Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
25/09/2026, 18:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe
- Size 2.0MB
- Sample260925-xfb3dsha22
- SHA256 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85
- MD5 0decc9e1bb1f0fec22c58851ce2d1b91
- SHA1 6da73af22905bf026dcc8ccacb80acf462acb5c6
- SHA512 d9a4d1c0b50f92588afde335a8bcf30de098db4fe04bae8d2a19f25cad1540711407ed9d2591bda3b28b7b1ee137cbf93e14154a6a7f91d0f24d90a531864674
- SSDEEP 49152:QHHKO29QG56/OJdJCXDrsOFZMjHfUTGkQy58:QnKdVkOhCXHHFZMjHfUKkVi
- TLSH T13FA57D31A6C18036E1B3867586FA56FAA5247C216311A5CF63C47A2A1F737D3EE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1484 b592c14f - Unexpected DNS network traffic destination 20 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 349 223.5.5.5 4000 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe Destination IP 3 114.114.114.114 4000 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe Destination IP 125 223.5.5.5 4000 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe Destination IP 197 223.5.5.5 4000 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe Destination IP 243 114.114.114.114 4000 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe Destination IP 386 223.5.5.5 4000 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe Destination IP 416 114.114.114.114 4000 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe Destination IP 477 114.114.114.114 4000 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe Destination IP 60 223.5.5.5 4000 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe Destination IP 244 223.5.5.5 4000 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe Destination IP 346 114.114.114.114 4000 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe Destination IP 478 223.5.5.5 4000 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe Destination IP 305 223.5.5.5 4000 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe Destination IP 5 223.5.5.5 4000 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe Destination IP 59 114.114.114.114 4000 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe Destination IP 196 114.114.114.114 4000 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe Destination IP 304 114.114.114.114 4000 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe Destination IP 385 114.114.114.114 4000 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe Destination IP 124 114.114.114.114 1484 b592c14f Destination IP 417 223.5.5.5 4000 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 b592c14f File created C:\Windows\SysWOW64\b592c14f 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE b592c14f File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft b592c14f File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache b592c14f File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content b592c14f File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 b592c14f File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 b592c14f File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 b592c14f File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies b592c14f File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 b592c14f File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData b592c14f File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 b592c14f - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\196818 b592c14f File opened for modification C:\Windows\447b40 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname b592c14f Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain b592c14f - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b592c14f - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing b592c14f Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix b592c14f Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ b592c14f Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" b592c14f Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" b592c14f Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" b592c14f Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" b592c14f Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" b592c14f Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" b592c14f - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 1484 b592c14f 1484 b592c14f 1484 b592c14f 1484 b592c14f 1484 b592c14f 1484 b592c14f 1484 b592c14f 1484 b592c14f 4000 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe 4000 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe 4000 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe 4000 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe 4000 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe 4000 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4000 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe Token: SeTcbPrivilege 4000 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe Token: SeDebugPrivilege 1484 b592c14f Token: SeTcbPrivilege 1484 b592c14f
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe"C:\Users\Admin\AppData\Local\Temp\0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4000
-
C:\Windows\Syswow64\b592c14fC:\Windows\Syswow64\b592c14f1⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1484
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\b592c14f
- Size 2.0MB
- SHA256 44987472f511d5f4b4553fdcc39964ac7ab70635a5001e840b60845544f5fd23
- MD5 a2d1331cb93d17667036970ce5d686b2
- SHA1 c76f0e73433dfe45b73a95b9a5fba7b1f47ee511
- SHA512 e56ddaa6176d151f1c987ef7d701b138d4fe19ea503caebf0f29fc8e48e84dd3167c2a84383b1a8e43dcb754bf0951951b9fe0a971c5e4a1ee08736a35222660
- SSDEEP 49152:kHHKO29QG56/OJdJCXDrsOFZMjHfUTGkQy58:knKdVkOhCXHHFZMjHfUKkVi
- TLSH T181A57D31A6C18036E1B3867586FA56FAA5247C216311A5CF63C47A2A1F737D3EE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH