Analysis
- max time kernel
150s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/10/2026, 19:34
Behavioral task
behavioral1
Sample
12ae81c4dd964acc0f4179bea13026235c31ece812fafb9ec1c5eb87f43082c2.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 12ae81c4dd964acc0f4179bea13026235c31ece812fafb9ec1c5eb87f43082c2.exe
- Size 1.2MB
- Sample261006-x96tvsty2j
- SHA256 12ae81c4dd964acc0f4179bea13026235c31ece812fafb9ec1c5eb87f43082c2
- MD5 0e9a391d698a28f612f38f1c2fabd286
- SHA1 b6608b3a9525fe155d72720fb384a2c37a046785
- SHA512 94b9740ed550d470e47e7471a7004fc9539256eee39b15ae96901795ac12af4607a8650822536a69429cf2620e2e3112006013a1d9de89227121d8ba2592a7b4
- SSDEEP 24576:AvO2xJKRw2kOkx2LFRvhuZ98Es8k3OH3C0rQ6+y:AHHKe2WQXhuTtS0rQi
- TLSH T111559E31E641C036D4A70176C6B94BBFA578BD22072555CBE3D43A6A2F723D2AE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5904 691c0a90 - Unexpected DNS network traffic destination 24 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 280 114.114.114.114 4108 12ae81c4dd964acc0f4179bea13026235c31ece812fafb9ec1c5eb87f43082c2.exe Destination IP 336 114.114.114.114 4108 12ae81c4dd964acc0f4179bea13026235c31ece812fafb9ec1c5eb87f43082c2.exe Destination IP 368 114.114.114.114 4108 12ae81c4dd964acc0f4179bea13026235c31ece812fafb9ec1c5eb87f43082c2.exe Destination IP 369 223.5.5.5 4108 12ae81c4dd964acc0f4179bea13026235c31ece812fafb9ec1c5eb87f43082c2.exe Destination IP 476 114.114.114.114 4108 12ae81c4dd964acc0f4179bea13026235c31ece812fafb9ec1c5eb87f43082c2.exe Destination IP 95 223.5.5.5 4108 12ae81c4dd964acc0f4179bea13026235c31ece812fafb9ec1c5eb87f43082c2.exe Destination IP 149 114.114.114.114 4108 12ae81c4dd964acc0f4179bea13026235c31ece812fafb9ec1c5eb87f43082c2.exe Destination IP 182 223.5.5.5 4108 12ae81c4dd964acc0f4179bea13026235c31ece812fafb9ec1c5eb87f43082c2.exe Destination IP 235 114.114.114.114 4108 12ae81c4dd964acc0f4179bea13026235c31ece812fafb9ec1c5eb87f43082c2.exe Destination IP 319 114.114.114.114 4108 12ae81c4dd964acc0f4179bea13026235c31ece812fafb9ec1c5eb87f43082c2.exe Destination IP 4 223.5.5.5 4108 12ae81c4dd964acc0f4179bea13026235c31ece812fafb9ec1c5eb87f43082c2.exe Destination IP 40 114.114.114.114 4108 12ae81c4dd964acc0f4179bea13026235c31ece812fafb9ec1c5eb87f43082c2.exe Destination IP 94 114.114.114.114 5904 691c0a90 Destination IP 150 223.5.5.5 4108 12ae81c4dd964acc0f4179bea13026235c31ece812fafb9ec1c5eb87f43082c2.exe Destination IP 181 114.114.114.114 4108 12ae81c4dd964acc0f4179bea13026235c31ece812fafb9ec1c5eb87f43082c2.exe Destination IP 236 223.5.5.5 4108 12ae81c4dd964acc0f4179bea13026235c31ece812fafb9ec1c5eb87f43082c2.exe Destination IP 422 114.114.114.114 4108 12ae81c4dd964acc0f4179bea13026235c31ece812fafb9ec1c5eb87f43082c2.exe Destination IP 423 223.5.5.5 4108 12ae81c4dd964acc0f4179bea13026235c31ece812fafb9ec1c5eb87f43082c2.exe Destination IP 1 114.114.114.114 4108 12ae81c4dd964acc0f4179bea13026235c31ece812fafb9ec1c5eb87f43082c2.exe Destination IP 282 223.5.5.5 4108 12ae81c4dd964acc0f4179bea13026235c31ece812fafb9ec1c5eb87f43082c2.exe Destination IP 320 223.5.5.5 4108 12ae81c4dd964acc0f4179bea13026235c31ece812fafb9ec1c5eb87f43082c2.exe Destination IP 337 223.5.5.5 4108 12ae81c4dd964acc0f4179bea13026235c31ece812fafb9ec1c5eb87f43082c2.exe Destination IP 477 223.5.5.5 4108 12ae81c4dd964acc0f4179bea13026235c31ece812fafb9ec1c5eb87f43082c2.exe Destination IP 41 223.5.5.5 4108 12ae81c4dd964acc0f4179bea13026235c31ece812fafb9ec1c5eb87f43082c2.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 691c0a90 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 691c0a90 File created C:\Windows\SysWOW64\691c0a90 12ae81c4dd964acc0f4179bea13026235c31ece812fafb9ec1c5eb87f43082c2.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 691c0a90 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 691c0a90 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 691c0a90 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 691c0a90 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 691c0a90 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 691c0a90 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 691c0a90 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 691c0a90 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 691c0a90 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 691c0a90 -
resource yara_rule behavioral2/memory/4108-0-0x00000000009B0000-0x0000000000A3C000-memory.dmp upx behavioral2/files/0x000700000001b867-2.dat upx behavioral2/memory/5904-4-0x0000000000300000-0x000000000038C000-memory.dmp upx behavioral2/memory/4108-18-0x00000000009B0000-0x0000000000A3C000-memory.dmp upx behavioral2/memory/5904-19-0x0000000000300000-0x000000000038C000-memory.dmp upx behavioral2/memory/5904-44-0x0000000000300000-0x000000000038C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\651420 691c0a90 File opened for modification C:\Windows\465498 12ae81c4dd964acc0f4179bea13026235c31ece812fafb9ec1c5eb87f43082c2.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 691c0a90 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 691c0a90 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 12ae81c4dd964acc0f4179bea13026235c31ece812fafb9ec1c5eb87f43082c2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 12ae81c4dd964acc0f4179bea13026235c31ece812fafb9ec1c5eb87f43082c2.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12ae81c4dd964acc0f4179bea13026235c31ece812fafb9ec1c5eb87f43082c2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 691c0a90 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 691c0a90 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 691c0a90 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 691c0a90 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 691c0a90 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 691c0a90 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 691c0a90 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 691c0a90 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 691c0a90 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 691c0a90 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 5904 691c0a90 5904 691c0a90 5904 691c0a90 5904 691c0a90 5904 691c0a90 5904 691c0a90 5904 691c0a90 5904 691c0a90 4108 12ae81c4dd964acc0f4179bea13026235c31ece812fafb9ec1c5eb87f43082c2.exe 4108 12ae81c4dd964acc0f4179bea13026235c31ece812fafb9ec1c5eb87f43082c2.exe 4108 12ae81c4dd964acc0f4179bea13026235c31ece812fafb9ec1c5eb87f43082c2.exe 4108 12ae81c4dd964acc0f4179bea13026235c31ece812fafb9ec1c5eb87f43082c2.exe 4108 12ae81c4dd964acc0f4179bea13026235c31ece812fafb9ec1c5eb87f43082c2.exe 4108 12ae81c4dd964acc0f4179bea13026235c31ece812fafb9ec1c5eb87f43082c2.exe 4108 12ae81c4dd964acc0f4179bea13026235c31ece812fafb9ec1c5eb87f43082c2.exe 4108 12ae81c4dd964acc0f4179bea13026235c31ece812fafb9ec1c5eb87f43082c2.exe 4108 12ae81c4dd964acc0f4179bea13026235c31ece812fafb9ec1c5eb87f43082c2.exe 4108 12ae81c4dd964acc0f4179bea13026235c31ece812fafb9ec1c5eb87f43082c2.exe 4108 12ae81c4dd964acc0f4179bea13026235c31ece812fafb9ec1c5eb87f43082c2.exe 4108 12ae81c4dd964acc0f4179bea13026235c31ece812fafb9ec1c5eb87f43082c2.exe 4108 12ae81c4dd964acc0f4179bea13026235c31ece812fafb9ec1c5eb87f43082c2.exe 4108 12ae81c4dd964acc0f4179bea13026235c31ece812fafb9ec1c5eb87f43082c2.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4108 12ae81c4dd964acc0f4179bea13026235c31ece812fafb9ec1c5eb87f43082c2.exe Token: SeTcbPrivilege 4108 12ae81c4dd964acc0f4179bea13026235c31ece812fafb9ec1c5eb87f43082c2.exe Token: SeDebugPrivilege 5904 691c0a90 Token: SeTcbPrivilege 5904 691c0a90
Processes
-
C:\Users\Admin\AppData\Local\Temp\12ae81c4dd964acc0f4179bea13026235c31ece812fafb9ec1c5eb87f43082c2.exe"C:\Users\Admin\AppData\Local\Temp\12ae81c4dd964acc0f4179bea13026235c31ece812fafb9ec1c5eb87f43082c2.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4108
-
C:\Windows\Syswow64\691c0a90C:\Windows\Syswow64\691c0a901⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5904
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\691c0a90
- Size 1.2MB
- SHA256 785f7283e879af788cdca813ae48efbba62154c805ee1cec7ccbca7fd1786611
- MD5 dd89cdcd2d6118acfc8a94cb1a1ed828
- SHA1 44ee67a757e216b293126c3c0f94a8f3aeae79c9
- SHA512 dd6d864472ee951175335178bcfa962ac9f0e18575b9317f461167482a29a3a764a7790f440ca6caae058651bab0551bed569ce52bacd667f4ecf41bebf70737
- SSDEEP 24576:2vO2xJKRw2kOkx2LFRvhuZ98Es8k3OH3C0rQ6+y:2HHKe2WQXhuTtS0rQi
- TLSH T114559E31E641C036D4A70176C6B94BBFA578BD22072555CBE3D43A6A2F722D2AE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH