Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/09/2026, 13:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9ad2576a70e466eabcbb78ed73ab35e58b72b5b7d1603b917526720a7b6aaea7.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
9ad2576a70e466eabcbb78ed73ab35e58b72b5b7d1603b917526720a7b6aaea7.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 9ad2576a70e466eabcbb78ed73ab35e58b72b5b7d1603b917526720a7b6aaea7.exe
- Size 1.2MB
- Sample260924-qw2jnavdpg
- SHA256 9ad2576a70e466eabcbb78ed73ab35e58b72b5b7d1603b917526720a7b6aaea7
- MD5 3ba35ec6ab12b421742cb02b0deabe29
- SHA1 077b3f2ef32fca482ba72d04ca55fb8035435304
- SHA512 dc9694205f2fddd45bcc9cf52e5c237e6bddbfb3173d6ab8dde88c19d6b1caab15f6ae7252d5aa2a891e2d50ee8f22f34c1426709217a578fcf438cbcb7f9f18
- SSDEEP 24576:avO2xJKRI2FOkx2LFEvcUQPxuZ98Es8k3OH3C0rQ6+8pKJJFz:aHHKO29QG5QZuTtS0rQMYx
- TLSH T1B7557D21F741C036D5AB017186B94BAEA578BD61072555C7B3C87E3A2FB22D2BE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4632 31085177 - Unexpected DNS network traffic destination 22 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 451 114.114.114.114 6072 9ad2576a70e466eabcbb78ed73ab35e58b72b5b7d1603b917526720a7b6aaea7.exe Destination IP 2 223.5.5.5 6072 9ad2576a70e466eabcbb78ed73ab35e58b72b5b7d1603b917526720a7b6aaea7.exe Destination IP 89 114.114.114.114 4632 31085177 Destination IP 90 223.5.5.5 6072 9ad2576a70e466eabcbb78ed73ab35e58b72b5b7d1603b917526720a7b6aaea7.exe Destination IP 176 114.114.114.114 6072 9ad2576a70e466eabcbb78ed73ab35e58b72b5b7d1603b917526720a7b6aaea7.exe Destination IP 343 114.114.114.114 6072 9ad2576a70e466eabcbb78ed73ab35e58b72b5b7d1603b917526720a7b6aaea7.exe Destination IP 1 114.114.114.114 6072 9ad2576a70e466eabcbb78ed73ab35e58b72b5b7d1603b917526720a7b6aaea7.exe Destination IP 35 114.114.114.114 6072 9ad2576a70e466eabcbb78ed73ab35e58b72b5b7d1603b917526720a7b6aaea7.exe Destination IP 36 223.5.5.5 6072 9ad2576a70e466eabcbb78ed73ab35e58b72b5b7d1603b917526720a7b6aaea7.exe Destination IP 264 114.114.114.114 6072 9ad2576a70e466eabcbb78ed73ab35e58b72b5b7d1603b917526720a7b6aaea7.exe Destination IP 344 223.5.5.5 6072 9ad2576a70e466eabcbb78ed73ab35e58b72b5b7d1603b917526720a7b6aaea7.exe Destination IP 397 114.114.114.114 6072 9ad2576a70e466eabcbb78ed73ab35e58b72b5b7d1603b917526720a7b6aaea7.exe Destination IP 144 114.114.114.114 6072 9ad2576a70e466eabcbb78ed73ab35e58b72b5b7d1603b917526720a7b6aaea7.exe Destination IP 145 223.5.5.5 6072 9ad2576a70e466eabcbb78ed73ab35e58b72b5b7d1603b917526720a7b6aaea7.exe Destination IP 230 114.114.114.114 6072 9ad2576a70e466eabcbb78ed73ab35e58b72b5b7d1603b917526720a7b6aaea7.exe Destination IP 311 114.114.114.114 6072 9ad2576a70e466eabcbb78ed73ab35e58b72b5b7d1603b917526720a7b6aaea7.exe Destination IP 452 223.5.5.5 6072 9ad2576a70e466eabcbb78ed73ab35e58b72b5b7d1603b917526720a7b6aaea7.exe Destination IP 177 223.5.5.5 6072 9ad2576a70e466eabcbb78ed73ab35e58b72b5b7d1603b917526720a7b6aaea7.exe Destination IP 231 223.5.5.5 6072 9ad2576a70e466eabcbb78ed73ab35e58b72b5b7d1603b917526720a7b6aaea7.exe Destination IP 266 223.5.5.5 6072 9ad2576a70e466eabcbb78ed73ab35e58b72b5b7d1603b917526720a7b6aaea7.exe Destination IP 312 223.5.5.5 6072 9ad2576a70e466eabcbb78ed73ab35e58b72b5b7d1603b917526720a7b6aaea7.exe Destination IP 398 223.5.5.5 6072 9ad2576a70e466eabcbb78ed73ab35e58b72b5b7d1603b917526720a7b6aaea7.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 31085177 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 31085177 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 31085177 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 31085177 File created C:\Windows\SysWOW64\31085177 9ad2576a70e466eabcbb78ed73ab35e58b72b5b7d1603b917526720a7b6aaea7.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 31085177 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 31085177 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 31085177 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 31085177 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 31085177 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 31085177 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 31085177 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 31085177 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 31085177 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 31085177 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\4f4d30 31085177 File opened for modification C:\Windows\67f470 9ad2576a70e466eabcbb78ed73ab35e58b72b5b7d1603b917526720a7b6aaea7.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ad2576a70e466eabcbb78ed73ab35e58b72b5b7d1603b917526720a7b6aaea7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 31085177 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 31085177 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 31085177 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 31085177 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 31085177 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 31085177 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 31085177 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 31085177 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 31085177 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 31085177 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 4632 31085177 4632 31085177 4632 31085177 4632 31085177 4632 31085177 4632 31085177 4632 31085177 4632 31085177 6072 9ad2576a70e466eabcbb78ed73ab35e58b72b5b7d1603b917526720a7b6aaea7.exe 6072 9ad2576a70e466eabcbb78ed73ab35e58b72b5b7d1603b917526720a7b6aaea7.exe 6072 9ad2576a70e466eabcbb78ed73ab35e58b72b5b7d1603b917526720a7b6aaea7.exe 6072 9ad2576a70e466eabcbb78ed73ab35e58b72b5b7d1603b917526720a7b6aaea7.exe 6072 9ad2576a70e466eabcbb78ed73ab35e58b72b5b7d1603b917526720a7b6aaea7.exe 6072 9ad2576a70e466eabcbb78ed73ab35e58b72b5b7d1603b917526720a7b6aaea7.exe 6072 9ad2576a70e466eabcbb78ed73ab35e58b72b5b7d1603b917526720a7b6aaea7.exe 6072 9ad2576a70e466eabcbb78ed73ab35e58b72b5b7d1603b917526720a7b6aaea7.exe 6072 9ad2576a70e466eabcbb78ed73ab35e58b72b5b7d1603b917526720a7b6aaea7.exe 6072 9ad2576a70e466eabcbb78ed73ab35e58b72b5b7d1603b917526720a7b6aaea7.exe 6072 9ad2576a70e466eabcbb78ed73ab35e58b72b5b7d1603b917526720a7b6aaea7.exe 6072 9ad2576a70e466eabcbb78ed73ab35e58b72b5b7d1603b917526720a7b6aaea7.exe 6072 9ad2576a70e466eabcbb78ed73ab35e58b72b5b7d1603b917526720a7b6aaea7.exe 6072 9ad2576a70e466eabcbb78ed73ab35e58b72b5b7d1603b917526720a7b6aaea7.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 6072 9ad2576a70e466eabcbb78ed73ab35e58b72b5b7d1603b917526720a7b6aaea7.exe Token: SeTcbPrivilege 6072 9ad2576a70e466eabcbb78ed73ab35e58b72b5b7d1603b917526720a7b6aaea7.exe Token: SeDebugPrivilege 4632 31085177 Token: SeTcbPrivilege 4632 31085177
Processes
-
C:\Users\Admin\AppData\Local\Temp\9ad2576a70e466eabcbb78ed73ab35e58b72b5b7d1603b917526720a7b6aaea7.exe"C:\Users\Admin\AppData\Local\Temp\9ad2576a70e466eabcbb78ed73ab35e58b72b5b7d1603b917526720a7b6aaea7.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6072
-
C:\Windows\Syswow64\31085177C:\Windows\Syswow64\310851771⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4632
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\31085177
- Size 1.2MB
- SHA256 8bc82fa441b112dc20ff63ba0761b4c7bf440c76a24fbaab259604d4257ba642
- MD5 7fbbe9c5b30a8c497850ae6392c9a459
- SHA1 5ad3036b928d251582b8de2df60905b4a2e29409
- SHA512 8b1bf4e4cbd8dd587df2ef3400cdf116950a2bb2e3b5af56f46d0e1045b45833a5070f91dc973f0a2e0cd3e4ce69e61475f65965b3e72845dc76d0634e306180
- SSDEEP 24576:AvO2xJKRI2FOkx2LFEvcUQPxuZ98Es8k3OH3C0rQ6+8pKJJFz:AHHKO29QG5QZuTtS0rQMYx
- TLSH T1DB557D21F741C036D5AB017186B94BAEA578BD61072555C7B3C87E3A2FB22D2BE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH