Analysis
- max time kernel
150s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 06:46
Behavioral task
behavioral1
Sample
0cc04a4f70aedd1bbb8b0d50bffd09dcbdb031ef430e189de9674442ee0a4a81.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 0cc04a4f70aedd1bbb8b0d50bffd09dcbdb031ef430e189de9674442ee0a4a81.exe
- Size 560KB
- Sample260930-hjpqbsssft
- SHA256 0cc04a4f70aedd1bbb8b0d50bffd09dcbdb031ef430e189de9674442ee0a4a81
- MD5 17a6bec62874b9bce6f74b9fbff85b35
- SHA1 6410afcec3ba31f5572be5764be8ed482431c69f
- SHA512 207220c60908809716c7026ba88f5e637773ee34bb29fd05bebba6188e8ee4ac7bff7a5e1d5505ac845ac7eb30b2df68011da4fffb1855609a0cf4071e7c1d88
- SSDEEP 12288:GftONCx61vvGEYQFNEhyQU/lLi2IsOkxHy:QtONCTU/lmaOkxS
- TLSH T15EC48E29B6E0C076C4B79574C4A186BAFAB17432372089CFA39407571F637D2BA3974E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1780 99f0f2ce - Unexpected DNS network traffic destination 24 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 234 114.114.114.114 4228 0cc04a4f70aedd1bbb8b0d50bffd09dcbdb031ef430e189de9674442ee0a4a81.exe Destination IP 265 114.114.114.114 4228 0cc04a4f70aedd1bbb8b0d50bffd09dcbdb031ef430e189de9674442ee0a4a81.exe Destination IP 3 114.114.114.114 4228 0cc04a4f70aedd1bbb8b0d50bffd09dcbdb031ef430e189de9674442ee0a4a81.exe Destination IP 93 114.114.114.114 1780 99f0f2ce Destination IP 149 223.5.5.5 4228 0cc04a4f70aedd1bbb8b0d50bffd09dcbdb031ef430e189de9674442ee0a4a81.exe Destination IP 39 114.114.114.114 4228 0cc04a4f70aedd1bbb8b0d50bffd09dcbdb031ef430e189de9674442ee0a4a81.exe Destination IP 40 223.5.5.5 4228 0cc04a4f70aedd1bbb8b0d50bffd09dcbdb031ef430e189de9674442ee0a4a81.exe Destination IP 235 223.5.5.5 4228 0cc04a4f70aedd1bbb8b0d50bffd09dcbdb031ef430e189de9674442ee0a4a81.exe Destination IP 367 223.5.5.5 4228 0cc04a4f70aedd1bbb8b0d50bffd09dcbdb031ef430e189de9674442ee0a4a81.exe Destination IP 481 223.5.5.5 4228 0cc04a4f70aedd1bbb8b0d50bffd09dcbdb031ef430e189de9674442ee0a4a81.exe Destination IP 5 223.5.5.5 4228 0cc04a4f70aedd1bbb8b0d50bffd09dcbdb031ef430e189de9674442ee0a4a81.exe Destination IP 94 223.5.5.5 4228 0cc04a4f70aedd1bbb8b0d50bffd09dcbdb031ef430e189de9674442ee0a4a81.exe Destination IP 148 114.114.114.114 4228 0cc04a4f70aedd1bbb8b0d50bffd09dcbdb031ef430e189de9674442ee0a4a81.exe Destination IP 180 114.114.114.114 4228 0cc04a4f70aedd1bbb8b0d50bffd09dcbdb031ef430e189de9674442ee0a4a81.exe Destination IP 181 223.5.5.5 4228 0cc04a4f70aedd1bbb8b0d50bffd09dcbdb031ef430e189de9674442ee0a4a81.exe Destination IP 313 114.114.114.114 4228 0cc04a4f70aedd1bbb8b0d50bffd09dcbdb031ef430e189de9674442ee0a4a81.exe Destination IP 315 223.5.5.5 4228 0cc04a4f70aedd1bbb8b0d50bffd09dcbdb031ef430e189de9674442ee0a4a81.exe Destination IP 366 114.114.114.114 4228 0cc04a4f70aedd1bbb8b0d50bffd09dcbdb031ef430e189de9674442ee0a4a81.exe Destination IP 267 223.5.5.5 4228 0cc04a4f70aedd1bbb8b0d50bffd09dcbdb031ef430e189de9674442ee0a4a81.exe Destination IP 336 114.114.114.114 4228 0cc04a4f70aedd1bbb8b0d50bffd09dcbdb031ef430e189de9674442ee0a4a81.exe Destination IP 337 223.5.5.5 4228 0cc04a4f70aedd1bbb8b0d50bffd09dcbdb031ef430e189de9674442ee0a4a81.exe Destination IP 422 114.114.114.114 4228 0cc04a4f70aedd1bbb8b0d50bffd09dcbdb031ef430e189de9674442ee0a4a81.exe Destination IP 423 223.5.5.5 4228 0cc04a4f70aedd1bbb8b0d50bffd09dcbdb031ef430e189de9674442ee0a4a81.exe Destination IP 480 114.114.114.114 4228 0cc04a4f70aedd1bbb8b0d50bffd09dcbdb031ef430e189de9674442ee0a4a81.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 99f0f2ce File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 99f0f2ce File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 99f0f2ce File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 99f0f2ce File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 99f0f2ce File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 99f0f2ce File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 99f0f2ce File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 99f0f2ce File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 99f0f2ce File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 99f0f2ce File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 99f0f2ce File created C:\Windows\SysWOW64\99f0f2ce 0cc04a4f70aedd1bbb8b0d50bffd09dcbdb031ef430e189de9674442ee0a4a81.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 99f0f2ce -
resource yara_rule behavioral2/memory/4228-0-0x00000000002A0000-0x000000000032C000-memory.dmp upx behavioral2/files/0x000d000000006908-2.dat upx behavioral2/memory/1780-3-0x0000000000980000-0x0000000000A0C000-memory.dmp upx behavioral2/memory/4228-18-0x00000000002A0000-0x000000000032C000-memory.dmp upx behavioral2/memory/1780-19-0x0000000000980000-0x0000000000A0C000-memory.dmp upx behavioral2/memory/1780-44-0x0000000000980000-0x0000000000A0C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\1e7968 99f0f2ce File opened for modification C:\Windows\486288 0cc04a4f70aedd1bbb8b0d50bffd09dcbdb031ef430e189de9674442ee0a4a81.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 99f0f2ce Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 0cc04a4f70aedd1bbb8b0d50bffd09dcbdb031ef430e189de9674442ee0a4a81.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 0cc04a4f70aedd1bbb8b0d50bffd09dcbdb031ef430e189de9674442ee0a4a81.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 99f0f2ce - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0cc04a4f70aedd1bbb8b0d50bffd09dcbdb031ef430e189de9674442ee0a4a81.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99f0f2ce - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 99f0f2ce Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 99f0f2ce Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 99f0f2ce Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 99f0f2ce Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 99f0f2ce Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 99f0f2ce Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 99f0f2ce Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 99f0f2ce Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 99f0f2ce - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 1780 99f0f2ce 1780 99f0f2ce 1780 99f0f2ce 1780 99f0f2ce 1780 99f0f2ce 1780 99f0f2ce 1780 99f0f2ce 1780 99f0f2ce 4228 0cc04a4f70aedd1bbb8b0d50bffd09dcbdb031ef430e189de9674442ee0a4a81.exe 4228 0cc04a4f70aedd1bbb8b0d50bffd09dcbdb031ef430e189de9674442ee0a4a81.exe 4228 0cc04a4f70aedd1bbb8b0d50bffd09dcbdb031ef430e189de9674442ee0a4a81.exe 4228 0cc04a4f70aedd1bbb8b0d50bffd09dcbdb031ef430e189de9674442ee0a4a81.exe 4228 0cc04a4f70aedd1bbb8b0d50bffd09dcbdb031ef430e189de9674442ee0a4a81.exe 4228 0cc04a4f70aedd1bbb8b0d50bffd09dcbdb031ef430e189de9674442ee0a4a81.exe 4228 0cc04a4f70aedd1bbb8b0d50bffd09dcbdb031ef430e189de9674442ee0a4a81.exe 4228 0cc04a4f70aedd1bbb8b0d50bffd09dcbdb031ef430e189de9674442ee0a4a81.exe 4228 0cc04a4f70aedd1bbb8b0d50bffd09dcbdb031ef430e189de9674442ee0a4a81.exe 4228 0cc04a4f70aedd1bbb8b0d50bffd09dcbdb031ef430e189de9674442ee0a4a81.exe 4228 0cc04a4f70aedd1bbb8b0d50bffd09dcbdb031ef430e189de9674442ee0a4a81.exe 4228 0cc04a4f70aedd1bbb8b0d50bffd09dcbdb031ef430e189de9674442ee0a4a81.exe 4228 0cc04a4f70aedd1bbb8b0d50bffd09dcbdb031ef430e189de9674442ee0a4a81.exe 4228 0cc04a4f70aedd1bbb8b0d50bffd09dcbdb031ef430e189de9674442ee0a4a81.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4228 0cc04a4f70aedd1bbb8b0d50bffd09dcbdb031ef430e189de9674442ee0a4a81.exe Token: SeTcbPrivilege 4228 0cc04a4f70aedd1bbb8b0d50bffd09dcbdb031ef430e189de9674442ee0a4a81.exe Token: SeDebugPrivilege 1780 99f0f2ce Token: SeTcbPrivilege 1780 99f0f2ce
Processes
-
C:\Users\Admin\AppData\Local\Temp\0cc04a4f70aedd1bbb8b0d50bffd09dcbdb031ef430e189de9674442ee0a4a81.exe"C:\Users\Admin\AppData\Local\Temp\0cc04a4f70aedd1bbb8b0d50bffd09dcbdb031ef430e189de9674442ee0a4a81.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4228
-
C:\Windows\Syswow64\99f0f2ceC:\Windows\Syswow64\99f0f2ce1⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1780
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\99f0f2ce
- Size 560KB
- SHA256 31f1bdcb0c85d692e37c7d63fbaa2b49ea106fa372ec6fc4c37fb489c46111f6
- MD5 7e4a2918d9011463e13e848bda04116d
- SHA1 1a43e8cd304633c469b13a553940e8ae64615051
- SHA512 c8eb767bb71aed49d3bab689cf54b7ba9818c16a556736509197381e6ebe81b50bccea17e56354e64fbcd26a77280913dc9edcaec87eb5ecfddbf79ddc7d2b21
- SSDEEP 12288:8ftONCx61vvGEYQFNEhyQU/lLi2IsOkxHy:OtONCTU/lmaOkxS
- TLSH T15AC48E29B6E0C076C4B79574C4A186BAFAB17432372089CFA39407571F637D2BA3974E
- MD5 SHA1 SHA512 SSDEEP TLSH