Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/09/2026, 18:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe
- Size 2.0MB
- Sample260925-xfb3dsha22
- SHA256 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85
- MD5 0decc9e1bb1f0fec22c58851ce2d1b91
- SHA1 6da73af22905bf026dcc8ccacb80acf462acb5c6
- SHA512 d9a4d1c0b50f92588afde335a8bcf30de098db4fe04bae8d2a19f25cad1540711407ed9d2591bda3b28b7b1ee137cbf93e14154a6a7f91d0f24d90a531864674
- SSDEEP 49152:QHHKO29QG56/OJdJCXDrsOFZMjHfUTGkQy58:QnKdVkOhCXHHFZMjHfUKkVi
- TLSH T13FA57D31A6C18036E1B3867586FA56FAA5247C216311A5CF63C47A2A1F737D3EE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1964 3e28ec0e - Unexpected DNS network traffic destination 26 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 283 223.5.5.5 4108 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe Destination IP 319 223.5.5.5 4108 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe Destination IP 368 223.5.5.5 4108 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe Destination IP 482 114.114.114.114 4108 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe Destination IP 483 223.5.5.5 4108 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe Destination IP 514 223.5.5.5 4108 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe Destination IP 40 223.5.5.5 4108 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe Destination IP 318 114.114.114.114 4108 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe Destination IP 424 223.5.5.5 4108 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe Destination IP 1 114.114.114.114 4108 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe Destination IP 39 114.114.114.114 4108 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe Destination IP 180 114.114.114.114 4108 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe Destination IP 234 114.114.114.114 4108 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe Destination IP 280 114.114.114.114 4108 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe Destination IP 337 114.114.114.114 4108 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe Destination IP 338 223.5.5.5 4108 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe Destination IP 513 114.114.114.114 4108 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe Destination IP 4 223.5.5.5 4108 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe Destination IP 93 114.114.114.114 1964 3e28ec0e Destination IP 95 223.5.5.5 4108 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe Destination IP 148 114.114.114.114 4108 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe Destination IP 149 223.5.5.5 4108 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe Destination IP 181 223.5.5.5 4108 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe Destination IP 367 114.114.114.114 4108 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe Destination IP 423 114.114.114.114 4108 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe Destination IP 235 223.5.5.5 4108 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe - Drops file in System32 directory 13 IoCs
description ioc Process File created C:\Windows\SysWOW64\3e28ec0e 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 3e28ec0e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 3e28ec0e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 3e28ec0e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 3e28ec0e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 3e28ec0e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 3e28ec0e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 3e28ec0e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 3e28ec0e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 3e28ec0e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 3e28ec0e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 3e28ec0e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 3e28ec0e - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\219fd8 3e28ec0e File opened for modification C:\Windows\465498 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 3e28ec0e Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 3e28ec0e - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3e28ec0e - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 3e28ec0e Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 3e28ec0e Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 3e28ec0e Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 3e28ec0e Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 3e28ec0e Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 3e28ec0e Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 3e28ec0e Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 3e28ec0e Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 3e28ec0e - Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 1964 3e28ec0e 1964 3e28ec0e 1964 3e28ec0e 1964 3e28ec0e 1964 3e28ec0e 1964 3e28ec0e 1964 3e28ec0e 1964 3e28ec0e 1964 3e28ec0e 1964 3e28ec0e 1964 3e28ec0e 1964 3e28ec0e 1964 3e28ec0e 1964 3e28ec0e 1964 3e28ec0e 1964 3e28ec0e 1964 3e28ec0e 1964 3e28ec0e 1964 3e28ec0e 1964 3e28ec0e 4108 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe 4108 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe 4108 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe 4108 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe 4108 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe 4108 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe 4108 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe 4108 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe 4108 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe 4108 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe 4108 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe 4108 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe 4108 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe 4108 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe 4108 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe 4108 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe 4108 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe 4108 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe 4108 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe 4108 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4108 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe Token: SeTcbPrivilege 4108 0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe Token: SeDebugPrivilege 1964 3e28ec0e Token: SeTcbPrivilege 1964 3e28ec0e
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe"C:\Users\Admin\AppData\Local\Temp\0f805c3a4b1d6dbd63f1476a90c8e94ae7d95665bb4f01059ad13e81290ebc85.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4108
-
C:\Windows\Syswow64\3e28ec0eC:\Windows\Syswow64\3e28ec0e1⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1964
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\219fd8
- Size 916B
- SHA256 323827cee4c558e69dc72f08dce8948657ae8739c12b938a6ec97b2e3b79178b
- MD5 7d5eff2bdd02a22436e8539733994b19
- SHA1 52464441d4539431c1c50c60cad040d40726a210
- SHA512 a0c28e4edab9f9987bfe8fcd16ac18612689b62aa25856b34b8d4258f8931a3d0a87fa8820255c05a91933375a616b6ff8bb6afb5b4f0a534a95fd4e8dc7c2e4
- TLSH T1BC113A23ACD6E6A19CD99264B5E21CEC26213587EACE112B4D9370523233A5CC233412
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\3e28ec0e
- Size 2.0MB
- SHA256 dc842edce5aabde7f359cdaf4244139e60e9aa1d05722b6ae1fc9c8d7eae8bce
- MD5 7b17daa80f5ca5d5fa7c576cfbe91c24
- SHA1 1a681bd7b63ebf3a19bbfb2f636b2529bfea0b0d
- SHA512 e8bb44c8ae66ef4563b576376a9090097f146812db375059245e382eb1c90366748b2b4aca8a08f0a6f0f9d86a941760570c9b3e2e484adef013239b75e53586
- SSDEEP 49152:8HHKO29QG56/OJdJCXDrsOFZMjHfUTGkQy58:8nKdVkOhCXHHFZMjHfUKkVi
- TLSH T111A57D31A6C18036E1B3867586FA56FAA5247C216311A5CF63C47A2A1F737D3EE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH