Analysis
- max time kernel
150s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/10/2026, 04:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4a054a2e389c3c7b876127d4c04a955ceed53201d979e18d6facb57e1bd5ff91.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
4a054a2e389c3c7b876127d4c04a955ceed53201d979e18d6facb57e1bd5ff91.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 4a054a2e389c3c7b876127d4c04a955ceed53201d979e18d6facb57e1bd5ff91.exe
- Size 615KB
- Sample261011-e647rady5k
- SHA256 4a054a2e389c3c7b876127d4c04a955ceed53201d979e18d6facb57e1bd5ff91
- MD5 af995fe633074187ed2f17558b10b197
- SHA1 b907d40db3ec06cf4817ff40a3a32d7f766b7204
- SHA512 03f46d1b59a89bf1cf48fa9ccb18cb18f7a97cda1b828523bf2f950103e3c5e9e37cd6b9e35aecdfc6571eb8ad12a0a24215b579598aef5a0a95a8fa72747aeb
- SSDEEP 12288:DSvO2x9mONvKRILSFnOkx2LIax5FAQjU/Liw:2vO2xJKRI2FOkx2LFicUV
- TLSH T159D44A31E241C03AD4A74576C6FA0BAFE5647D25531165CBA3C43A2A2FB36D2BE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5572 c43b2a28 - Unexpected DNS network traffic destination 22 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 94 223.5.5.5 6008 4a054a2e389c3c7b876127d4c04a955ceed53201d979e18d6facb57e1bd5ff91.exe Destination IP 235 223.5.5.5 6008 4a054a2e389c3c7b876127d4c04a955ceed53201d979e18d6facb57e1bd5ff91.exe Destination IP 284 223.5.5.5 6008 4a054a2e389c3c7b876127d4c04a955ceed53201d979e18d6facb57e1bd5ff91.exe Destination IP 39 114.114.114.114 6008 4a054a2e389c3c7b876127d4c04a955ceed53201d979e18d6facb57e1bd5ff91.exe Destination IP 234 114.114.114.114 6008 4a054a2e389c3c7b876127d4c04a955ceed53201d979e18d6facb57e1bd5ff91.exe Destination IP 318 114.114.114.114 6008 4a054a2e389c3c7b876127d4c04a955ceed53201d979e18d6facb57e1bd5ff91.exe Destination IP 319 223.5.5.5 6008 4a054a2e389c3c7b876127d4c04a955ceed53201d979e18d6facb57e1bd5ff91.exe Destination IP 322 114.114.114.114 6008 4a054a2e389c3c7b876127d4c04a955ceed53201d979e18d6facb57e1bd5ff91.exe Destination IP 323 223.5.5.5 6008 4a054a2e389c3c7b876127d4c04a955ceed53201d979e18d6facb57e1bd5ff91.exe Destination IP 355 223.5.5.5 6008 4a054a2e389c3c7b876127d4c04a955ceed53201d979e18d6facb57e1bd5ff91.exe Destination IP 408 114.114.114.114 6008 4a054a2e389c3c7b876127d4c04a955ceed53201d979e18d6facb57e1bd5ff91.exe Destination IP 5 223.5.5.5 6008 4a054a2e389c3c7b876127d4c04a955ceed53201d979e18d6facb57e1bd5ff91.exe Destination IP 93 114.114.114.114 5572 c43b2a28 Destination IP 148 114.114.114.114 6008 4a054a2e389c3c7b876127d4c04a955ceed53201d979e18d6facb57e1bd5ff91.exe Destination IP 181 223.5.5.5 6008 4a054a2e389c3c7b876127d4c04a955ceed53201d979e18d6facb57e1bd5ff91.exe Destination IP 354 114.114.114.114 6008 4a054a2e389c3c7b876127d4c04a955ceed53201d979e18d6facb57e1bd5ff91.exe Destination IP 409 223.5.5.5 6008 4a054a2e389c3c7b876127d4c04a955ceed53201d979e18d6facb57e1bd5ff91.exe Destination IP 149 223.5.5.5 6008 4a054a2e389c3c7b876127d4c04a955ceed53201d979e18d6facb57e1bd5ff91.exe Destination IP 180 114.114.114.114 6008 4a054a2e389c3c7b876127d4c04a955ceed53201d979e18d6facb57e1bd5ff91.exe Destination IP 281 114.114.114.114 6008 4a054a2e389c3c7b876127d4c04a955ceed53201d979e18d6facb57e1bd5ff91.exe Destination IP 3 114.114.114.114 6008 4a054a2e389c3c7b876127d4c04a955ceed53201d979e18d6facb57e1bd5ff91.exe Destination IP 40 223.5.5.5 6008 4a054a2e389c3c7b876127d4c04a955ceed53201d979e18d6facb57e1bd5ff91.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 c43b2a28 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE c43b2a28 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft c43b2a28 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData c43b2a28 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 c43b2a28 File created C:\Windows\SysWOW64\c43b2a28 4a054a2e389c3c7b876127d4c04a955ceed53201d979e18d6facb57e1bd5ff91.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies c43b2a28 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 c43b2a28 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache c43b2a28 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 c43b2a28 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content c43b2a28 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 c43b2a28 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 c43b2a28 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\66dbf0 4a054a2e389c3c7b876127d4c04a955ceed53201d979e18d6facb57e1bd5ff91.exe File opened for modification C:\Windows\5f6508 c43b2a28 - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname c43b2a28 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain c43b2a28 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 4a054a2e389c3c7b876127d4c04a955ceed53201d979e18d6facb57e1bd5ff91.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 4a054a2e389c3c7b876127d4c04a955ceed53201d979e18d6facb57e1bd5ff91.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4a054a2e389c3c7b876127d4c04a955ceed53201d979e18d6facb57e1bd5ff91.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c43b2a28 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix c43b2a28 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" c43b2a28 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" c43b2a28 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" c43b2a28 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" c43b2a28 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ c43b2a28 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" c43b2a28 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" c43b2a28 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing c43b2a28 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 5572 c43b2a28 5572 c43b2a28 5572 c43b2a28 5572 c43b2a28 5572 c43b2a28 5572 c43b2a28 5572 c43b2a28 5572 c43b2a28 6008 4a054a2e389c3c7b876127d4c04a955ceed53201d979e18d6facb57e1bd5ff91.exe 6008 4a054a2e389c3c7b876127d4c04a955ceed53201d979e18d6facb57e1bd5ff91.exe 6008 4a054a2e389c3c7b876127d4c04a955ceed53201d979e18d6facb57e1bd5ff91.exe 6008 4a054a2e389c3c7b876127d4c04a955ceed53201d979e18d6facb57e1bd5ff91.exe 6008 4a054a2e389c3c7b876127d4c04a955ceed53201d979e18d6facb57e1bd5ff91.exe 6008 4a054a2e389c3c7b876127d4c04a955ceed53201d979e18d6facb57e1bd5ff91.exe 6008 4a054a2e389c3c7b876127d4c04a955ceed53201d979e18d6facb57e1bd5ff91.exe 6008 4a054a2e389c3c7b876127d4c04a955ceed53201d979e18d6facb57e1bd5ff91.exe 6008 4a054a2e389c3c7b876127d4c04a955ceed53201d979e18d6facb57e1bd5ff91.exe 6008 4a054a2e389c3c7b876127d4c04a955ceed53201d979e18d6facb57e1bd5ff91.exe 6008 4a054a2e389c3c7b876127d4c04a955ceed53201d979e18d6facb57e1bd5ff91.exe 6008 4a054a2e389c3c7b876127d4c04a955ceed53201d979e18d6facb57e1bd5ff91.exe 6008 4a054a2e389c3c7b876127d4c04a955ceed53201d979e18d6facb57e1bd5ff91.exe 6008 4a054a2e389c3c7b876127d4c04a955ceed53201d979e18d6facb57e1bd5ff91.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 6008 4a054a2e389c3c7b876127d4c04a955ceed53201d979e18d6facb57e1bd5ff91.exe Token: SeTcbPrivilege 6008 4a054a2e389c3c7b876127d4c04a955ceed53201d979e18d6facb57e1bd5ff91.exe Token: SeDebugPrivilege 5572 c43b2a28 Token: SeTcbPrivilege 5572 c43b2a28
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a054a2e389c3c7b876127d4c04a955ceed53201d979e18d6facb57e1bd5ff91.exe"C:\Users\Admin\AppData\Local\Temp\4a054a2e389c3c7b876127d4c04a955ceed53201d979e18d6facb57e1bd5ff91.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6008
-
C:\Windows\Syswow64\c43b2a28C:\Windows\Syswow64\c43b2a281⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5572
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\c43b2a28
- Size 615KB
- SHA256 2177974876fa349bd9ae8c4ffe3a082dd083a79e27386a1143ac24a361502038
- MD5 72931be55cfbf26186146763054001b9
- SHA1 b0bcd1e81dc2b3867cc0cf02e0bae12b7957866d
- SHA512 2cc82f8a0e3cfc88b95e773353d452f8d86688371c526fb0cd49ccc1124fd1f8766acc53ad2b7881e61d285c099858ee35cab9188b1dcf8f1de2b2cf02835bc3
- SSDEEP 12288:/SvO2x9mONvKRILSFnOkx2LIax5FAQjU/Liw:KvO2xJKRI2FOkx2LFicUV
- TLSH T1C1D44A31E241C03AD4A74576C6FA0BAFE5647D25531165CBA3C43A2A2FB36D2BE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH