Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/10/2026, 07:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3fdace27478ff60b357a354df0e650fd9ccd2abda4bcea645a1bf495bc707972.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
3fdace27478ff60b357a354df0e650fd9ccd2abda4bcea645a1bf495bc707972.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 3fdace27478ff60b357a354df0e650fd9ccd2abda4bcea645a1bf495bc707972.exe
- Size 948KB
- Sample261014-jdmt8a1vdz
- SHA256 3fdace27478ff60b357a354df0e650fd9ccd2abda4bcea645a1bf495bc707972
- MD5 72d2ccf9912c2ef77381cd88a810e3d7
- SHA1 eeca0547be81d635416fe750258bdc2ea0997b42
- SHA512 4734d42f211824e04f4211f0d60b804c3f0114683adde2ff8c32762351fbac3390ddd4f449fa400f65e2c861b974196e1a1a6e8c29e14cfdc13751c6f26f5e94
- SSDEEP 24576:1vO2xJKRI2dOkx2LFAAX1oOYSY82e5QPJJ:1HHKO2FQd1oOU82lPJ
- TLSH T165259D16F7A1C072C86742B448B6872EA671BC152B214ACBF7C07B5E4E727D1AE3634D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4944 52b88b0 - Unexpected DNS network traffic destination 18 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 40 114.114.114.114 5172 3fdace27478ff60b357a354df0e650fd9ccd2abda4bcea645a1bf495bc707972.exe Destination IP 179 223.5.5.5 5172 3fdace27478ff60b357a354df0e650fd9ccd2abda4bcea645a1bf495bc707972.exe Destination IP 235 114.114.114.114 5172 3fdace27478ff60b357a354df0e650fd9ccd2abda4bcea645a1bf495bc707972.exe Destination IP 292 114.114.114.114 5172 3fdace27478ff60b357a354df0e650fd9ccd2abda4bcea645a1bf495bc707972.exe Destination IP 41 223.5.5.5 5172 3fdace27478ff60b357a354df0e650fd9ccd2abda4bcea645a1bf495bc707972.exe Destination IP 114 114.114.114.114 5172 3fdace27478ff60b357a354df0e650fd9ccd2abda4bcea645a1bf495bc707972.exe Destination IP 115 223.5.5.5 5172 3fdace27478ff60b357a354df0e650fd9ccd2abda4bcea645a1bf495bc707972.exe Destination IP 322 114.114.114.114 5172 3fdace27478ff60b357a354df0e650fd9ccd2abda4bcea645a1bf495bc707972.exe Destination IP 323 223.5.5.5 5172 3fdace27478ff60b357a354df0e650fd9ccd2abda4bcea645a1bf495bc707972.exe Destination IP 4 223.5.5.5 5172 3fdace27478ff60b357a354df0e650fd9ccd2abda4bcea645a1bf495bc707972.exe Destination IP 95 114.114.114.114 4944 52b88b0 Destination IP 96 223.5.5.5 5172 3fdace27478ff60b357a354df0e650fd9ccd2abda4bcea645a1bf495bc707972.exe Destination IP 1 114.114.114.114 5172 3fdace27478ff60b357a354df0e650fd9ccd2abda4bcea645a1bf495bc707972.exe Destination IP 177 114.114.114.114 5172 3fdace27478ff60b357a354df0e650fd9ccd2abda4bcea645a1bf495bc707972.exe Destination IP 236 223.5.5.5 5172 3fdace27478ff60b357a354df0e650fd9ccd2abda4bcea645a1bf495bc707972.exe Destination IP 293 223.5.5.5 5172 3fdace27478ff60b357a354df0e650fd9ccd2abda4bcea645a1bf495bc707972.exe Destination IP 376 114.114.114.114 5172 3fdace27478ff60b357a354df0e650fd9ccd2abda4bcea645a1bf495bc707972.exe Destination IP 377 223.5.5.5 5172 3fdace27478ff60b357a354df0e650fd9ccd2abda4bcea645a1bf495bc707972.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 52b88b0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 52b88b0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 52b88b0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 52b88b0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 52b88b0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 52b88b0 File created C:\Windows\SysWOW64\52b88b0 3fdace27478ff60b357a354df0e650fd9ccd2abda4bcea645a1bf495bc707972.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 52b88b0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 52b88b0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 52b88b0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 52b88b0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 52b88b0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 52b88b0 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\54a4a0 52b88b0 File opened for modification C:\Windows\588be8 3fdace27478ff60b357a354df0e650fd9ccd2abda4bcea645a1bf495bc707972.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 52b88b0 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 3fdace27478ff60b357a354df0e650fd9ccd2abda4bcea645a1bf495bc707972.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 3fdace27478ff60b357a354df0e650fd9ccd2abda4bcea645a1bf495bc707972.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 52b88b0 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52b88b0 Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3fdace27478ff60b357a354df0e650fd9ccd2abda4bcea645a1bf495bc707972.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 52b88b0 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 52b88b0 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 52b88b0 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 52b88b0 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 52b88b0 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 52b88b0 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 52b88b0 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 52b88b0 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 52b88b0 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 4944 52b88b0 4944 52b88b0 4944 52b88b0 4944 52b88b0 4944 52b88b0 4944 52b88b0 4944 52b88b0 4944 52b88b0 5172 3fdace27478ff60b357a354df0e650fd9ccd2abda4bcea645a1bf495bc707972.exe 5172 3fdace27478ff60b357a354df0e650fd9ccd2abda4bcea645a1bf495bc707972.exe 5172 3fdace27478ff60b357a354df0e650fd9ccd2abda4bcea645a1bf495bc707972.exe 5172 3fdace27478ff60b357a354df0e650fd9ccd2abda4bcea645a1bf495bc707972.exe 5172 3fdace27478ff60b357a354df0e650fd9ccd2abda4bcea645a1bf495bc707972.exe 5172 3fdace27478ff60b357a354df0e650fd9ccd2abda4bcea645a1bf495bc707972.exe 5172 3fdace27478ff60b357a354df0e650fd9ccd2abda4bcea645a1bf495bc707972.exe 5172 3fdace27478ff60b357a354df0e650fd9ccd2abda4bcea645a1bf495bc707972.exe 5172 3fdace27478ff60b357a354df0e650fd9ccd2abda4bcea645a1bf495bc707972.exe 5172 3fdace27478ff60b357a354df0e650fd9ccd2abda4bcea645a1bf495bc707972.exe 5172 3fdace27478ff60b357a354df0e650fd9ccd2abda4bcea645a1bf495bc707972.exe 5172 3fdace27478ff60b357a354df0e650fd9ccd2abda4bcea645a1bf495bc707972.exe 5172 3fdace27478ff60b357a354df0e650fd9ccd2abda4bcea645a1bf495bc707972.exe 5172 3fdace27478ff60b357a354df0e650fd9ccd2abda4bcea645a1bf495bc707972.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 5172 3fdace27478ff60b357a354df0e650fd9ccd2abda4bcea645a1bf495bc707972.exe Token: SeTcbPrivilege 5172 3fdace27478ff60b357a354df0e650fd9ccd2abda4bcea645a1bf495bc707972.exe Token: SeDebugPrivilege 4944 52b88b0 Token: SeTcbPrivilege 4944 52b88b0
Processes
-
C:\Users\Admin\AppData\Local\Temp\3fdace27478ff60b357a354df0e650fd9ccd2abda4bcea645a1bf495bc707972.exe"C:\Users\Admin\AppData\Local\Temp\3fdace27478ff60b357a354df0e650fd9ccd2abda4bcea645a1bf495bc707972.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5172
-
C:\Windows\Syswow64\52b88b0C:\Windows\Syswow64\52b88b01⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4944
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\52b88b0
- Size 948KB
- SHA256 e20a9f8f097d4e99fd4bde346afab1aee20dcecb08cf7b9b888a9941ef4efb63
- MD5 6fe4ddb36a05f355e07bfc438632dae0
- SHA1 2f0c216bad394da1f6bfe748fcf8075d3b93bdd2
- SHA512 ec47f0414319f5c48b2c9d9f488d4ef7eb6167370e69f42770c15c5bb2542f0b2116a01c823d0f66374b7ead3d66389b3912c784b9ff18251a017063d47567b9
- SSDEEP 24576:6vO2xJKRI2dOkx2LFAAX1oOYSY82e5QPJJ:6HHKO2FQd1oOU82lPJ
- TLSH T162259D16F7A1C072C86742B448B6872EA671BC152B214ACBF7C07B5E4E727D1AE3634D
- MD5 SHA1 SHA512 SSDEEP TLSH