Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/10/2026, 09:40
Behavioral task
behavioral1
Sample
f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe
- Size 560KB
- Sample261002-lnaczstepf
- SHA256 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5
- MD5 089c902937e5807ee85dbe11e5a63698
- SHA1 c7050ba8bc4593f7e11ce50ab4126c1f3e779063
- SHA512 566d3e4867254bc309be22f7efb5b550344ef26eb241301707272e4bd29fd6d03461ef69e253e5e5fc7f290bc429119aa24ccd36e91ce37c1fa5f089e47375de
- SSDEEP 6144:z4ZaN1cb90oOTFmIFLq0cvnXhLCqj2EFNirGcEOkCybEaQRuy8K:zrNOb9+sIF+0cvnXhLCqEsOkxHy
- TLSH T159C48D29B6E0C076C4B79578C4A186B6FAB17832372459CFA394075A1F337E2BA3570D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2644 7e871a00 - Unexpected DNS network traffic destination 20 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 66 223.5.5.5 768 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe Destination IP 131 223.5.5.5 768 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe Destination IP 201 223.5.5.5 768 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe Destination IP 302 223.5.5.5 768 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe Destination IP 348 114.114.114.114 768 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe Destination IP 3 114.114.114.114 768 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe Destination IP 65 114.114.114.114 768 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe Destination IP 199 114.114.114.114 768 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe Destination IP 239 114.114.114.114 768 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe Destination IP 301 114.114.114.114 768 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe Destination IP 351 223.5.5.5 768 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe Destination IP 130 114.114.114.114 2644 7e871a00 Destination IP 240 223.5.5.5 768 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe Destination IP 399 114.114.114.114 768 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe Destination IP 431 223.5.5.5 768 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe Destination IP 400 223.5.5.5 768 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe Destination IP 430 114.114.114.114 768 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe Destination IP 491 114.114.114.114 768 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe Destination IP 492 223.5.5.5 768 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe Destination IP 4 223.5.5.5 768 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe - Drops file in System32 directory 13 IoCs
description ioc Process File created C:\Windows\SysWOW64\7e871a00 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 7e871a00 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 7e871a00 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 7e871a00 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 7e871a00 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 7e871a00 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 7e871a00 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 7e871a00 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 7e871a00 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 7e871a00 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 7e871a00 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 7e871a00 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 7e871a00 -
resource yara_rule behavioral1/memory/768-0-0x0000000000E10000-0x0000000000E9C000-memory.dmp upx behavioral1/files/0x000500000001dbec-2.dat upx behavioral1/memory/2644-4-0x0000000000DE0000-0x0000000000E6C000-memory.dmp upx behavioral1/memory/768-18-0x0000000000E10000-0x0000000000E9C000-memory.dmp upx behavioral1/memory/2644-19-0x0000000000DE0000-0x0000000000E6C000-memory.dmp upx behavioral1/memory/2644-38-0x0000000000DE0000-0x0000000000E6C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\d2600 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe File opened for modification C:\Windows\2d4428 7e871a00 - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 7e871a00 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 7e871a00 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7e871a00 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 7e871a00 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 7e871a00 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 7e871a00 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 7e871a00 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 7e871a00 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 7e871a00 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 7e871a00 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 7e871a00 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 7e871a00 - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2644 7e871a00 2644 7e871a00 2644 7e871a00 2644 7e871a00 2644 7e871a00 2644 7e871a00 2644 7e871a00 2644 7e871a00 768 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe 768 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe 768 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe 768 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe 768 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe 768 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 768 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe Token: SeTcbPrivilege 768 f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe Token: SeDebugPrivilege 2644 7e871a00 Token: SeTcbPrivilege 2644 7e871a00
Processes
-
C:\Users\Admin\AppData\Local\Temp\f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe"C:\Users\Admin\AppData\Local\Temp\f78e265b888841da2e8632a31b5809bfd71dcecb63165bd33c0975407a1b4ce5.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:768
-
C:\Windows\Syswow64\7e871a00C:\Windows\Syswow64\7e871a001⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2644
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\7e871a00
- Size 560KB
- SHA256 a64f413e54d0d8df64f0be5663171dc80cc31973d9de9ca4c27a3d612adde2d1
- MD5 f376d0de109866f06e5a67c0d21fc4a8
- SHA1 605f7f4b0af1d4759b9450ea85dfe87156ff1812
- SHA512 5fae684f6709684c3fc899841d085e81f23df2133b5698666d1ab49b3886dc834d20b51420aa8c30226ec45679aacc6b69124bd3312b6a5d9259088bb0fadc38
- SSDEEP 6144:O4ZaN1cb90oOTFmIFLq0cvnXhLCqj2EFNirGcEOkCybEaQRuy8K:OrNOb9+sIF+0cvnXhLCqEsOkxHy
- TLSH T108C48D29B6E0C076C4B79578C4A186B6FAB17832372459CFA394075A1F337E2BA3570D
- MD5 SHA1 SHA512 SSDEEP TLSH