Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/09/2026, 08:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
53132b177c27a5c5586570831785049505e4f04fe00bb3bfe49a84b5847f3b8d.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
53132b177c27a5c5586570831785049505e4f04fe00bb3bfe49a84b5847f3b8d.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 53132b177c27a5c5586570831785049505e4f04fe00bb3bfe49a84b5847f3b8d.exe
- Size 3.0MB
- Sample260930-kf67bazthy
- SHA256 53132b177c27a5c5586570831785049505e4f04fe00bb3bfe49a84b5847f3b8d
- MD5 f1d98878a41b6871780f8bbee196fdbc
- SHA1 2a220cc66d24bfd07bb61ca9b5125dcccdfba46a
- SHA512 9cf9e09c581ca9909464581571e14dd297d8d3b820664fa5cb79d08ef054e6855066557eac3a6faee84e9ad48223d9e4c8254c22768b9f4908b76540334167c5
- SSDEEP 49152:yHHKO29QG5QZuTtS0rQMYOQ+q8CEOTG4QmTGHQv9KFeMz:ynKdBWsM0r1Qn1K4XKH40Feq
- TLSH T1BBE59D12F7A0C036C4A7027589BA476EA678BD614B2547CBB3C47B2E5F723D16E3530A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3988 66f08e00 - Unexpected DNS network traffic destination 21 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 3 114.114.114.114 2616 53132b177c27a5c5586570831785049505e4f04fe00bb3bfe49a84b5847f3b8d.exe Destination IP 4 223.5.5.5 2616 53132b177c27a5c5586570831785049505e4f04fe00bb3bfe49a84b5847f3b8d.exe Destination IP 335 223.5.5.5 2616 53132b177c27a5c5586570831785049505e4f04fe00bb3bfe49a84b5847f3b8d.exe Destination IP 131 223.5.5.5 2616 53132b177c27a5c5586570831785049505e4f04fe00bb3bfe49a84b5847f3b8d.exe Destination IP 203 223.5.5.5 2616 53132b177c27a5c5586570831785049505e4f04fe00bb3bfe49a84b5847f3b8d.exe Destination IP 241 223.5.5.5 2616 53132b177c27a5c5586570831785049505e4f04fe00bb3bfe49a84b5847f3b8d.exe Destination IP 333 114.114.114.114 2616 53132b177c27a5c5586570831785049505e4f04fe00bb3bfe49a84b5847f3b8d.exe Destination IP 393 114.114.114.114 2616 53132b177c27a5c5586570831785049505e4f04fe00bb3bfe49a84b5847f3b8d.exe Destination IP 494 223.5.5.5 2616 53132b177c27a5c5586570831785049505e4f04fe00bb3bfe49a84b5847f3b8d.exe Destination IP 65 114.114.114.114 2616 53132b177c27a5c5586570831785049505e4f04fe00bb3bfe49a84b5847f3b8d.exe Destination IP 202 114.114.114.114 2616 53132b177c27a5c5586570831785049505e4f04fe00bb3bfe49a84b5847f3b8d.exe Destination IP 301 114.114.114.114 2616 53132b177c27a5c5586570831785049505e4f04fe00bb3bfe49a84b5847f3b8d.exe Destination IP 302 223.5.5.5 2616 53132b177c27a5c5586570831785049505e4f04fe00bb3bfe49a84b5847f3b8d.exe Destination IP 402 223.5.5.5 2616 53132b177c27a5c5586570831785049505e4f04fe00bb3bfe49a84b5847f3b8d.exe Destination IP 432 114.114.114.114 2616 53132b177c27a5c5586570831785049505e4f04fe00bb3bfe49a84b5847f3b8d.exe Destination IP 493 114.114.114.114 2616 53132b177c27a5c5586570831785049505e4f04fe00bb3bfe49a84b5847f3b8d.exe Destination IP 66 223.5.5.5 2616 53132b177c27a5c5586570831785049505e4f04fe00bb3bfe49a84b5847f3b8d.exe Destination IP 130 114.114.114.114 3988 66f08e00 Destination IP 240 114.114.114.114 2616 53132b177c27a5c5586570831785049505e4f04fe00bb3bfe49a84b5847f3b8d.exe Destination IP 401 114.114.114.114 2616 53132b177c27a5c5586570831785049505e4f04fe00bb3bfe49a84b5847f3b8d.exe Destination IP 433 223.5.5.5 2616 53132b177c27a5c5586570831785049505e4f04fe00bb3bfe49a84b5847f3b8d.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 66f08e00 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 66f08e00 File created C:\Windows\SysWOW64\66f08e00 53132b177c27a5c5586570831785049505e4f04fe00bb3bfe49a84b5847f3b8d.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 66f08e00 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 66f08e00 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 66f08e00 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 66f08e00 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 66f08e00 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 66f08e00 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 66f08e00 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 66f08e00 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 66f08e00 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 66f08e00 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\4446a8 66f08e00 File opened for modification C:\Windows\2cc970 53132b177c27a5c5586570831785049505e4f04fe00bb3bfe49a84b5847f3b8d.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 66f08e00 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 66f08e00 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 53132b177c27a5c5586570831785049505e4f04fe00bb3bfe49a84b5847f3b8d.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 53132b177c27a5c5586570831785049505e4f04fe00bb3bfe49a84b5847f3b8d.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 53132b177c27a5c5586570831785049505e4f04fe00bb3bfe49a84b5847f3b8d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66f08e00 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 66f08e00 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 66f08e00 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 66f08e00 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 66f08e00 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 66f08e00 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 66f08e00 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 66f08e00 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 66f08e00 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 66f08e00 - Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 3988 66f08e00 3988 66f08e00 3988 66f08e00 3988 66f08e00 3988 66f08e00 3988 66f08e00 3988 66f08e00 3988 66f08e00 3988 66f08e00 3988 66f08e00 3988 66f08e00 3988 66f08e00 3988 66f08e00 3988 66f08e00 3988 66f08e00 3988 66f08e00 3988 66f08e00 3988 66f08e00 3988 66f08e00 3988 66f08e00 2616 53132b177c27a5c5586570831785049505e4f04fe00bb3bfe49a84b5847f3b8d.exe 2616 53132b177c27a5c5586570831785049505e4f04fe00bb3bfe49a84b5847f3b8d.exe 2616 53132b177c27a5c5586570831785049505e4f04fe00bb3bfe49a84b5847f3b8d.exe 2616 53132b177c27a5c5586570831785049505e4f04fe00bb3bfe49a84b5847f3b8d.exe 2616 53132b177c27a5c5586570831785049505e4f04fe00bb3bfe49a84b5847f3b8d.exe 2616 53132b177c27a5c5586570831785049505e4f04fe00bb3bfe49a84b5847f3b8d.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2616 53132b177c27a5c5586570831785049505e4f04fe00bb3bfe49a84b5847f3b8d.exe Token: SeTcbPrivilege 2616 53132b177c27a5c5586570831785049505e4f04fe00bb3bfe49a84b5847f3b8d.exe Token: SeDebugPrivilege 3988 66f08e00 Token: SeTcbPrivilege 3988 66f08e00
Processes
-
C:\Users\Admin\AppData\Local\Temp\53132b177c27a5c5586570831785049505e4f04fe00bb3bfe49a84b5847f3b8d.exe"C:\Users\Admin\AppData\Local\Temp\53132b177c27a5c5586570831785049505e4f04fe00bb3bfe49a84b5847f3b8d.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2616
-
C:\Windows\Syswow64\66f08e00C:\Windows\Syswow64\66f08e001⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3988
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\4446a8
- Size 906B
- SHA256 f5769c62b23c39a71eca052e58a0b7f7379c9f015a3d4a0acaf9a024fcc7cfef
- MD5 cf9a8801ed6d2ed81205f13df1c9ee72
- SHA1 087062c1d04288a724181a5608b92207e3e54445
- SHA512 59ec2413a2eb23426c57f7438837f02caee26af65a4518a12f325cfc68365990d3b05784f112b5f7fc3956e47711c8d06a44e6ac64bce5476ca439693df4acd7
- TLSH T18811C0FEF0F822520ABCC911B5195DF63515775F56FA1414AF8AAD1E397B424490340B
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\66f08e00
- Size 3.0MB
- SHA256 aa6b796d4d6f06d5804795b7a89914ac2cd7f26596d1b86d4b69dae06a66c3ce
- MD5 2169d649453362842d956f06337c1785
- SHA1 512293f3830705f610787784d2f6a26f0da84824
- SHA512 cfa3c2ded7d9cfa6dd566551db4b3dc527b68ed090dab0e411eb5ca29b8f1fdc0fc601f2b87dc6db362d829ba319849cff53e33ce521fc80b195d51b5bc02921
- SSDEEP 49152:eHHKO29QG5QZuTtS0rQMYOQ+q8CEOTG4QmTGHQv9KFeMz:enKdBWsM0r1Qn1K4XKH40Feq
- TLSH T1B7E59D12F7A0C036C4A7027589BA476EA678BD614B2547CBB3C47B2E5F723D16E3530A
- MD5 SHA1 SHA512 SSDEEP TLSH