Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
29/09/2026, 20:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
91e3545bd665659b703fc7d8b0f3ae2b433927173d7c96b3beb9bf79d5d70677.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
91e3545bd665659b703fc7d8b0f3ae2b433927173d7c96b3beb9bf79d5d70677.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 91e3545bd665659b703fc7d8b0f3ae2b433927173d7c96b3beb9bf79d5d70677.exe
- Size 2.0MB
- Sample260929-yy42ka1thy
- SHA256 91e3545bd665659b703fc7d8b0f3ae2b433927173d7c96b3beb9bf79d5d70677
- MD5 2822dae63793292e6a33c5432e264107
- SHA1 2713da6434b2686928ca8fc274325d03f6739474
- SHA512 efd0207cacd9eb94178b2c99f471510b1d5e642d9a15dfabf592020fbf78ae5c6072017087d9543e9f3219f47752a7a61099a92f8877528522321f611a9acb4a
- SSDEEP 49152:ZHHKO29QG56/OJdJCXDrsOFZMjHfUTGkQy58:ZnKdVkOhCXHHFZMjHfUKkVi
- TLSH T125A57D31A6C18036E1B3867586FA56FAA5247C216311A5CF63C47A2A1F737D3EE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1948 f42ec5c1 - Unexpected DNS network traffic destination 22 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 4 114.114.114.114 716 91e3545bd665659b703fc7d8b0f3ae2b433927173d7c96b3beb9bf79d5d70677.exe Destination IP 6 223.5.5.5 716 91e3545bd665659b703fc7d8b0f3ae2b433927173d7c96b3beb9bf79d5d70677.exe Destination IP 58 223.5.5.5 716 91e3545bd665659b703fc7d8b0f3ae2b433927173d7c96b3beb9bf79d5d70677.exe Destination IP 434 223.5.5.5 716 91e3545bd665659b703fc7d8b0f3ae2b433927173d7c96b3beb9bf79d5d70677.exe Destination IP 192 114.114.114.114 716 91e3545bd665659b703fc7d8b0f3ae2b433927173d7c96b3beb9bf79d5d70677.exe Destination IP 241 114.114.114.114 716 91e3545bd665659b703fc7d8b0f3ae2b433927173d7c96b3beb9bf79d5d70677.exe Destination IP 343 223.5.5.5 716 91e3545bd665659b703fc7d8b0f3ae2b433927173d7c96b3beb9bf79d5d70677.exe Destination IP 495 223.5.5.5 716 91e3545bd665659b703fc7d8b0f3ae2b433927173d7c96b3beb9bf79d5d70677.exe Destination IP 554 114.114.114.114 716 91e3545bd665659b703fc7d8b0f3ae2b433927173d7c96b3beb9bf79d5d70677.exe Destination IP 122 114.114.114.114 1948 f42ec5c1 Destination IP 123 223.5.5.5 716 91e3545bd665659b703fc7d8b0f3ae2b433927173d7c96b3beb9bf79d5d70677.exe Destination IP 303 114.114.114.114 716 91e3545bd665659b703fc7d8b0f3ae2b433927173d7c96b3beb9bf79d5d70677.exe Destination IP 304 223.5.5.5 716 91e3545bd665659b703fc7d8b0f3ae2b433927173d7c96b3beb9bf79d5d70677.exe Destination IP 402 114.114.114.114 716 91e3545bd665659b703fc7d8b0f3ae2b433927173d7c96b3beb9bf79d5d70677.exe Destination IP 433 114.114.114.114 716 91e3545bd665659b703fc7d8b0f3ae2b433927173d7c96b3beb9bf79d5d70677.exe Destination IP 57 114.114.114.114 716 91e3545bd665659b703fc7d8b0f3ae2b433927173d7c96b3beb9bf79d5d70677.exe Destination IP 193 223.5.5.5 716 91e3545bd665659b703fc7d8b0f3ae2b433927173d7c96b3beb9bf79d5d70677.exe Destination IP 243 223.5.5.5 716 91e3545bd665659b703fc7d8b0f3ae2b433927173d7c96b3beb9bf79d5d70677.exe Destination IP 341 114.114.114.114 716 91e3545bd665659b703fc7d8b0f3ae2b433927173d7c96b3beb9bf79d5d70677.exe Destination IP 403 223.5.5.5 716 91e3545bd665659b703fc7d8b0f3ae2b433927173d7c96b3beb9bf79d5d70677.exe Destination IP 494 114.114.114.114 716 91e3545bd665659b703fc7d8b0f3ae2b433927173d7c96b3beb9bf79d5d70677.exe Destination IP 555 223.5.5.5 716 91e3545bd665659b703fc7d8b0f3ae2b433927173d7c96b3beb9bf79d5d70677.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft f42ec5c1 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache f42ec5c1 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 f42ec5c1 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content f42ec5c1 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE f42ec5c1 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData f42ec5c1 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 f42ec5c1 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 f42ec5c1 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 f42ec5c1 File created C:\Windows\SysWOW64\f42ec5c1 91e3545bd665659b703fc7d8b0f3ae2b433927173d7c96b3beb9bf79d5d70677.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 f42ec5c1 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies f42ec5c1 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 f42ec5c1 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\2159b8 f42ec5c1 File opened for modification C:\Windows\c4218 91e3545bd665659b703fc7d8b0f3ae2b433927173d7c96b3beb9bf79d5d70677.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname f42ec5c1 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain f42ec5c1 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 91e3545bd665659b703fc7d8b0f3ae2b433927173d7c96b3beb9bf79d5d70677.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 91e3545bd665659b703fc7d8b0f3ae2b433927173d7c96b3beb9bf79d5d70677.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91e3545bd665659b703fc7d8b0f3ae2b433927173d7c96b3beb9bf79d5d70677.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f42ec5c1 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix f42ec5c1 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" f42ec5c1 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" f42ec5c1 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" f42ec5c1 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" f42ec5c1 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" f42ec5c1 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" f42ec5c1 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ f42ec5c1 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing f42ec5c1 - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 1948 f42ec5c1 1948 f42ec5c1 1948 f42ec5c1 1948 f42ec5c1 1948 f42ec5c1 1948 f42ec5c1 1948 f42ec5c1 1948 f42ec5c1 1948 f42ec5c1 1948 f42ec5c1 1948 f42ec5c1 1948 f42ec5c1 716 91e3545bd665659b703fc7d8b0f3ae2b433927173d7c96b3beb9bf79d5d70677.exe 716 91e3545bd665659b703fc7d8b0f3ae2b433927173d7c96b3beb9bf79d5d70677.exe 716 91e3545bd665659b703fc7d8b0f3ae2b433927173d7c96b3beb9bf79d5d70677.exe 716 91e3545bd665659b703fc7d8b0f3ae2b433927173d7c96b3beb9bf79d5d70677.exe 716 91e3545bd665659b703fc7d8b0f3ae2b433927173d7c96b3beb9bf79d5d70677.exe 716 91e3545bd665659b703fc7d8b0f3ae2b433927173d7c96b3beb9bf79d5d70677.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 716 91e3545bd665659b703fc7d8b0f3ae2b433927173d7c96b3beb9bf79d5d70677.exe Token: SeTcbPrivilege 716 91e3545bd665659b703fc7d8b0f3ae2b433927173d7c96b3beb9bf79d5d70677.exe Token: SeDebugPrivilege 1948 f42ec5c1 Token: SeTcbPrivilege 1948 f42ec5c1
Processes
-
C:\Users\Admin\AppData\Local\Temp\91e3545bd665659b703fc7d8b0f3ae2b433927173d7c96b3beb9bf79d5d70677.exe"C:\Users\Admin\AppData\Local\Temp\91e3545bd665659b703fc7d8b0f3ae2b433927173d7c96b3beb9bf79d5d70677.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:716
-
C:\Windows\Syswow64\f42ec5c1C:\Windows\Syswow64\f42ec5c11⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1948
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\f42ec5c1
- Size 2.0MB
- SHA256 589568de62ac37d349131c55735dd0284380a74e7a323bc352669695bd157653
- MD5 f0f51ef46ad0298b14085332950a1ab3
- SHA1 a3586f7c9c4520f9d812dbbfda0ed3a4fe5c3887
- SHA512 6d6ee5edb2f3b0f9ace85f75409778f074c531ca1f3af89338e952c3c4b9e9b5572322c9349ff39bdcd914c57be8369c7853310a6826b024f0616a14ee7be45e
- SSDEEP 49152:DHHKO29QG56/OJdJCXDrsOFZMjHfUTGkQy58:DnKdVkOhCXHHFZMjHfUKkVi
- TLSH T19AA57D31A6C18036E1B3867586FA56FAA5247C216311A5CF63C47A2A1F737D3EE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH