Analysis
- max time kernel
148s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/09/2026, 23:16
Behavioral task
behavioral1
Sample
450b94233fd424cdec4722bce757a99c08334e63fd5944d00bb1ab8b56a4eb54.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 450b94233fd424cdec4722bce757a99c08334e63fd5944d00bb1ab8b56a4eb54.exe
- Size 830KB
- Sample260920-28586adh34
- SHA256 450b94233fd424cdec4722bce757a99c08334e63fd5944d00bb1ab8b56a4eb54
- MD5 716c30e3d0e91776536945e74c25ba98
- SHA1 121b7374acbdde4b5fb09343634ad16bff20caae
- SHA512 3677a308ef1debff2754868853ab179b0ae5a54ad745406576138471e944fa785cb6e958c36d24421e8e00b7a66714c0a5351e7f511f58472c95ef3857bb599a
- SSDEEP 12288:ASvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/Lik8CQ3K:bvO2xJKRw2kOkx2LFRvcUQPK
- TLSH T123055A31E641C03AD0A74575C6FA4BBFE964BD25131165CBA3C43A262FB36D2BA3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1348 d72331db - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 20 223.5.5.5 4264 450b94233fd424cdec4722bce757a99c08334e63fd5944d00bb1ab8b56a4eb54.exe Destination IP 1 114.114.114.114 4264 450b94233fd424cdec4722bce757a99c08334e63fd5944d00bb1ab8b56a4eb54.exe Destination IP 3 223.5.5.5 4264 450b94233fd424cdec4722bce757a99c08334e63fd5944d00bb1ab8b56a4eb54.exe Destination IP 19 114.114.114.114 4264 450b94233fd424cdec4722bce757a99c08334e63fd5944d00bb1ab8b56a4eb54.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC845F33427F1C99AF855BE8930371C d72331db File created C:\Windows\SysWOW64\d72331db 450b94233fd424cdec4722bce757a99c08334e63fd5944d00bb1ab8b56a4eb54.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 d72331db File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies d72331db File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft d72331db File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 d72331db File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content d72331db File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC845F33427F1C99AF855BE8930371C d72331db File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE d72331db File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 d72331db File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache d72331db File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData d72331db File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 d72331db -
resource yara_rule behavioral2/memory/4264-0-0x0000000000820000-0x00000000008AC000-memory.dmp upx behavioral2/files/0x000c000000019ca4-2.dat upx behavioral2/memory/1348-3-0x0000000000870000-0x00000000008FC000-memory.dmp upx behavioral2/memory/4264-13-0x0000000000820000-0x00000000008AC000-memory.dmp upx behavioral2/memory/1348-14-0x0000000000870000-0x00000000008FC000-memory.dmp upx behavioral2/memory/1348-30-0x0000000000870000-0x00000000008FC000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\171408 d72331db File opened for modification C:\Windows\490050 450b94233fd424cdec4722bce757a99c08334e63fd5944d00bb1ab8b56a4eb54.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 450b94233fd424cdec4722bce757a99c08334e63fd5944d00bb1ab8b56a4eb54.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d72331db - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix d72331db Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" d72331db Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ d72331db Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" d72331db Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" d72331db Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" d72331db Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" d72331db Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" d72331db Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing d72331db - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 1348 d72331db 1348 d72331db 1348 d72331db 1348 d72331db 1348 d72331db 1348 d72331db 1348 d72331db 1348 d72331db 4264 450b94233fd424cdec4722bce757a99c08334e63fd5944d00bb1ab8b56a4eb54.exe 4264 450b94233fd424cdec4722bce757a99c08334e63fd5944d00bb1ab8b56a4eb54.exe 4264 450b94233fd424cdec4722bce757a99c08334e63fd5944d00bb1ab8b56a4eb54.exe 4264 450b94233fd424cdec4722bce757a99c08334e63fd5944d00bb1ab8b56a4eb54.exe 4264 450b94233fd424cdec4722bce757a99c08334e63fd5944d00bb1ab8b56a4eb54.exe 4264 450b94233fd424cdec4722bce757a99c08334e63fd5944d00bb1ab8b56a4eb54.exe 4264 450b94233fd424cdec4722bce757a99c08334e63fd5944d00bb1ab8b56a4eb54.exe 4264 450b94233fd424cdec4722bce757a99c08334e63fd5944d00bb1ab8b56a4eb54.exe 4264 450b94233fd424cdec4722bce757a99c08334e63fd5944d00bb1ab8b56a4eb54.exe 4264 450b94233fd424cdec4722bce757a99c08334e63fd5944d00bb1ab8b56a4eb54.exe 4264 450b94233fd424cdec4722bce757a99c08334e63fd5944d00bb1ab8b56a4eb54.exe 4264 450b94233fd424cdec4722bce757a99c08334e63fd5944d00bb1ab8b56a4eb54.exe 4264 450b94233fd424cdec4722bce757a99c08334e63fd5944d00bb1ab8b56a4eb54.exe 4264 450b94233fd424cdec4722bce757a99c08334e63fd5944d00bb1ab8b56a4eb54.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4264 450b94233fd424cdec4722bce757a99c08334e63fd5944d00bb1ab8b56a4eb54.exe Token: SeTcbPrivilege 4264 450b94233fd424cdec4722bce757a99c08334e63fd5944d00bb1ab8b56a4eb54.exe Token: SeDebugPrivilege 1348 d72331db Token: SeTcbPrivilege 1348 d72331db
Processes
-
C:\Users\Admin\AppData\Local\Temp\450b94233fd424cdec4722bce757a99c08334e63fd5944d00bb1ab8b56a4eb54.exe"C:\Users\Admin\AppData\Local\Temp\450b94233fd424cdec4722bce757a99c08334e63fd5944d00bb1ab8b56a4eb54.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4264
-
C:\Windows\Syswow64\d72331dbC:\Windows\Syswow64\d72331db1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1348
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\d72331db
- Size 830KB
- SHA256 6675688495e6ab0e6dd736dbde57a42d65e41af0eadd6466a20210e159a50e9d
- MD5 1d290abc354323b6a29f4e28f37466e1
- SHA1 5e1d2afcf6b1c196215f7f0c616bea110aed99b4
- SHA512 4cbd5421fdcebc7688e397773f42b9d76e0c5ef633da36cd2424a0656484507d3c843142961e24feeb3bcf9c915649d371e763d216f205868e6031c748781c85
- SSDEEP 12288:MSvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/Lik8CQ3K:/vO2xJKRw2kOkx2LFRvcUQPK
- TLSH T19A055A31E641C03AD0A74575C6FA4BBFE964BD25131165CBA3C43A262FB36D2BA3170E
- MD5 SHA1 SHA512 SSDEEP TLSH