Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/10/2026, 10:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fe4eead875f0ed725ffb1e5e31f5b9d1ce88fed4b2bff2a759d45b5f2766f632.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
fe4eead875f0ed725ffb1e5e31f5b9d1ce88fed4b2bff2a759d45b5f2766f632.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target fe4eead875f0ed725ffb1e5e31f5b9d1ce88fed4b2bff2a759d45b5f2766f632.exe
- Size 374KB
- Sample261014-mwyk8aby21
- SHA256 fe4eead875f0ed725ffb1e5e31f5b9d1ce88fed4b2bff2a759d45b5f2766f632
- MD5 8bdf9da923b5abcf1962b3f28bccb378
- SHA1 bc142504fb920749029fb8716a9e4ac402e0ae42
- SHA512 28eed3f17ce047657354300f627745f937d7ae7a552e1b693ead33df8f75e99fa0cbab1012420849f0beace008ce31e8c917f31e16a870969c9df8dfa12ff4aa
- SSDEEP 6144:ZcTgav1cdCTuoPbgwmOLJvKRILSFvdFDcEOkCybEaQRXr9HNdvOa:ZSvO2x9mONvKRILSFnOkx2LIa
- TLSH T1AF846D2AF6A0D076C4779579C4A247AAFBB1742137208ACFA390475A1F637E2BD3530D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4144 90754020 - Unexpected DNS network traffic destination 22 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 462 223.5.5.5 4508 fe4eead875f0ed725ffb1e5e31f5b9d1ce88fed4b2bff2a759d45b5f2766f632.exe Destination IP 273 114.114.114.114 4508 fe4eead875f0ed725ffb1e5e31f5b9d1ce88fed4b2bff2a759d45b5f2766f632.exe Destination IP 1 114.114.114.114 4508 fe4eead875f0ed725ffb1e5e31f5b9d1ce88fed4b2bff2a759d45b5f2766f632.exe Destination IP 95 114.114.114.114 4144 90754020 Destination IP 149 114.114.114.114 4508 fe4eead875f0ed725ffb1e5e31f5b9d1ce88fed4b2bff2a759d45b5f2766f632.exe Destination IP 181 114.114.114.114 4508 fe4eead875f0ed725ffb1e5e31f5b9d1ce88fed4b2bff2a759d45b5f2766f632.exe Destination IP 235 114.114.114.114 4508 fe4eead875f0ed725ffb1e5e31f5b9d1ce88fed4b2bff2a759d45b5f2766f632.exe Destination IP 236 223.5.5.5 4508 fe4eead875f0ed725ffb1e5e31f5b9d1ce88fed4b2bff2a759d45b5f2766f632.exe Destination IP 150 223.5.5.5 4508 fe4eead875f0ed725ffb1e5e31f5b9d1ce88fed4b2bff2a759d45b5f2766f632.exe Destination IP 461 114.114.114.114 4508 fe4eead875f0ed725ffb1e5e31f5b9d1ce88fed4b2bff2a759d45b5f2766f632.exe Destination IP 274 223.5.5.5 4508 fe4eead875f0ed725ffb1e5e31f5b9d1ce88fed4b2bff2a759d45b5f2766f632.exe Destination IP 4 223.5.5.5 4508 fe4eead875f0ed725ffb1e5e31f5b9d1ce88fed4b2bff2a759d45b5f2766f632.exe Destination IP 96 223.5.5.5 4508 fe4eead875f0ed725ffb1e5e31f5b9d1ce88fed4b2bff2a759d45b5f2766f632.exe Destination IP 320 114.114.114.114 4508 fe4eead875f0ed725ffb1e5e31f5b9d1ce88fed4b2bff2a759d45b5f2766f632.exe Destination IP 321 223.5.5.5 4508 fe4eead875f0ed725ffb1e5e31f5b9d1ce88fed4b2bff2a759d45b5f2766f632.exe Destination IP 406 114.114.114.114 4508 fe4eead875f0ed725ffb1e5e31f5b9d1ce88fed4b2bff2a759d45b5f2766f632.exe Destination IP 407 223.5.5.5 4508 fe4eead875f0ed725ffb1e5e31f5b9d1ce88fed4b2bff2a759d45b5f2766f632.exe Destination IP 40 114.114.114.114 4508 fe4eead875f0ed725ffb1e5e31f5b9d1ce88fed4b2bff2a759d45b5f2766f632.exe Destination IP 41 223.5.5.5 4508 fe4eead875f0ed725ffb1e5e31f5b9d1ce88fed4b2bff2a759d45b5f2766f632.exe Destination IP 182 223.5.5.5 4508 fe4eead875f0ed725ffb1e5e31f5b9d1ce88fed4b2bff2a759d45b5f2766f632.exe Destination IP 352 114.114.114.114 4508 fe4eead875f0ed725ffb1e5e31f5b9d1ce88fed4b2bff2a759d45b5f2766f632.exe Destination IP 353 223.5.5.5 4508 fe4eead875f0ed725ffb1e5e31f5b9d1ce88fed4b2bff2a759d45b5f2766f632.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 90754020 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 90754020 File created C:\Windows\SysWOW64\90754020 fe4eead875f0ed725ffb1e5e31f5b9d1ce88fed4b2bff2a759d45b5f2766f632.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 90754020 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 90754020 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 90754020 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 90754020 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 90754020 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 90754020 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 90754020 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 90754020 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 90754020 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 90754020 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\46f260 90754020 File opened for modification C:\Windows\4d2db8 fe4eead875f0ed725ffb1e5e31f5b9d1ce88fed4b2bff2a759d45b5f2766f632.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 90754020 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname fe4eead875f0ed725ffb1e5e31f5b9d1ce88fed4b2bff2a759d45b5f2766f632.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain fe4eead875f0ed725ffb1e5e31f5b9d1ce88fed4b2bff2a759d45b5f2766f632.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 90754020 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fe4eead875f0ed725ffb1e5e31f5b9d1ce88fed4b2bff2a759d45b5f2766f632.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 90754020 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 90754020 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 90754020 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 90754020 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 90754020 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 90754020 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 90754020 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 90754020 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 90754020 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 90754020 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 4144 90754020 4144 90754020 4144 90754020 4144 90754020 4144 90754020 4144 90754020 4144 90754020 4144 90754020 4508 fe4eead875f0ed725ffb1e5e31f5b9d1ce88fed4b2bff2a759d45b5f2766f632.exe 4508 fe4eead875f0ed725ffb1e5e31f5b9d1ce88fed4b2bff2a759d45b5f2766f632.exe 4508 fe4eead875f0ed725ffb1e5e31f5b9d1ce88fed4b2bff2a759d45b5f2766f632.exe 4508 fe4eead875f0ed725ffb1e5e31f5b9d1ce88fed4b2bff2a759d45b5f2766f632.exe 4508 fe4eead875f0ed725ffb1e5e31f5b9d1ce88fed4b2bff2a759d45b5f2766f632.exe 4508 fe4eead875f0ed725ffb1e5e31f5b9d1ce88fed4b2bff2a759d45b5f2766f632.exe 4508 fe4eead875f0ed725ffb1e5e31f5b9d1ce88fed4b2bff2a759d45b5f2766f632.exe 4508 fe4eead875f0ed725ffb1e5e31f5b9d1ce88fed4b2bff2a759d45b5f2766f632.exe 4508 fe4eead875f0ed725ffb1e5e31f5b9d1ce88fed4b2bff2a759d45b5f2766f632.exe 4508 fe4eead875f0ed725ffb1e5e31f5b9d1ce88fed4b2bff2a759d45b5f2766f632.exe 4508 fe4eead875f0ed725ffb1e5e31f5b9d1ce88fed4b2bff2a759d45b5f2766f632.exe 4508 fe4eead875f0ed725ffb1e5e31f5b9d1ce88fed4b2bff2a759d45b5f2766f632.exe 4508 fe4eead875f0ed725ffb1e5e31f5b9d1ce88fed4b2bff2a759d45b5f2766f632.exe 4508 fe4eead875f0ed725ffb1e5e31f5b9d1ce88fed4b2bff2a759d45b5f2766f632.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4508 fe4eead875f0ed725ffb1e5e31f5b9d1ce88fed4b2bff2a759d45b5f2766f632.exe Token: SeTcbPrivilege 4508 fe4eead875f0ed725ffb1e5e31f5b9d1ce88fed4b2bff2a759d45b5f2766f632.exe Token: SeDebugPrivilege 4144 90754020 Token: SeTcbPrivilege 4144 90754020
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe4eead875f0ed725ffb1e5e31f5b9d1ce88fed4b2bff2a759d45b5f2766f632.exe"C:\Users\Admin\AppData\Local\Temp\fe4eead875f0ed725ffb1e5e31f5b9d1ce88fed4b2bff2a759d45b5f2766f632.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4508
-
C:\Windows\Syswow64\90754020C:\Windows\Syswow64\907540201⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4144
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\90754020
- Size 374KB
- SHA256 fb87cf682a6777eeae5a16f191ae56b97ddfe7166f2906650e83e4001066bf65
- MD5 35ad6f14062f638583f83e898efc72db
- SHA1 da2364672dc4b1693ff3439b7f6f4def9971f56c
- SHA512 166681375de824b4c11652728f36fc82aa06e36b56594ac450328dba306ca730885a606fca9bf254c6011bf2919314cd8ae1e6aafce1bbd7af800e18a7153689
- SSDEEP 6144:4cTgav1cdCTuoPbgwmOLJvKRILSFvdFDcEOkCybEaQRXr9HNdvOa:4SvO2x9mONvKRILSFnOkx2LIa
- TLSH T1B0846D2AF6A0D076C4779579C4A247AAFBB1742137208ACFA390475A1F637E2BD3530D
- MD5 SHA1 SHA512 SSDEEP TLSH