Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/09/2026, 20:06
Behavioral task
behavioral1
Sample
68e50907ed6e8832686e108c74baacb5166fd9a6950e0466871513847cf8ee2c.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 68e50907ed6e8832686e108c74baacb5166fd9a6950e0466871513847cf8ee2c.exe
- Size 560KB
- Sample260930-yvm9msvakf
- SHA256 68e50907ed6e8832686e108c74baacb5166fd9a6950e0466871513847cf8ee2c
- MD5 a2e1eca7ddbc1d9d2b3d9532bddc7d20
- SHA1 762b78a8d9e7f34db5e1bc27e21def9d66282b20
- SHA512 7cb2ecf0b6e00666de60d671422450f2af368935968125c9ff0873eada8578b182fe49a75fb70270be0b7a75156466899e20115afa940868fcdae887ddde7185
- SSDEEP 6144:jUJJuV1cdhIoA7vJ0CLoCgvDLe4AmFvirGcEOkCybEaQRuy8K:jYsVOdhElvkCgvDLe4usOkxHy
- TLSH T177C48D29B6D0C036C5B39574C4A186BAEAB17432372549CFA3D5475A0F337E2BA7930E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1348 2afd10f6 - Unexpected DNS network traffic destination 22 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 424 114.114.114.114 2288 68e50907ed6e8832686e108c74baacb5166fd9a6950e0466871513847cf8ee2c.exe Destination IP 425 223.5.5.5 2288 68e50907ed6e8832686e108c74baacb5166fd9a6950e0466871513847cf8ee2c.exe Destination IP 3 114.114.114.114 2288 68e50907ed6e8832686e108c74baacb5166fd9a6950e0466871513847cf8ee2c.exe Destination IP 4 223.5.5.5 2288 68e50907ed6e8832686e108c74baacb5166fd9a6950e0466871513847cf8ee2c.exe Destination IP 122 114.114.114.114 1348 2afd10f6 Destination IP 193 223.5.5.5 2288 68e50907ed6e8832686e108c74baacb5166fd9a6950e0466871513847cf8ee2c.exe Destination IP 346 223.5.5.5 2288 68e50907ed6e8832686e108c74baacb5166fd9a6950e0466871513847cf8ee2c.exe Destination IP 393 114.114.114.114 2288 68e50907ed6e8832686e108c74baacb5166fd9a6950e0466871513847cf8ee2c.exe Destination IP 486 223.5.5.5 2288 68e50907ed6e8832686e108c74baacb5166fd9a6950e0466871513847cf8ee2c.exe Destination IP 544 114.114.114.114 2288 68e50907ed6e8832686e108c74baacb5166fd9a6950e0466871513847cf8ee2c.exe Destination IP 192 114.114.114.114 2288 68e50907ed6e8832686e108c74baacb5166fd9a6950e0466871513847cf8ee2c.exe Destination IP 301 223.5.5.5 2288 68e50907ed6e8832686e108c74baacb5166fd9a6950e0466871513847cf8ee2c.exe Destination IP 57 114.114.114.114 2288 68e50907ed6e8832686e108c74baacb5166fd9a6950e0466871513847cf8ee2c.exe Destination IP 58 223.5.5.5 2288 68e50907ed6e8832686e108c74baacb5166fd9a6950e0466871513847cf8ee2c.exe Destination IP 123 223.5.5.5 2288 68e50907ed6e8832686e108c74baacb5166fd9a6950e0466871513847cf8ee2c.exe Destination IP 239 114.114.114.114 2288 68e50907ed6e8832686e108c74baacb5166fd9a6950e0466871513847cf8ee2c.exe Destination IP 344 114.114.114.114 2288 68e50907ed6e8832686e108c74baacb5166fd9a6950e0466871513847cf8ee2c.exe Destination IP 485 114.114.114.114 2288 68e50907ed6e8832686e108c74baacb5166fd9a6950e0466871513847cf8ee2c.exe Destination IP 545 223.5.5.5 2288 68e50907ed6e8832686e108c74baacb5166fd9a6950e0466871513847cf8ee2c.exe Destination IP 240 223.5.5.5 2288 68e50907ed6e8832686e108c74baacb5166fd9a6950e0466871513847cf8ee2c.exe Destination IP 300 114.114.114.114 2288 68e50907ed6e8832686e108c74baacb5166fd9a6950e0466871513847cf8ee2c.exe Destination IP 394 223.5.5.5 2288 68e50907ed6e8832686e108c74baacb5166fd9a6950e0466871513847cf8ee2c.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 2afd10f6 File created C:\Windows\SysWOW64\2afd10f6 68e50907ed6e8832686e108c74baacb5166fd9a6950e0466871513847cf8ee2c.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 2afd10f6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 2afd10f6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 2afd10f6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 2afd10f6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 2afd10f6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 2afd10f6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 2afd10f6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 2afd10f6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 2afd10f6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 2afd10f6 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 2afd10f6 -
resource yara_rule behavioral1/memory/2288-0-0x0000000000450000-0x00000000004DC000-memory.dmp upx behavioral1/files/0x000a00000002433c-2.dat upx behavioral1/memory/1348-4-0x0000000000520000-0x00000000005AC000-memory.dmp upx behavioral1/memory/2288-18-0x0000000000450000-0x00000000004DC000-memory.dmp upx behavioral1/memory/1348-19-0x0000000000520000-0x00000000005AC000-memory.dmp upx behavioral1/memory/1348-38-0x0000000000520000-0x00000000005AC000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\171408 2afd10f6 File opened for modification C:\Windows\272be0 68e50907ed6e8832686e108c74baacb5166fd9a6950e0466871513847cf8ee2c.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 68e50907ed6e8832686e108c74baacb5166fd9a6950e0466871513847cf8ee2c.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 68e50907ed6e8832686e108c74baacb5166fd9a6950e0466871513847cf8ee2c.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 2afd10f6 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 2afd10f6 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68e50907ed6e8832686e108c74baacb5166fd9a6950e0466871513847cf8ee2c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2afd10f6 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 2afd10f6 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 2afd10f6 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 2afd10f6 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 2afd10f6 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 2afd10f6 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 2afd10f6 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 2afd10f6 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 2afd10f6 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 2afd10f6 - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 1348 2afd10f6 1348 2afd10f6 1348 2afd10f6 1348 2afd10f6 1348 2afd10f6 1348 2afd10f6 1348 2afd10f6 1348 2afd10f6 2288 68e50907ed6e8832686e108c74baacb5166fd9a6950e0466871513847cf8ee2c.exe 2288 68e50907ed6e8832686e108c74baacb5166fd9a6950e0466871513847cf8ee2c.exe 2288 68e50907ed6e8832686e108c74baacb5166fd9a6950e0466871513847cf8ee2c.exe 2288 68e50907ed6e8832686e108c74baacb5166fd9a6950e0466871513847cf8ee2c.exe 2288 68e50907ed6e8832686e108c74baacb5166fd9a6950e0466871513847cf8ee2c.exe 2288 68e50907ed6e8832686e108c74baacb5166fd9a6950e0466871513847cf8ee2c.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2288 68e50907ed6e8832686e108c74baacb5166fd9a6950e0466871513847cf8ee2c.exe Token: SeTcbPrivilege 2288 68e50907ed6e8832686e108c74baacb5166fd9a6950e0466871513847cf8ee2c.exe Token: SeDebugPrivilege 1348 2afd10f6 Token: SeTcbPrivilege 1348 2afd10f6
Processes
-
C:\Users\Admin\AppData\Local\Temp\68e50907ed6e8832686e108c74baacb5166fd9a6950e0466871513847cf8ee2c.exe"C:\Users\Admin\AppData\Local\Temp\68e50907ed6e8832686e108c74baacb5166fd9a6950e0466871513847cf8ee2c.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2288
-
C:\Windows\Syswow64\2afd10f6C:\Windows\Syswow64\2afd10f61⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1348
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\2afd10f6
- Size 560KB
- SHA256 71ef121b8037406eeee6dce61602276c5b8fc4326b618bc580a4c475fd3ae938
- MD5 367617912752bb61f364ea16d6042cc6
- SHA1 a41fc7987235a7b462c795fd9bc441aae4adb77a
- SHA512 da3e5e9fb435fe7773dffe09e8ffb2a2f17211cb574df4e29b36ea561bd8a3fa929d196af997a6ce15118f801960e6592a9c3fad9f14e743283d552cb90a2cf8
- SSDEEP 6144:1UJJuV1cdhIoA7vJ0CLoCgvDLe4AmFvirGcEOkCybEaQRuy8K:1YsVOdhElvkCgvDLe4usOkxHy
- TLSH T11FC48D29B6D0C036C5B39574C4A186BAEAB17432372549CFA3D5475A0F337E2BA7930E
- MD5 SHA1 SHA512 SSDEEP TLSH