Analysis
- max time kernel
150s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/10/2026, 19:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
38f09eaa0c068cc6d5e2d259810cd5700442947c47df0a767788151d55c8a232.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
38f09eaa0c068cc6d5e2d259810cd5700442947c47df0a767788151d55c8a232.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 38f09eaa0c068cc6d5e2d259810cd5700442947c47df0a767788151d55c8a232.exe
- Size 1.7MB
- Sample261001-ykawkax15m
- SHA256 38f09eaa0c068cc6d5e2d259810cd5700442947c47df0a767788151d55c8a232
- MD5 f8af0e6f4c0893080cbd2a49ff6f0c65
- SHA1 0a19d29e62656da2233aa82990c93a3d629aa268
- SHA512 46233ca90ae7a38c5aaec5ac3d191f765fb2021e65a105c81602c309e38dce49e4fab715c29ec022f10e85fb21dad9b5a0b20aac5b14325529ad57a02a7d21a1
- SSDEEP 24576:/vO2xJKRI2FOkx2LFEWcUQPxuZ98Es8k3OH3C0rQ6+8pKJJFo3Q+qdCOKIbAI:/HHKO29Qr5QZuTtS0rQMYOQ+q8CEI
- TLSH T12F858E21B351C036D4AB05758ABA47AE9578BC310B2551C7B3C47B7E6FB22D2AE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4728 edfa7d43 - Unexpected DNS network traffic destination 18 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 235 114.114.114.114 1004 38f09eaa0c068cc6d5e2d259810cd5700442947c47df0a767788151d55c8a232.exe Destination IP 322 114.114.114.114 1004 38f09eaa0c068cc6d5e2d259810cd5700442947c47df0a767788151d55c8a232.exe Destination IP 1 114.114.114.114 1004 38f09eaa0c068cc6d5e2d259810cd5700442947c47df0a767788151d55c8a232.exe Destination IP 182 223.5.5.5 1004 38f09eaa0c068cc6d5e2d259810cd5700442947c47df0a767788151d55c8a232.exe Destination IP 293 223.5.5.5 1004 38f09eaa0c068cc6d5e2d259810cd5700442947c47df0a767788151d55c8a232.exe Destination IP 323 223.5.5.5 1004 38f09eaa0c068cc6d5e2d259810cd5700442947c47df0a767788151d55c8a232.exe Destination IP 376 114.114.114.114 1004 38f09eaa0c068cc6d5e2d259810cd5700442947c47df0a767788151d55c8a232.exe Destination IP 4 223.5.5.5 1004 38f09eaa0c068cc6d5e2d259810cd5700442947c47df0a767788151d55c8a232.exe Destination IP 41 223.5.5.5 1004 38f09eaa0c068cc6d5e2d259810cd5700442947c47df0a767788151d55c8a232.exe Destination IP 129 114.114.114.114 1004 38f09eaa0c068cc6d5e2d259810cd5700442947c47df0a767788151d55c8a232.exe Destination IP 181 114.114.114.114 1004 38f09eaa0c068cc6d5e2d259810cd5700442947c47df0a767788151d55c8a232.exe Destination IP 236 223.5.5.5 1004 38f09eaa0c068cc6d5e2d259810cd5700442947c47df0a767788151d55c8a232.exe Destination IP 377 223.5.5.5 1004 38f09eaa0c068cc6d5e2d259810cd5700442947c47df0a767788151d55c8a232.exe Destination IP 40 114.114.114.114 1004 38f09eaa0c068cc6d5e2d259810cd5700442947c47df0a767788151d55c8a232.exe Destination IP 95 114.114.114.114 4728 edfa7d43 Destination IP 96 223.5.5.5 1004 38f09eaa0c068cc6d5e2d259810cd5700442947c47df0a767788151d55c8a232.exe Destination IP 131 223.5.5.5 1004 38f09eaa0c068cc6d5e2d259810cd5700442947c47df0a767788151d55c8a232.exe Destination IP 292 114.114.114.114 1004 38f09eaa0c068cc6d5e2d259810cd5700442947c47df0a767788151d55c8a232.exe - Drops file in System32 directory 13 IoCs
description ioc Process File created C:\Windows\SysWOW64\edfa7d43 38f09eaa0c068cc6d5e2d259810cd5700442947c47df0a767788151d55c8a232.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 edfa7d43 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies edfa7d43 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 edfa7d43 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft edfa7d43 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData edfa7d43 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 edfa7d43 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content edfa7d43 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE edfa7d43 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache edfa7d43 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 edfa7d43 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 edfa7d43 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 edfa7d43 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\50f1f0 edfa7d43 File opened for modification C:\Windows\113058 38f09eaa0c068cc6d5e2d259810cd5700442947c47df0a767788151d55c8a232.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname edfa7d43 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain edfa7d43 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 38f09eaa0c068cc6d5e2d259810cd5700442947c47df0a767788151d55c8a232.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 38f09eaa0c068cc6d5e2d259810cd5700442947c47df0a767788151d55c8a232.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38f09eaa0c068cc6d5e2d259810cd5700442947c47df0a767788151d55c8a232.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language edfa7d43 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix edfa7d43 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" edfa7d43 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" edfa7d43 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ edfa7d43 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" edfa7d43 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" edfa7d43 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" edfa7d43 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" edfa7d43 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing edfa7d43 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 4728 edfa7d43 4728 edfa7d43 4728 edfa7d43 4728 edfa7d43 4728 edfa7d43 4728 edfa7d43 4728 edfa7d43 4728 edfa7d43 1004 38f09eaa0c068cc6d5e2d259810cd5700442947c47df0a767788151d55c8a232.exe 1004 38f09eaa0c068cc6d5e2d259810cd5700442947c47df0a767788151d55c8a232.exe 1004 38f09eaa0c068cc6d5e2d259810cd5700442947c47df0a767788151d55c8a232.exe 1004 38f09eaa0c068cc6d5e2d259810cd5700442947c47df0a767788151d55c8a232.exe 1004 38f09eaa0c068cc6d5e2d259810cd5700442947c47df0a767788151d55c8a232.exe 1004 38f09eaa0c068cc6d5e2d259810cd5700442947c47df0a767788151d55c8a232.exe 1004 38f09eaa0c068cc6d5e2d259810cd5700442947c47df0a767788151d55c8a232.exe 1004 38f09eaa0c068cc6d5e2d259810cd5700442947c47df0a767788151d55c8a232.exe 1004 38f09eaa0c068cc6d5e2d259810cd5700442947c47df0a767788151d55c8a232.exe 1004 38f09eaa0c068cc6d5e2d259810cd5700442947c47df0a767788151d55c8a232.exe 1004 38f09eaa0c068cc6d5e2d259810cd5700442947c47df0a767788151d55c8a232.exe 1004 38f09eaa0c068cc6d5e2d259810cd5700442947c47df0a767788151d55c8a232.exe 1004 38f09eaa0c068cc6d5e2d259810cd5700442947c47df0a767788151d55c8a232.exe 1004 38f09eaa0c068cc6d5e2d259810cd5700442947c47df0a767788151d55c8a232.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1004 38f09eaa0c068cc6d5e2d259810cd5700442947c47df0a767788151d55c8a232.exe Token: SeTcbPrivilege 1004 38f09eaa0c068cc6d5e2d259810cd5700442947c47df0a767788151d55c8a232.exe Token: SeDebugPrivilege 4728 edfa7d43 Token: SeTcbPrivilege 4728 edfa7d43
Processes
-
C:\Users\Admin\AppData\Local\Temp\38f09eaa0c068cc6d5e2d259810cd5700442947c47df0a767788151d55c8a232.exe"C:\Users\Admin\AppData\Local\Temp\38f09eaa0c068cc6d5e2d259810cd5700442947c47df0a767788151d55c8a232.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1004
-
C:\Windows\Syswow64\edfa7d43C:\Windows\Syswow64\edfa7d431⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4728
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\113058
- Size 780B
- SHA256 432204392cabc573cff46e9e2a92e51ab0f181a591e79402cddfda7b18add331
- MD5 fabbfc279b5657b2115262e978e25ef9
- SHA1 7397028d3aae1554174143406e97fd5a3a53f809
- SHA512 4775ee89a9ebec6f5ef4fa5423de042d7c8231687d41709b13198e484b4152ed292f8f60a06c2da42cfc4754768f4b20ab54c30410af8ac1f5e36cbb16db1fa5
- TLSH T1AE01D51AC73B8EE63BB5173377D1CE410799A451E03472989D553DB0514BF559E1F007
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\edfa7d43
- Size 1.7MB
- SHA256 83d929234486af1c8b334f301afc0d2637093b0b68f24d6bef40f2075271dee5
- MD5 36b532efd468551efdae9bd61eedea94
- SHA1 21374b3c15a8cd657483856fe387c471d023c719
- SHA512 f6985ae01f2233c9f3d1d83b7e4e9eaaf7696c2d93a6d8e9b206ac06554d312a86e6ca6196e8f2e175ba2b1d468aa817b56d3d0ec1ad53297b74a2026a4b9e82
- SSDEEP 24576:4vO2xJKRI2FOkx2LFEWcUQPxuZ98Es8k3OH3C0rQ6+8pKJJFo3Q+qdCOKIbAI:4HHKO29Qr5QZuTtS0rQMYOQ+q8CEI
- TLSH T156858E21B351C036D4AB05758ABA47AE9578BC310B2551C7B3C47B7E6FB22D2AE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH