Analysis
- max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
12/10/2026, 20:13
Behavioral task
behavioral1
Sample
ba1c5183ee5ea4086167a29bf0c0efa4d78d162c136c6c7f29c6b39e196322c7.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target ba1c5183ee5ea4086167a29bf0c0efa4d78d162c136c6c7f29c6b39e196322c7.exe
- Size 525KB
- Sample261012-yzlavaef39
- SHA256 ba1c5183ee5ea4086167a29bf0c0efa4d78d162c136c6c7f29c6b39e196322c7
- MD5 8f6ab1a5d0d7d8bbfb8fa9e638cf397f
- SHA1 993e87029ca5777f0e448a988d440faa4e8b526f
- SHA512 b3d6190beb6fa07a834f35019a40aac9e003a47a736dca23709ff2dbbafd537d865287410573bfb78027f579c60aaf50756ea3b6e8a68bf78299c57d007d4fae
- SSDEEP 6144:8cTgav1cdCTuoPbgwmOLJvKRwLSFXdFwirGcEOkCybEaQRXr9HNdvOa+y8K:8SvO2x9mONvKRwLSFtsOkx2LIa+y
- TLSH T152B47D2AB6A0D076C4779579C4A257BAFBB1742137204ACFA390475A1F237E2BE3530D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2820 92993f73 - Unexpected DNS network traffic destination 20 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 200 223.5.5.5 3420 ba1c5183ee5ea4086167a29bf0c0efa4d78d162c136c6c7f29c6b39e196322c7.exe Destination IP 419 114.114.114.114 3420 ba1c5183ee5ea4086167a29bf0c0efa4d78d162c136c6c7f29c6b39e196322c7.exe Destination IP 480 114.114.114.114 3420 ba1c5183ee5ea4086167a29bf0c0efa4d78d162c136c6c7f29c6b39e196322c7.exe Destination IP 349 223.5.5.5 3420 ba1c5183ee5ea4086167a29bf0c0efa4d78d162c136c6c7f29c6b39e196322c7.exe Destination IP 389 223.5.5.5 3420 ba1c5183ee5ea4086167a29bf0c0efa4d78d162c136c6c7f29c6b39e196322c7.exe Destination IP 481 223.5.5.5 3420 ba1c5183ee5ea4086167a29bf0c0efa4d78d162c136c6c7f29c6b39e196322c7.exe Destination IP 63 114.114.114.114 3420 ba1c5183ee5ea4086167a29bf0c0efa4d78d162c136c6c7f29c6b39e196322c7.exe Destination IP 64 223.5.5.5 3420 ba1c5183ee5ea4086167a29bf0c0efa4d78d162c136c6c7f29c6b39e196322c7.exe Destination IP 130 223.5.5.5 3420 ba1c5183ee5ea4086167a29bf0c0efa4d78d162c136c6c7f29c6b39e196322c7.exe Destination IP 199 114.114.114.114 3420 ba1c5183ee5ea4086167a29bf0c0efa4d78d162c136c6c7f29c6b39e196322c7.exe Destination IP 299 114.114.114.114 3420 ba1c5183ee5ea4086167a29bf0c0efa4d78d162c136c6c7f29c6b39e196322c7.exe Destination IP 347 114.114.114.114 3420 ba1c5183ee5ea4086167a29bf0c0efa4d78d162c136c6c7f29c6b39e196322c7.exe Destination IP 3 114.114.114.114 3420 ba1c5183ee5ea4086167a29bf0c0efa4d78d162c136c6c7f29c6b39e196322c7.exe Destination IP 238 114.114.114.114 3420 ba1c5183ee5ea4086167a29bf0c0efa4d78d162c136c6c7f29c6b39e196322c7.exe Destination IP 239 223.5.5.5 3420 ba1c5183ee5ea4086167a29bf0c0efa4d78d162c136c6c7f29c6b39e196322c7.exe Destination IP 300 223.5.5.5 3420 ba1c5183ee5ea4086167a29bf0c0efa4d78d162c136c6c7f29c6b39e196322c7.exe Destination IP 388 114.114.114.114 3420 ba1c5183ee5ea4086167a29bf0c0efa4d78d162c136c6c7f29c6b39e196322c7.exe Destination IP 420 223.5.5.5 3420 ba1c5183ee5ea4086167a29bf0c0efa4d78d162c136c6c7f29c6b39e196322c7.exe Destination IP 4 223.5.5.5 3420 ba1c5183ee5ea4086167a29bf0c0efa4d78d162c136c6c7f29c6b39e196322c7.exe Destination IP 129 114.114.114.114 2820 92993f73 - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 92993f73 File created C:\Windows\SysWOW64\92993f73 ba1c5183ee5ea4086167a29bf0c0efa4d78d162c136c6c7f29c6b39e196322c7.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 92993f73 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 92993f73 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 92993f73 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 92993f73 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 92993f73 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 92993f73 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 92993f73 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 92993f73 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 92993f73 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 92993f73 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 92993f73 -
resource yara_rule behavioral1/memory/3420-0-0x0000000000190000-0x000000000021C000-memory.dmp upx behavioral1/files/0x00080000000243c2-2.dat upx behavioral1/memory/2820-4-0x0000000000D00000-0x0000000000D8C000-memory.dmp upx behavioral1/memory/3420-18-0x0000000000190000-0x000000000021C000-memory.dmp upx behavioral1/memory/2820-19-0x0000000000D00000-0x0000000000D8C000-memory.dmp upx behavioral1/memory/2820-38-0x0000000000D00000-0x0000000000D8C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\304788 92993f73 File opened for modification C:\Windows\3a8d38 ba1c5183ee5ea4086167a29bf0c0efa4d78d162c136c6c7f29c6b39e196322c7.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 92993f73 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 92993f73 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname ba1c5183ee5ea4086167a29bf0c0efa4d78d162c136c6c7f29c6b39e196322c7.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain ba1c5183ee5ea4086167a29bf0c0efa4d78d162c136c6c7f29c6b39e196322c7.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ba1c5183ee5ea4086167a29bf0c0efa4d78d162c136c6c7f29c6b39e196322c7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92993f73 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 92993f73 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 92993f73 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 92993f73 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 92993f73 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 92993f73 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 92993f73 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 92993f73 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 92993f73 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 92993f73 - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2820 92993f73 2820 92993f73 2820 92993f73 2820 92993f73 2820 92993f73 2820 92993f73 2820 92993f73 2820 92993f73 3420 ba1c5183ee5ea4086167a29bf0c0efa4d78d162c136c6c7f29c6b39e196322c7.exe 3420 ba1c5183ee5ea4086167a29bf0c0efa4d78d162c136c6c7f29c6b39e196322c7.exe 3420 ba1c5183ee5ea4086167a29bf0c0efa4d78d162c136c6c7f29c6b39e196322c7.exe 3420 ba1c5183ee5ea4086167a29bf0c0efa4d78d162c136c6c7f29c6b39e196322c7.exe 3420 ba1c5183ee5ea4086167a29bf0c0efa4d78d162c136c6c7f29c6b39e196322c7.exe 3420 ba1c5183ee5ea4086167a29bf0c0efa4d78d162c136c6c7f29c6b39e196322c7.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3420 ba1c5183ee5ea4086167a29bf0c0efa4d78d162c136c6c7f29c6b39e196322c7.exe Token: SeTcbPrivilege 3420 ba1c5183ee5ea4086167a29bf0c0efa4d78d162c136c6c7f29c6b39e196322c7.exe Token: SeDebugPrivilege 2820 92993f73 Token: SeTcbPrivilege 2820 92993f73
Processes
-
C:\Users\Admin\AppData\Local\Temp\ba1c5183ee5ea4086167a29bf0c0efa4d78d162c136c6c7f29c6b39e196322c7.exe"C:\Users\Admin\AppData\Local\Temp\ba1c5183ee5ea4086167a29bf0c0efa4d78d162c136c6c7f29c6b39e196322c7.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3420
-
C:\Windows\Syswow64\92993f73C:\Windows\Syswow64\92993f731⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2820
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\92993f73
- Size 525KB
- SHA256 540d3e64462bd2bde97c5d27943f8d4b01afb66bcf05f05aae8b26312edeb740
- MD5 98bc1142e86e7ad182c8665ba6165b62
- SHA1 5e3158a00f52722b487e0f51ce423ecf89e18cb0
- SHA512 133e0928b1a653de1990b7979731a804b122e5419f61a740e141dfb9a6f1fcaae482f54f12608f4183fcc07ec8066d8931a2be77e63956558ef54bd308c988f2
- SSDEEP 6144:2cTgav1cdCTuoPbgwmOLJvKRwLSFXdFwirGcEOkCybEaQRXr9HNdvOa+y8K:2SvO2x9mONvKRwLSFtsOkx2LIa+y
- TLSH T1B8B47D2AB6A0D076C4779579C4A257BAFBB1742137204ACFA390475A1F237E2BE3530D
- MD5 SHA1 SHA512 SSDEEP TLSH