Analysis
- max time kernel
150s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 10:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
55cf65c38692f2c52b87b68b57b2151ef429e5ef08a58c8e60993ba6051f97e9.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
55cf65c38692f2c52b87b68b57b2151ef429e5ef08a58c8e60993ba6051f97e9.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 55cf65c38692f2c52b87b68b57b2151ef429e5ef08a58c8e60993ba6051f97e9.exe
- Size 374KB
- Sample261002-md72yawend
- SHA256 55cf65c38692f2c52b87b68b57b2151ef429e5ef08a58c8e60993ba6051f97e9
- MD5 251268b4749e5d11048aa5e6c68c6b01
- SHA1 e53c55a5d9ed293e9ec6d1caa2d7f0d8ddd32647
- SHA512 934b0fba97f0c19c9f7486302828a05f47d38b83e5072d987e69b504d85e632ea5db575c9291ea135559f4bcbeedce50cb93136d3348b447b3924a91a57d39ff
- SSDEEP 6144:wcTgav1cdCTuoPbgwmOLJvKRILSFvdFDcEOkCybEaQRXr9HNdvOaxy8K:wSvO2x9mONvKRILSFnOkx2LIaxy
- TLSH T19B846D2AF6A0D076C4B79579C4A257AAFBB1742137204ACFA390475A1F237E2BD3530D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1348 1ce27d6a - Unexpected DNS network traffic destination 22 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 150 223.5.5.5 972 55cf65c38692f2c52b87b68b57b2151ef429e5ef08a58c8e60993ba6051f97e9.exe Destination IP 236 223.5.5.5 972 55cf65c38692f2c52b87b68b57b2151ef429e5ef08a58c8e60993ba6051f97e9.exe Destination IP 315 114.114.114.114 972 55cf65c38692f2c52b87b68b57b2151ef429e5ef08a58c8e60993ba6051f97e9.exe Destination IP 347 114.114.114.114 972 55cf65c38692f2c52b87b68b57b2151ef429e5ef08a58c8e60993ba6051f97e9.exe Destination IP 348 223.5.5.5 972 55cf65c38692f2c52b87b68b57b2151ef429e5ef08a58c8e60993ba6051f97e9.exe Destination IP 456 223.5.5.5 972 55cf65c38692f2c52b87b68b57b2151ef429e5ef08a58c8e60993ba6051f97e9.exe Destination IP 41 223.5.5.5 972 55cf65c38692f2c52b87b68b57b2151ef429e5ef08a58c8e60993ba6051f97e9.exe Destination IP 94 114.114.114.114 1348 1ce27d6a Destination IP 279 114.114.114.114 972 55cf65c38692f2c52b87b68b57b2151ef429e5ef08a58c8e60993ba6051f97e9.exe Destination IP 316 223.5.5.5 972 55cf65c38692f2c52b87b68b57b2151ef429e5ef08a58c8e60993ba6051f97e9.exe Destination IP 401 114.114.114.114 972 55cf65c38692f2c52b87b68b57b2151ef429e5ef08a58c8e60993ba6051f97e9.exe Destination IP 1 114.114.114.114 972 55cf65c38692f2c52b87b68b57b2151ef429e5ef08a58c8e60993ba6051f97e9.exe Destination IP 40 114.114.114.114 972 55cf65c38692f2c52b87b68b57b2151ef429e5ef08a58c8e60993ba6051f97e9.exe Destination IP 95 223.5.5.5 972 55cf65c38692f2c52b87b68b57b2151ef429e5ef08a58c8e60993ba6051f97e9.exe Destination IP 235 114.114.114.114 972 55cf65c38692f2c52b87b68b57b2151ef429e5ef08a58c8e60993ba6051f97e9.exe Destination IP 281 223.5.5.5 972 55cf65c38692f2c52b87b68b57b2151ef429e5ef08a58c8e60993ba6051f97e9.exe Destination IP 402 223.5.5.5 972 55cf65c38692f2c52b87b68b57b2151ef429e5ef08a58c8e60993ba6051f97e9.exe Destination IP 455 114.114.114.114 972 55cf65c38692f2c52b87b68b57b2151ef429e5ef08a58c8e60993ba6051f97e9.exe Destination IP 3 223.5.5.5 972 55cf65c38692f2c52b87b68b57b2151ef429e5ef08a58c8e60993ba6051f97e9.exe Destination IP 181 114.114.114.114 972 55cf65c38692f2c52b87b68b57b2151ef429e5ef08a58c8e60993ba6051f97e9.exe Destination IP 182 223.5.5.5 972 55cf65c38692f2c52b87b68b57b2151ef429e5ef08a58c8e60993ba6051f97e9.exe Destination IP 149 114.114.114.114 972 55cf65c38692f2c52b87b68b57b2151ef429e5ef08a58c8e60993ba6051f97e9.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 1ce27d6a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 1ce27d6a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 1ce27d6a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 1ce27d6a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 1ce27d6a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 1ce27d6a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 1ce27d6a File created C:\Windows\SysWOW64\1ce27d6a 55cf65c38692f2c52b87b68b57b2151ef429e5ef08a58c8e60993ba6051f97e9.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 1ce27d6a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 1ce27d6a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 1ce27d6a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 1ce27d6a File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 1ce27d6a - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\171408 1ce27d6a File opened for modification C:\Windows\10a418 55cf65c38692f2c52b87b68b57b2151ef429e5ef08a58c8e60993ba6051f97e9.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 1ce27d6a Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 55cf65c38692f2c52b87b68b57b2151ef429e5ef08a58c8e60993ba6051f97e9.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 55cf65c38692f2c52b87b68b57b2151ef429e5ef08a58c8e60993ba6051f97e9.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 1ce27d6a - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 55cf65c38692f2c52b87b68b57b2151ef429e5ef08a58c8e60993ba6051f97e9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ce27d6a - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 1ce27d6a Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 1ce27d6a Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 1ce27d6a Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 1ce27d6a Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 1ce27d6a Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 1ce27d6a Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 1ce27d6a Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 1ce27d6a Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 1ce27d6a - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 1348 1ce27d6a 1348 1ce27d6a 1348 1ce27d6a 1348 1ce27d6a 1348 1ce27d6a 1348 1ce27d6a 1348 1ce27d6a 1348 1ce27d6a 972 55cf65c38692f2c52b87b68b57b2151ef429e5ef08a58c8e60993ba6051f97e9.exe 972 55cf65c38692f2c52b87b68b57b2151ef429e5ef08a58c8e60993ba6051f97e9.exe 972 55cf65c38692f2c52b87b68b57b2151ef429e5ef08a58c8e60993ba6051f97e9.exe 972 55cf65c38692f2c52b87b68b57b2151ef429e5ef08a58c8e60993ba6051f97e9.exe 972 55cf65c38692f2c52b87b68b57b2151ef429e5ef08a58c8e60993ba6051f97e9.exe 972 55cf65c38692f2c52b87b68b57b2151ef429e5ef08a58c8e60993ba6051f97e9.exe 972 55cf65c38692f2c52b87b68b57b2151ef429e5ef08a58c8e60993ba6051f97e9.exe 972 55cf65c38692f2c52b87b68b57b2151ef429e5ef08a58c8e60993ba6051f97e9.exe 972 55cf65c38692f2c52b87b68b57b2151ef429e5ef08a58c8e60993ba6051f97e9.exe 972 55cf65c38692f2c52b87b68b57b2151ef429e5ef08a58c8e60993ba6051f97e9.exe 972 55cf65c38692f2c52b87b68b57b2151ef429e5ef08a58c8e60993ba6051f97e9.exe 972 55cf65c38692f2c52b87b68b57b2151ef429e5ef08a58c8e60993ba6051f97e9.exe 972 55cf65c38692f2c52b87b68b57b2151ef429e5ef08a58c8e60993ba6051f97e9.exe 972 55cf65c38692f2c52b87b68b57b2151ef429e5ef08a58c8e60993ba6051f97e9.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 972 55cf65c38692f2c52b87b68b57b2151ef429e5ef08a58c8e60993ba6051f97e9.exe Token: SeTcbPrivilege 972 55cf65c38692f2c52b87b68b57b2151ef429e5ef08a58c8e60993ba6051f97e9.exe Token: SeDebugPrivilege 1348 1ce27d6a Token: SeTcbPrivilege 1348 1ce27d6a
Processes
-
C:\Users\Admin\AppData\Local\Temp\55cf65c38692f2c52b87b68b57b2151ef429e5ef08a58c8e60993ba6051f97e9.exe"C:\Users\Admin\AppData\Local\Temp\55cf65c38692f2c52b87b68b57b2151ef429e5ef08a58c8e60993ba6051f97e9.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:972
-
C:\Windows\Syswow64\1ce27d6aC:\Windows\Syswow64\1ce27d6a1⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1348
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\1ce27d6a
- Size 374KB
- SHA256 57e06b2d684505a54d039cc7529676d06683dc3f0a6fb5a612f7f00d107df930
- MD5 6e61c94d7de31119089ca5edc65e2387
- SHA1 2a85ecd7cba6600443f1d6e9b266ae576e06e6a3
- SHA512 0a61e8f543359c6a7da397889a7c1c93eeb8dbab89a93530c2e8c50e79555adaa6c8f9d4a3f542980947c238f98c071d61a260e7cd321fd6383adf64583dd5b7
- SSDEEP 6144:xcTgav1cdCTuoPbgwmOLJvKRILSFvdFDcEOkCybEaQRXr9HNdvOaxy8K:xSvO2x9mONvKRILSFnOkx2LIaxy
- TLSH T147846D2AF6A0D076C4B79579C4A257AAFBB1742137204ACFA390475A1F237E2BD3530D
- MD5 SHA1 SHA512 SSDEEP TLSH