HNdvOaxy8K:p39OFaPpKIUfdLyO8Okx2LIaxy
- TLSH T14F847D2AB7A0D076C4B79579C49247AAFEB1B42137204ACFA390475A1F237E2BD3570D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4748 14de1070 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 3 114.114.114.114 768 ad76c3c4652f7be5c07c59e473289e53085eafea16cc3fb9344a4db2b6ff983f.exe Destination IP 4 223.5.5.5 768 ad76c3c4652f7be5c07c59e473289e53085eafea16cc3fb9344a4db2b6ff983f.exe Destination IP 31 114.114.114.114 768 ad76c3c4652f7be5c07c59e473289e53085eafea16cc3fb9344a4db2b6ff983f.exe Destination IP 32 223.5.5.5 768 ad76c3c4652f7be5c07c59e473289e53085eafea16cc3fb9344a4db2b6ff983f.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 14de1070 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 14de1070 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 14de1070 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 14de1070 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 14de1070 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 14de1070 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 14de1070 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AAD646CB44373074ADE741C38400E7E1 14de1070 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 14de1070 File created C:\Windows\SysWOW64\14de1070 ad76c3c4652f7be5c07c59e473289e53085eafea16cc3fb9344a4db2b6ff983f.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 14de1070 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 14de1070 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 14de1070 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 14de1070 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AAD646CB44373074ADE741C38400E7E1 14de1070 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\d2600 ad76c3c4652f7be5c07c59e473289e53085eafea16cc3fb9344a4db2b6ff983f.exe File opened for modification C:\Windows\514998 14de1070 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ad76c3c4652f7be5c07c59e473289e53085eafea16cc3fb9344a4db2b6ff983f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14de1070 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 14de1070 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 14de1070 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 14de1070 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 14de1070 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 14de1070 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 14de1070 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 14de1070 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 14de1070 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 14de1070 - Modifies system certificate store 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1F24C630CDA418EF2069FFAD4FDD5F463A1B69AA 14de1070 Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1F24C630CDA418EF2069FFAD4FDD5F463A1B69AA\Blob = 5c0000000100000004000000800100000f0000000100000030000000f019c7ba12795dacd6ef1a767657deb8e41060a2ad1a6c66900a6ec16870fc06eecbaffdd3e2c986659578e7e85e535a530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003800000047006c006f00620061006c005300690067006e002000450043004300200052006f006f00740020004300410020002d002000520035000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308620000000100000020000000179fbc148a3dd00fd24ea13458cc43bfa7f59c8182d783a513f6ebec100c89241400000001000000140000003de629489bea07ca21444a26de6eded283d09f591d0000000100000010000000b647dd2a9ccadee75e8905e256cc6b147f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d7010300000001000000140000001f24c630cda418ef2069ffad4fdd5f463a1b69aa190000000100000010000000e3087c0c81f60a2a2b466b8a3e70cce82000000001000000220200003082021e308201a4a0030201020211605949e0262ebb55f90a778a71f94ad86c300a06082a8648ce3d040303305031243022060355040b131b476c6f62616c5369676e2045434320526f6f74204341202d20523531133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3132313131333030303030305a170d3338303131393033313430375a305031243022060355040b131b476c6f62616c5369676e2045434320526f6f74204341202d20523531133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e3076301006072a8648ce3d020106052b810400220362000447450e96fb7d5dbfe939d121f89f0bb6d57b1e923a48591cf062312dc07a28fe1aa75cb3b6cc97e745d458fad1776d43a2c08765340a1f7addeb3c33a1c59d4da46f4195387fc91e84ebd19e49928794870c3a854a669f9d59934d976106864aa3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604143de629489bea07ca21444a26de6eded283d09f59300a06082a8648ce3d0403030368003065023100e56912c96edbc631ba0941e197f8fbfd9ae27d12c9ed7c64d3cb05258b56d9a0e75e5d4e0b839c5b7629a00926216a62023071d2b58f5cea3be1780985a875923bc85cfd48ef0d7422a808e26ec549cec70cbca76169f1f73be12acbf92bf3669037 14de1070 - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 4748 14de1070 4748 14de1070 4748 14de1070 4748 14de1070 4748 14de1070 4748 14de1070 4748 14de1070 4748 14de1070 4748 14de1070 4748 14de1070 4748 14de1070 4748 14de1070 768 ad76c3c4652f7be5c07c59e473289e53085eafea16cc3fb9344a4db2b6ff983f.exe 768 ad76c3c4652f7be5c07c59e473289e53085eafea16cc3fb9344a4db2b6ff983f.exe 768 ad76c3c4652f7be5c07c59e473289e53085eafea16cc3fb9344a4db2b6ff983f.exe 768 ad76c3c4652f7be5c07c59e473289e53085eafea16cc3fb9344a4db2b6ff983f.exe 768 ad76c3c4652f7be5c07c59e473289e53085eafea16cc3fb9344a4db2b6ff983f.exe 768 ad76c3c4652f7be5c07c59e473289e53085eafea16cc3fb9344a4db2b6ff983f.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 768 ad76c3c4652f7be5c07c59e473289e53085eafea16cc3fb9344a4db2b6ff983f.exe Token: SeTcbPrivilege 768 ad76c3c4652f7be5c07c59e473289e53085eafea16cc3fb9344a4db2b6ff983f.exe Token: SeDebugPrivilege 4748 14de1070 Token: SeTcbPrivilege 4748 14de1070
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad76c3c4652f7be5c07c59e473289e53085eafea16cc3fb9344a4db2b6ff983f.exe"C:\Users\Admin\AppData\Local\Temp\ad76c3c4652f7be5c07c59e473289e53085eafea16cc3fb9344a4db2b6ff983f.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:768
-
C:\Windows\Syswow64\14de1070C:\Windows\Syswow64\14de10701⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4748
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\514998
- Size 501B
- SHA256 9a00ede16bba0e8ed3142c27c4582e10beb5709c1e924ed7639274634f35a27d
- MD5 6d9ab273277029d97cc2b9334f96581f
- SHA1 9f8cdfd9bb08de8590fd80813a225355b78dad1f
- SHA512 b8a7c79f624360025b4ea0b050df361efc7f224989ec95fd1547d16eaae0b12aa76e1c74f2a70e4e843829fdc03ad5ae5ece5271d99d48bf144d3bd1e75c5e67
- TLSH T1A6F00E7ED4273B9C099668B32B169C9731C151BF210AA05626D33BD144CF2409D0380E
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\14de1070
- Size 395KB
- SHA256 5b39fe63a67ed6a75d59acc9b524d1f98750a1681163e66f7104c93ff912bd3d
- MD5 5891cbcb3f40842c4ceca5e2caeda300
- SHA1 16890d2b4aa203c2a94ad6e591f192c4ac32e191
- SHA512 a3bdd51b30e21fa3c170908e2f154dbb3832437c6af2e8cbcefae895fa9b831108f1340ae816e243b7dd1207c2120d88331cdb2f042a084615ac5e4c4f6da37f
- SSDEEP 6144:VQtK91cOo9qoiTpppLeIUfdLyO2QFicEOkCybEaQRXr9HNdvOaxy8K:V39OFaPpKIUfdLyO8Okx2LIaxy
- TLSH T141847D2AB7A0D076C4B79579C49247AAFEB1B42137204ACFA390475A1F237E2BD3570D
- MD5 SHA1 SHA512 SSDEEP TLSH