Analysis
- max time kernel
150s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 18:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b684e04dcd1e33b323bf534ed12da34be89d1ea8a5552654e86f277bbbfd7c15.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
b684e04dcd1e33b323bf534ed12da34be89d1ea8a5552654e86f277bbbfd7c15.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target b684e04dcd1e33b323bf534ed12da34be89d1ea8a5552654e86f277bbbfd7c15.exe
- Size 679KB
- Sample260930-xdtvesfe78
- SHA256 b684e04dcd1e33b323bf534ed12da34be89d1ea8a5552654e86f277bbbfd7c15
- MD5 02106012a3c8cb00f36e233a72b1f075
- SHA1 e9ecc4c471a5871c99179cc69534e9d761225bff
- SHA512 052d951e3e1833da4989a76b67d8a7c95599d4a9d3bd33bc915b11d4494b062fba2bf5433f4d885f920b05d106ea25175dca86e0befe9385db8ed65b60cd8380
- SSDEEP 12288:aSvO2x9mONvKRILSFnOkx2LIaxya5FAQjU/Lik8CQ3K:BvO2xJKRI2FOkx2LFEvcUQPK
- TLSH T12CE45A31E641C036D4A74576C6FA0BBFE964BD25131165CBA3C43A262FB36D2BA3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3784 ca7be53e - Unexpected DNS network traffic destination 22 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 343 114.114.114.114 3228 b684e04dcd1e33b323bf534ed12da34be89d1ea8a5552654e86f277bbbfd7c15.exe Destination IP 398 223.5.5.5 3228 b684e04dcd1e33b323bf534ed12da34be89d1ea8a5552654e86f277bbbfd7c15.exe Destination IP 1 114.114.114.114 3228 b684e04dcd1e33b323bf534ed12da34be89d1ea8a5552654e86f277bbbfd7c15.exe Destination IP 3 223.5.5.5 3228 b684e04dcd1e33b323bf534ed12da34be89d1ea8a5552654e86f277bbbfd7c15.exe Destination IP 181 114.114.114.114 3228 b684e04dcd1e33b323bf534ed12da34be89d1ea8a5552654e86f277bbbfd7c15.exe Destination IP 235 114.114.114.114 3228 b684e04dcd1e33b323bf534ed12da34be89d1ea8a5552654e86f277bbbfd7c15.exe Destination IP 289 223.5.5.5 3228 b684e04dcd1e33b323bf534ed12da34be89d1ea8a5552654e86f277bbbfd7c15.exe Destination IP 397 114.114.114.114 3228 b684e04dcd1e33b323bf534ed12da34be89d1ea8a5552654e86f277bbbfd7c15.exe Destination IP 451 114.114.114.114 3228 b684e04dcd1e33b323bf534ed12da34be89d1ea8a5552654e86f277bbbfd7c15.exe Destination IP 95 223.5.5.5 3228 b684e04dcd1e33b323bf534ed12da34be89d1ea8a5552654e86f277bbbfd7c15.exe Destination IP 149 114.114.114.114 3228 b684e04dcd1e33b323bf534ed12da34be89d1ea8a5552654e86f277bbbfd7c15.exe Destination IP 150 223.5.5.5 3228 b684e04dcd1e33b323bf534ed12da34be89d1ea8a5552654e86f277bbbfd7c15.exe Destination IP 312 223.5.5.5 3228 b684e04dcd1e33b323bf534ed12da34be89d1ea8a5552654e86f277bbbfd7c15.exe Destination IP 40 114.114.114.114 3228 b684e04dcd1e33b323bf534ed12da34be89d1ea8a5552654e86f277bbbfd7c15.exe Destination IP 236 223.5.5.5 3228 b684e04dcd1e33b323bf534ed12da34be89d1ea8a5552654e86f277bbbfd7c15.exe Destination IP 286 114.114.114.114 3228 b684e04dcd1e33b323bf534ed12da34be89d1ea8a5552654e86f277bbbfd7c15.exe Destination IP 311 114.114.114.114 3228 b684e04dcd1e33b323bf534ed12da34be89d1ea8a5552654e86f277bbbfd7c15.exe Destination IP 344 223.5.5.5 3228 b684e04dcd1e33b323bf534ed12da34be89d1ea8a5552654e86f277bbbfd7c15.exe Destination IP 452 223.5.5.5 3228 b684e04dcd1e33b323bf534ed12da34be89d1ea8a5552654e86f277bbbfd7c15.exe Destination IP 41 223.5.5.5 3228 b684e04dcd1e33b323bf534ed12da34be89d1ea8a5552654e86f277bbbfd7c15.exe Destination IP 94 114.114.114.114 3784 ca7be53e Destination IP 182 223.5.5.5 3228 b684e04dcd1e33b323bf534ed12da34be89d1ea8a5552654e86f277bbbfd7c15.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 ca7be53e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 ca7be53e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache ca7be53e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData ca7be53e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 ca7be53e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 ca7be53e File created C:\Windows\SysWOW64\ca7be53e b684e04dcd1e33b323bf534ed12da34be89d1ea8a5552654e86f277bbbfd7c15.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE ca7be53e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies ca7be53e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft ca7be53e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content ca7be53e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 ca7be53e File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 ca7be53e - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\40c890 ca7be53e File opened for modification C:\Windows\3743b8 b684e04dcd1e33b323bf534ed12da34be89d1ea8a5552654e86f277bbbfd7c15.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname ca7be53e Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain ca7be53e Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname b684e04dcd1e33b323bf534ed12da34be89d1ea8a5552654e86f277bbbfd7c15.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain b684e04dcd1e33b323bf534ed12da34be89d1ea8a5552654e86f277bbbfd7c15.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b684e04dcd1e33b323bf534ed12da34be89d1ea8a5552654e86f277bbbfd7c15.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ca7be53e - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" ca7be53e Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" ca7be53e Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ca7be53e Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ca7be53e Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ca7be53e Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing ca7be53e Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix ca7be53e Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ca7be53e Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ca7be53e - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 3784 ca7be53e 3784 ca7be53e 3784 ca7be53e 3784 ca7be53e 3784 ca7be53e 3784 ca7be53e 3784 ca7be53e 3784 ca7be53e 3228 b684e04dcd1e33b323bf534ed12da34be89d1ea8a5552654e86f277bbbfd7c15.exe 3228 b684e04dcd1e33b323bf534ed12da34be89d1ea8a5552654e86f277bbbfd7c15.exe 3228 b684e04dcd1e33b323bf534ed12da34be89d1ea8a5552654e86f277bbbfd7c15.exe 3228 b684e04dcd1e33b323bf534ed12da34be89d1ea8a5552654e86f277bbbfd7c15.exe 3228 b684e04dcd1e33b323bf534ed12da34be89d1ea8a5552654e86f277bbbfd7c15.exe 3228 b684e04dcd1e33b323bf534ed12da34be89d1ea8a5552654e86f277bbbfd7c15.exe 3228 b684e04dcd1e33b323bf534ed12da34be89d1ea8a5552654e86f277bbbfd7c15.exe 3228 b684e04dcd1e33b323bf534ed12da34be89d1ea8a5552654e86f277bbbfd7c15.exe 3228 b684e04dcd1e33b323bf534ed12da34be89d1ea8a5552654e86f277bbbfd7c15.exe 3228 b684e04dcd1e33b323bf534ed12da34be89d1ea8a5552654e86f277bbbfd7c15.exe 3228 b684e04dcd1e33b323bf534ed12da34be89d1ea8a5552654e86f277bbbfd7c15.exe 3228 b684e04dcd1e33b323bf534ed12da34be89d1ea8a5552654e86f277bbbfd7c15.exe 3228 b684e04dcd1e33b323bf534ed12da34be89d1ea8a5552654e86f277bbbfd7c15.exe 3228 b684e04dcd1e33b323bf534ed12da34be89d1ea8a5552654e86f277bbbfd7c15.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3228 b684e04dcd1e33b323bf534ed12da34be89d1ea8a5552654e86f277bbbfd7c15.exe Token: SeTcbPrivilege 3228 b684e04dcd1e33b323bf534ed12da34be89d1ea8a5552654e86f277bbbfd7c15.exe Token: SeDebugPrivilege 3784 ca7be53e Token: SeTcbPrivilege 3784 ca7be53e
Processes
-
C:\Users\Admin\AppData\Local\Temp\b684e04dcd1e33b323bf534ed12da34be89d1ea8a5552654e86f277bbbfd7c15.exe"C:\Users\Admin\AppData\Local\Temp\b684e04dcd1e33b323bf534ed12da34be89d1ea8a5552654e86f277bbbfd7c15.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3228
-
C:\Windows\Syswow64\ca7be53eC:\Windows\Syswow64\ca7be53e1⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3784
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\ca7be53e
- Size 679KB
- SHA256 31041c98cf949c03614ff7ee379f5c5090281d554c4ed3fb11126a2ad4a0aaa7
- MD5 835f3707f99a99c613f54be146586e24
- SHA1 1ad269eb80f6f25b4227c90aaf49e887199577ac
- SHA512 31baae548dab5c4455b7f6656ed5680203fc005c477ebb35ca7850a401f4ede3830f74893d3c21520d5d8bbe3d4425942bad9344c99d7db43a9f5efffb860a94
- SSDEEP 12288:qSvO2x9mONvKRILSFnOkx2LIaxya5FAQjU/Lik8CQ3K:xvO2xJKRI2FOkx2LFEvcUQPK
- TLSH T1A3E45A31E641C036D4A74576C6FA0BBFE964BD25131165CBA3C43A262FB36D2BA3170E
- MD5 SHA1 SHA512 SSDEEP TLSH