Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/10/2026, 20:03
Behavioral task
behavioral1
Sample
d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe
- Size 830KB
- Sample261012-ysrt2sew7s
- SHA256 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d
- MD5 977ea980a818d701087b16fc39f715bf
- SHA1 621e1e8c3cfb74bb5572a68e7936e5192882ab8f
- SHA512 edb26e71427d7dfb46ab454eff7412c627ee30a2128d39a11098cf9bc54fd527d30d39c502ff7fba79ee4023a371963d6874ab0d79840ed09282c5fdff002146
- SSDEEP 12288:9SvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/Lik8CQ3K:cvO2xJKRw2kOkx2LFRvcUQPK
- TLSH T11E055A31E641C03AD0A74575C6FA4BBFE964BD25131165CBA3C43A262FB36D2BA3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2832 694fc5b4 - Unexpected DNS network traffic destination 22 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 39 114.114.114.114 5888 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe Destination IP 95 223.5.5.5 5888 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe Destination IP 234 114.114.114.114 5888 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe Destination IP 235 223.5.5.5 5888 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe Destination IP 385 114.114.114.114 5888 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe Destination IP 386 223.5.5.5 5888 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe Destination IP 439 114.114.114.114 5888 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe Destination IP 6 223.5.5.5 5888 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe Destination IP 300 223.5.5.5 5888 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe Destination IP 289 223.5.5.5 5888 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe Destination IP 3 114.114.114.114 5888 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe Destination IP 149 223.5.5.5 5888 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe Destination IP 180 114.114.114.114 5888 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe Destination IP 181 223.5.5.5 5888 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe Destination IP 40 223.5.5.5 5888 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe Destination IP 93 114.114.114.114 2832 694fc5b4 Destination IP 148 114.114.114.114 5888 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe Destination IP 299 114.114.114.114 5888 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe Destination IP 331 114.114.114.114 5888 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe Destination IP 332 223.5.5.5 5888 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe Destination IP 440 223.5.5.5 5888 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe Destination IP 288 114.114.114.114 5888 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 694fc5b4 File created C:\Windows\SysWOW64\694fc5b4 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 694fc5b4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 694fc5b4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 694fc5b4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 694fc5b4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 694fc5b4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 694fc5b4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 694fc5b4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 694fc5b4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 694fc5b4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 694fc5b4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 694fc5b4 -
resource yara_rule behavioral2/memory/5888-0-0x0000000000EC0000-0x0000000000F4C000-memory.dmp upx behavioral2/files/0x001300000001b1c0-2.dat upx behavioral2/memory/2832-3-0x0000000000CF0000-0x0000000000D7C000-memory.dmp upx behavioral2/memory/5888-25-0x0000000000EC0000-0x0000000000F4C000-memory.dmp upx behavioral2/memory/2832-26-0x0000000000CF0000-0x0000000000D7C000-memory.dmp upx behavioral2/memory/2832-53-0x0000000000CF0000-0x0000000000D7C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\307c20 694fc5b4 File opened for modification C:\Windows\64ce00 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 694fc5b4 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 694fc5b4 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 694fc5b4 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 694fc5b4 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 694fc5b4 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 694fc5b4 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 694fc5b4 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 694fc5b4 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 694fc5b4 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 694fc5b4 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 694fc5b4 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 694fc5b4 - Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 2832 694fc5b4 2832 694fc5b4 2832 694fc5b4 2832 694fc5b4 2832 694fc5b4 2832 694fc5b4 2832 694fc5b4 2832 694fc5b4 2832 694fc5b4 2832 694fc5b4 2832 694fc5b4 2832 694fc5b4 2832 694fc5b4 2832 694fc5b4 2832 694fc5b4 2832 694fc5b4 2832 694fc5b4 2832 694fc5b4 2832 694fc5b4 2832 694fc5b4 5888 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe 5888 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe 5888 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe 5888 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe 5888 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe 5888 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe 5888 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe 5888 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe 5888 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe 5888 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe 5888 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe 5888 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe 5888 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe 5888 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe 5888 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe 5888 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe 5888 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe 5888 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe 5888 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe 5888 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 5888 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe Token: SeTcbPrivilege 5888 d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe Token: SeDebugPrivilege 2832 694fc5b4 Token: SeTcbPrivilege 2832 694fc5b4
Processes
-
C:\Users\Admin\AppData\Local\Temp\d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe"C:\Users\Admin\AppData\Local\Temp\d1768e21df71771d19e07785000cce1422fabb2f48e6a535ad81621ee499c38d.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5888
-
C:\Windows\Syswow64\694fc5b4C:\Windows\Syswow64\694fc5b41⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2832
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\307c20
- Size 916B
- SHA256 90fba995dc6a6e540203e3ab98a7d5985766935d78205ee93e08ce2dc6a2384d
- MD5 83c79aee9050a77e45afd00e4ab392b7
- SHA1 66c0c4a3b235b61cea2a5f100c09e430948bcf3d
- SHA512 daa62ecc420afcf33c63b05aa3c1ea695233c4ea372586d8051800ee5a3eb4861543bd8b7ffb9a5a18d0923b592e4a81e012e5c754b8240bdce985bbfefdb431
- TLSH T1D8117DF9A0689EE5B8ED86357AD19CDA7E3232D7C5CA402787A1405131522E8CDB3157
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\694fc5b4
- Size 830KB
- SHA256 a429fb6fada4b658aa3e9c2e8b6f84e4f9803ed67d1a9fc94265ab3c8c945167
- MD5 7f878ca7a162a3b69cd15a7d3bfb2993
- SHA1 53748b3d89727240dc26ae61a5aa78c80be26767
- SHA512 5dfb427400aff2b3d5d367506775457eb6252fe812e221c56c8638e3727a41b99fed23662dc3a149a0eac55a90770f375a32e76668ddf54758ad1e0c0c907560
- SSDEEP 12288:GSvO2x9mONvKRwLSFtsOkx2LIa+ya5FAQjU/Lik8CQ3K:lvO2xJKRw2kOkx2LFRvcUQPK
- TLSH T16C055A31E641C03AD0A74575C6FA4BBFE964BD25131165CBA3C43A262FB36D2BA3170E
- MD5 SHA1 SHA512 SSDEEP TLSH