Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
01/10/2026, 19:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e77ec25bcb3205c0b10ad90668c718e4da2d897a103868e1860045ac969ae268.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
e77ec25bcb3205c0b10ad90668c718e4da2d897a103868e1860045ac969ae268.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target e77ec25bcb3205c0b10ad90668c718e4da2d897a103868e1860045ac969ae268.exe
- Size 1.7MB
- Sample261001-ydtebs1zhy
- SHA256 e77ec25bcb3205c0b10ad90668c718e4da2d897a103868e1860045ac969ae268
- MD5 afdbaff5963c191144aa922200c8fd63
- SHA1 54067a9eff5f88e02ddc58297a59ac6e3c6397ab
- SHA512 ea158a12e1ed01cbb88bba560afab5cb6e38d5d08efa15a0a20353d8a651d9e604da195572935ba96b5ec6bc7656d8401b09136979bdbc29d8fc14862e080653
- SSDEEP 24576:XvO2xJKRI2FOkx2LFEWcUQPxuZ98Es8k3OH3C0rQ6+8pKJJFo3Q+qdCOKIbAI:XHHKO29Qr5QZuTtS0rQMYOQ+q8CEI
- TLSH T100858E21B351C036D4AB05758ABA47AE9578BC310B2551C7B3C47B7E6FB22D2AE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1476 a1371501 - Unexpected DNS network traffic destination 24 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 340 114.114.114.114 4432 e77ec25bcb3205c0b10ad90668c718e4da2d897a103868e1860045ac969ae268.exe Destination IP 400 114.114.114.114 4432 e77ec25bcb3205c0b10ad90668c718e4da2d897a103868e1860045ac969ae268.exe Destination IP 407 223.5.5.5 4432 e77ec25bcb3205c0b10ad90668c718e4da2d897a103868e1860045ac969ae268.exe Destination IP 437 114.114.114.114 4432 e77ec25bcb3205c0b10ad90668c718e4da2d897a103868e1860045ac969ae268.exe Destination IP 4 223.5.5.5 4432 e77ec25bcb3205c0b10ad90668c718e4da2d897a103868e1860045ac969ae268.exe Destination IP 68 223.5.5.5 4432 e77ec25bcb3205c0b10ad90668c718e4da2d897a103868e1860045ac969ae268.exe Destination IP 134 223.5.5.5 4432 e77ec25bcb3205c0b10ad90668c718e4da2d897a103868e1860045ac969ae268.exe Destination IP 206 223.5.5.5 4432 e77ec25bcb3205c0b10ad90668c718e4da2d897a103868e1860045ac969ae268.exe Destination IP 242 114.114.114.114 4432 e77ec25bcb3205c0b10ad90668c718e4da2d897a103868e1860045ac969ae268.exe Destination IP 343 223.5.5.5 4432 e77ec25bcb3205c0b10ad90668c718e4da2d897a103868e1860045ac969ae268.exe Destination IP 438 223.5.5.5 4432 e77ec25bcb3205c0b10ad90668c718e4da2d897a103868e1860045ac969ae268.exe Destination IP 499 223.5.5.5 4432 e77ec25bcb3205c0b10ad90668c718e4da2d897a103868e1860045ac969ae268.exe Destination IP 67 114.114.114.114 4432 e77ec25bcb3205c0b10ad90668c718e4da2d897a103868e1860045ac969ae268.exe Destination IP 205 114.114.114.114 4432 e77ec25bcb3205c0b10ad90668c718e4da2d897a103868e1860045ac969ae268.exe Destination IP 401 223.5.5.5 4432 e77ec25bcb3205c0b10ad90668c718e4da2d897a103868e1860045ac969ae268.exe Destination IP 498 114.114.114.114 4432 e77ec25bcb3205c0b10ad90668c718e4da2d897a103868e1860045ac969ae268.exe Destination IP 559 223.5.5.5 4432 e77ec25bcb3205c0b10ad90668c718e4da2d897a103868e1860045ac969ae268.exe Destination IP 304 223.5.5.5 4432 e77ec25bcb3205c0b10ad90668c718e4da2d897a103868e1860045ac969ae268.exe Destination IP 406 114.114.114.114 4432 e77ec25bcb3205c0b10ad90668c718e4da2d897a103868e1860045ac969ae268.exe Destination IP 558 114.114.114.114 4432 e77ec25bcb3205c0b10ad90668c718e4da2d897a103868e1860045ac969ae268.exe Destination IP 3 114.114.114.114 4432 e77ec25bcb3205c0b10ad90668c718e4da2d897a103868e1860045ac969ae268.exe Destination IP 133 114.114.114.114 1476 a1371501 Destination IP 243 223.5.5.5 4432 e77ec25bcb3205c0b10ad90668c718e4da2d897a103868e1860045ac969ae268.exe Destination IP 303 114.114.114.114 4432 e77ec25bcb3205c0b10ad90668c718e4da2d897a103868e1860045ac969ae268.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache a1371501 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content a1371501 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies a1371501 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft a1371501 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 a1371501 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 a1371501 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData a1371501 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 a1371501 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 a1371501 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 a1371501 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE a1371501 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 a1371501 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 a1371501 File created C:\Windows\SysWOW64\a1371501 e77ec25bcb3205c0b10ad90668c718e4da2d897a103868e1860045ac969ae268.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 a1371501 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\194508 a1371501 File opened for modification C:\Windows\4be0a0 e77ec25bcb3205c0b10ad90668c718e4da2d897a103868e1860045ac969ae268.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain e77ec25bcb3205c0b10ad90668c718e4da2d897a103868e1860045ac969ae268.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname a1371501 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain a1371501 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname e77ec25bcb3205c0b10ad90668c718e4da2d897a103868e1860045ac969ae268.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e77ec25bcb3205c0b10ad90668c718e4da2d897a103868e1860045ac969ae268.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a1371501 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" a1371501 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" a1371501 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" a1371501 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" a1371501 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing a1371501 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix a1371501 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" a1371501 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ a1371501 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" a1371501 - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 1476 a1371501 1476 a1371501 1476 a1371501 1476 a1371501 1476 a1371501 1476 a1371501 1476 a1371501 1476 a1371501 4432 e77ec25bcb3205c0b10ad90668c718e4da2d897a103868e1860045ac969ae268.exe 4432 e77ec25bcb3205c0b10ad90668c718e4da2d897a103868e1860045ac969ae268.exe 4432 e77ec25bcb3205c0b10ad90668c718e4da2d897a103868e1860045ac969ae268.exe 4432 e77ec25bcb3205c0b10ad90668c718e4da2d897a103868e1860045ac969ae268.exe 4432 e77ec25bcb3205c0b10ad90668c718e4da2d897a103868e1860045ac969ae268.exe 4432 e77ec25bcb3205c0b10ad90668c718e4da2d897a103868e1860045ac969ae268.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4432 e77ec25bcb3205c0b10ad90668c718e4da2d897a103868e1860045ac969ae268.exe Token: SeTcbPrivilege 4432 e77ec25bcb3205c0b10ad90668c718e4da2d897a103868e1860045ac969ae268.exe Token: SeDebugPrivilege 1476 a1371501 Token: SeTcbPrivilege 1476 a1371501
Processes
-
C:\Users\Admin\AppData\Local\Temp\e77ec25bcb3205c0b10ad90668c718e4da2d897a103868e1860045ac969ae268.exe"C:\Users\Admin\AppData\Local\Temp\e77ec25bcb3205c0b10ad90668c718e4da2d897a103868e1860045ac969ae268.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4432
-
C:\Windows\Syswow64\a1371501C:\Windows\Syswow64\a13715011⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1476
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\a1371501
- Size 1.7MB
- SHA256 7780e519854122e1d1adc755a6fbb26f02503cd518f315ff4e1a3a3f596b97eb
- MD5 08b61b1978d8ecc38891f6c2684641b0
- SHA1 973d47ccb6252e73b6652cb51cefa255d1069a28
- SHA512 e74235b87166ad400a5df919cf988906ea5dc15eae3afa05feccbfb226f3662331dbde5ef3e30d422a1b515b2243741abb971944b1ef5566c3ab20610c5be597
- SSDEEP 24576:evO2xJKRI2FOkx2LFEWcUQPxuZ98Es8k3OH3C0rQ6+8pKJJFo3Q+qdCOKIbAI:eHHKO29Qr5QZuTtS0rQMYOQ+q8CEI
- TLSH T1AF858E21B351C036D4AB05758ABA47AE9578BC310B2551C7B3C47B7E6FB22D2AE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH