Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/10/2026, 21:48
Behavioral task
behavioral1
Sample
9ba02ce4677ff1bb9a3b122e5bfedca035e84ac73442fdf67b86c6a303aa6ca8.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 9ba02ce4677ff1bb9a3b122e5bfedca035e84ac73442fdf67b86c6a303aa6ca8.exe
- Size 1.2MB
- Sample261011-1nt5qahe67
- SHA256 9ba02ce4677ff1bb9a3b122e5bfedca035e84ac73442fdf67b86c6a303aa6ca8
- MD5 83775a14db9c700eb753f6e043662610
- SHA1 3c69fa175f02a52f0fc459959d4d7a1d6ba2ad8f
- SHA512 e016fe3a6b1688ffffe5a87c9f5d4e53ee4b6082d42f01c6a2f0c400e38c648ba796f1df9df93fe45360553574741b4c8ccc54ff52d60383ceb7e5e504f5d73a
- SSDEEP 24576:CvO2xJKRw2kOkx2LFRvcUQPxuZ98Es8k3OH3C0rQS:CHHKe2WQX5QZuTtS0rQS
- TLSH T176458C31E641C036D4A70175C6BA4BBFA9787D25032565C7E3D43E6A2FB22D2BA3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1072 91ad7282 - Unexpected DNS network traffic destination 14 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 208 223.5.5.5 5736 9ba02ce4677ff1bb9a3b122e5bfedca035e84ac73442fdf67b86c6a303aa6ca8.exe Destination IP 263 114.114.114.114 5736 9ba02ce4677ff1bb9a3b122e5bfedca035e84ac73442fdf67b86c6a303aa6ca8.exe Destination IP 264 223.5.5.5 5736 9ba02ce4677ff1bb9a3b122e5bfedca035e84ac73442fdf67b86c6a303aa6ca8.exe Destination IP 1 114.114.114.114 5736 9ba02ce4677ff1bb9a3b122e5bfedca035e84ac73442fdf67b86c6a303aa6ca8.exe Destination IP 4 223.5.5.5 5736 9ba02ce4677ff1bb9a3b122e5bfedca035e84ac73442fdf67b86c6a303aa6ca8.exe Destination IP 41 114.114.114.114 5736 9ba02ce4677ff1bb9a3b122e5bfedca035e84ac73442fdf67b86c6a303aa6ca8.exe Destination IP 42 223.5.5.5 5736 9ba02ce4677ff1bb9a3b122e5bfedca035e84ac73442fdf67b86c6a303aa6ca8.exe Destination IP 70 114.114.114.114 5736 9ba02ce4677ff1bb9a3b122e5bfedca035e84ac73442fdf67b86c6a303aa6ca8.exe Destination IP 71 223.5.5.5 5736 9ba02ce4677ff1bb9a3b122e5bfedca035e84ac73442fdf67b86c6a303aa6ca8.exe Destination IP 125 114.114.114.114 1072 91ad7282 Destination IP 128 114.114.114.114 5736 9ba02ce4677ff1bb9a3b122e5bfedca035e84ac73442fdf67b86c6a303aa6ca8.exe Destination IP 129 223.5.5.5 5736 9ba02ce4677ff1bb9a3b122e5bfedca035e84ac73442fdf67b86c6a303aa6ca8.exe Destination IP 133 223.5.5.5 5736 9ba02ce4677ff1bb9a3b122e5bfedca035e84ac73442fdf67b86c6a303aa6ca8.exe Destination IP 207 114.114.114.114 5736 9ba02ce4677ff1bb9a3b122e5bfedca035e84ac73442fdf67b86c6a303aa6ca8.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 91ad7282 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 91ad7282 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 91ad7282 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 91ad7282 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 91ad7282 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 91ad7282 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 91ad7282 File created C:\Windows\SysWOW64\91ad7282 9ba02ce4677ff1bb9a3b122e5bfedca035e84ac73442fdf67b86c6a303aa6ca8.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 91ad7282 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 91ad7282 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 91ad7282 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 91ad7282 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 91ad7282 -
resource yara_rule behavioral2/memory/5736-0-0x0000000000F90000-0x000000000101C000-memory.dmp upx behavioral2/files/0x000900000001b2ca-2.dat upx behavioral2/memory/1072-4-0x00000000004B0000-0x000000000053C000-memory.dmp upx behavioral2/memory/5736-23-0x0000000000F90000-0x000000000101C000-memory.dmp upx behavioral2/memory/1072-24-0x00000000004B0000-0x000000000053C000-memory.dmp upx behavioral2/memory/1072-49-0x00000000004B0000-0x000000000053C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\125a60 91ad7282 File opened for modification C:\Windows\6233d0 9ba02ce4677ff1bb9a3b122e5bfedca035e84ac73442fdf67b86c6a303aa6ca8.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 91ad7282 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 91ad7282 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 9ba02ce4677ff1bb9a3b122e5bfedca035e84ac73442fdf67b86c6a303aa6ca8.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 9ba02ce4677ff1bb9a3b122e5bfedca035e84ac73442fdf67b86c6a303aa6ca8.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ba02ce4677ff1bb9a3b122e5bfedca035e84ac73442fdf67b86c6a303aa6ca8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91ad7282 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 91ad7282 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 91ad7282 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 91ad7282 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 91ad7282 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 91ad7282 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 91ad7282 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 91ad7282 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 91ad7282 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 91ad7282 - Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 1072 91ad7282 1072 91ad7282 1072 91ad7282 1072 91ad7282 1072 91ad7282 1072 91ad7282 1072 91ad7282 1072 91ad7282 1072 91ad7282 1072 91ad7282 1072 91ad7282 1072 91ad7282 1072 91ad7282 1072 91ad7282 1072 91ad7282 1072 91ad7282 1072 91ad7282 1072 91ad7282 1072 91ad7282 1072 91ad7282 5736 9ba02ce4677ff1bb9a3b122e5bfedca035e84ac73442fdf67b86c6a303aa6ca8.exe 5736 9ba02ce4677ff1bb9a3b122e5bfedca035e84ac73442fdf67b86c6a303aa6ca8.exe 5736 9ba02ce4677ff1bb9a3b122e5bfedca035e84ac73442fdf67b86c6a303aa6ca8.exe 5736 9ba02ce4677ff1bb9a3b122e5bfedca035e84ac73442fdf67b86c6a303aa6ca8.exe 5736 9ba02ce4677ff1bb9a3b122e5bfedca035e84ac73442fdf67b86c6a303aa6ca8.exe 5736 9ba02ce4677ff1bb9a3b122e5bfedca035e84ac73442fdf67b86c6a303aa6ca8.exe 5736 9ba02ce4677ff1bb9a3b122e5bfedca035e84ac73442fdf67b86c6a303aa6ca8.exe 5736 9ba02ce4677ff1bb9a3b122e5bfedca035e84ac73442fdf67b86c6a303aa6ca8.exe 5736 9ba02ce4677ff1bb9a3b122e5bfedca035e84ac73442fdf67b86c6a303aa6ca8.exe 5736 9ba02ce4677ff1bb9a3b122e5bfedca035e84ac73442fdf67b86c6a303aa6ca8.exe 5736 9ba02ce4677ff1bb9a3b122e5bfedca035e84ac73442fdf67b86c6a303aa6ca8.exe 5736 9ba02ce4677ff1bb9a3b122e5bfedca035e84ac73442fdf67b86c6a303aa6ca8.exe 5736 9ba02ce4677ff1bb9a3b122e5bfedca035e84ac73442fdf67b86c6a303aa6ca8.exe 5736 9ba02ce4677ff1bb9a3b122e5bfedca035e84ac73442fdf67b86c6a303aa6ca8.exe 5736 9ba02ce4677ff1bb9a3b122e5bfedca035e84ac73442fdf67b86c6a303aa6ca8.exe 5736 9ba02ce4677ff1bb9a3b122e5bfedca035e84ac73442fdf67b86c6a303aa6ca8.exe 5736 9ba02ce4677ff1bb9a3b122e5bfedca035e84ac73442fdf67b86c6a303aa6ca8.exe 5736 9ba02ce4677ff1bb9a3b122e5bfedca035e84ac73442fdf67b86c6a303aa6ca8.exe 5736 9ba02ce4677ff1bb9a3b122e5bfedca035e84ac73442fdf67b86c6a303aa6ca8.exe 5736 9ba02ce4677ff1bb9a3b122e5bfedca035e84ac73442fdf67b86c6a303aa6ca8.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 5736 9ba02ce4677ff1bb9a3b122e5bfedca035e84ac73442fdf67b86c6a303aa6ca8.exe Token: SeTcbPrivilege 5736 9ba02ce4677ff1bb9a3b122e5bfedca035e84ac73442fdf67b86c6a303aa6ca8.exe Token: SeDebugPrivilege 1072 91ad7282 Token: SeTcbPrivilege 1072 91ad7282
Processes
-
C:\Users\Admin\AppData\Local\Temp\9ba02ce4677ff1bb9a3b122e5bfedca035e84ac73442fdf67b86c6a303aa6ca8.exe"C:\Users\Admin\AppData\Local\Temp\9ba02ce4677ff1bb9a3b122e5bfedca035e84ac73442fdf67b86c6a303aa6ca8.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5736
-
C:\Windows\Syswow64\91ad7282C:\Windows\Syswow64\91ad72821⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1072
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\125a60
- Size 916B
- SHA256 b11736c87b85a8eb72961ccfe8ffe0186c6ada3e4943d1304ebe3d8481f52641
- MD5 453cb49644e67e2d7cb9b206acb172c7
- SHA1 5ba509fefd1feb145e9943955209035c50273c52
- SHA512 b452fa99b1f051a97e2bc0758e9549efcfbf5937cc5be5423e2f8c6827d109b170ef304fbf70a2088aeb16e81a9974c34b1934fead2ee6ba6f8018bb53d8f73f
- TLSH T1DE1136F21468CAF69F91C26139E36DE8FF7474ABC4CD5027C882704956233EDC8A94C2
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\6233d0
- Size 976B
- SHA256 cd606b1e8301762cf9e20165b7f44e9f67a7fbf9302926dfc8e9263fd714f6d5
- MD5 5732de2d0d4d7f48fc8fca59e2967c1d
- SHA1 45a09c614b6cfaddcacbc4e1128c893d5c8c59d3
- SHA512 42eb0c1d6c260bad58312aa5bf419bd591914d0c931f2c793b6e8f4c7bd7dbb42d5ed6c56ad8600f427a526c5a4193ae8fc7d863c981d4baa9a748084f95ca91
- TLSH T16B11AFF0C25EC6F178764A6636F2AEC593732CC2C4DD51F72D43AAA005453A8C9DF046
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\6233d0
- Size 1KB
- SHA256 3a194d940fe6f060d90701aaab7e348c1a554f1cadff5fecf8634b44a81c203f
- MD5 de9ab0f7f175ded371ab48548ea9b820
- SHA1 05e0b25d154abaafb3cc1ac40882e3f20dc804d6
- SHA512 489824f2c28c0d0909b6e7365544c762f98209ce6afc2bec1980b9e4b07f36323045febecc4959be34121fd3097da132d661595e4b4e3c09b5d81bba55f59edb
- TLSH T1FF219DB1D19EC6F178B14A6636F2AEC593722CC2C4DD51F71C43AAA0155A3A8C9DF047
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\91ad7282
- Size 1.2MB
- SHA256 2c3f648643c2b10e6f76379c8f5f07295749a70803eba88ec27f1e070a19ab66
- MD5 f60adf25c98b4bc4d454bdc732e49260
- SHA1 9c82e3d7e27ae6408eedeaed8e01982c89cddf66
- SHA512 b6b93af696979ec53fbb03147f681ecf8a065101c7c607b96335ffbb745cb0500f5d436995e07afce3f85c536e6e99d55556f5f3cae33073676e35c7cc63c849
- SSDEEP 24576:fvO2xJKRw2kOkx2LFRvcUQPxuZ98Es8k3OH3C0rQS:fHHKe2WQX5QZuTtS0rQS
- TLSH T164458C31E641C036D4A70175C6BA4BBFA9787D25032565C7E3D43E6A2FB22D2BA3170E
- MD5 SHA1 SHA512 SSDEEP TLSH