Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
17/10/2026, 02:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
34e7d8b67ab7b8a61c05fc591707138879c8438ca8fad44c58e2ff38cd6a76e9.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
34e7d8b67ab7b8a61c05fc591707138879c8438ca8fad44c58e2ff38cd6a76e9.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 34e7d8b67ab7b8a61c05fc591707138879c8438ca8fad44c58e2ff38cd6a76e9.exe
- Size 511KB
- Sample261017-cjrl2avvb1
- SHA256 34e7d8b67ab7b8a61c05fc591707138879c8438ca8fad44c58e2ff38cd6a76e9
- MD5 91b88c0751e0faae928b51b44204148e
- SHA1 5e6dd8bd835bd3ab4351b6b9e613c7c522b46115
- SHA512 c7cf428ddbf0ad6d9a07de312570a77fc3edb484049e11c1993fff957013985d58a9d6034eabae3488e7766d322d04c26bd4a2aab09330d33dcb9e29fa7bcd87
- SSDEEP 6144:ccTgav1cdCTuoPbgwmOLJvKRILSFvdFDcEOkCybEaQRXr9HNdvOax5Rv0:cSvO2x9mONvKRILSFnOkx2LIax5F0
- TLSH T18AB45C26F6908036C4B34575C5F64BAAFAB4BC21631156CBA3943A6A1F737D2BD3130E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2232 7c54a162 - Unexpected DNS network traffic destination 28 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 277 114.114.114.114 1708 34e7d8b67ab7b8a61c05fc591707138879c8438ca8fad44c58e2ff38cd6a76e9.exe Destination IP 368 114.114.114.114 1708 34e7d8b67ab7b8a61c05fc591707138879c8438ca8fad44c58e2ff38cd6a76e9.exe Destination IP 569 114.114.114.114 1708 34e7d8b67ab7b8a61c05fc591707138879c8438ca8fad44c58e2ff38cd6a76e9.exe Destination IP 5 114.114.114.114 1708 34e7d8b67ab7b8a61c05fc591707138879c8438ca8fad44c58e2ff38cd6a76e9.exe Destination IP 337 114.114.114.114 1708 34e7d8b67ab7b8a61c05fc591707138879c8438ca8fad44c58e2ff38cd6a76e9.exe Destination IP 370 223.5.5.5 1708 34e7d8b67ab7b8a61c05fc591707138879c8438ca8fad44c58e2ff38cd6a76e9.exe Destination IP 415 223.5.5.5 1708 34e7d8b67ab7b8a61c05fc591707138879c8438ca8fad44c58e2ff38cd6a76e9.exe Destination IP 479 223.5.5.5 1708 34e7d8b67ab7b8a61c05fc591707138879c8438ca8fad44c58e2ff38cd6a76e9.exe Destination IP 538 114.114.114.114 1708 34e7d8b67ab7b8a61c05fc591707138879c8438ca8fad44c58e2ff38cd6a76e9.exe Destination IP 539 223.5.5.5 1708 34e7d8b67ab7b8a61c05fc591707138879c8438ca8fad44c58e2ff38cd6a76e9.exe Destination IP 630 114.114.114.114 1708 34e7d8b67ab7b8a61c05fc591707138879c8438ca8fad44c58e2ff38cd6a76e9.exe Destination IP 46 114.114.114.114 1708 34e7d8b67ab7b8a61c05fc591707138879c8438ca8fad44c58e2ff38cd6a76e9.exe Destination IP 181 114.114.114.114 1708 34e7d8b67ab7b8a61c05fc591707138879c8438ca8fad44c58e2ff38cd6a76e9.exe Destination IP 383 114.114.114.114 1708 34e7d8b67ab7b8a61c05fc591707138879c8438ca8fad44c58e2ff38cd6a76e9.exe Destination IP 384 223.5.5.5 1708 34e7d8b67ab7b8a61c05fc591707138879c8438ca8fad44c58e2ff38cd6a76e9.exe Destination IP 478 114.114.114.114 1708 34e7d8b67ab7b8a61c05fc591707138879c8438ca8fad44c58e2ff38cd6a76e9.exe Destination IP 570 223.5.5.5 1708 34e7d8b67ab7b8a61c05fc591707138879c8438ca8fad44c58e2ff38cd6a76e9.exe Destination IP 631 223.5.5.5 1708 34e7d8b67ab7b8a61c05fc591707138879c8438ca8fad44c58e2ff38cd6a76e9.exe Destination IP 338 223.5.5.5 1708 34e7d8b67ab7b8a61c05fc591707138879c8438ca8fad44c58e2ff38cd6a76e9.exe Destination IP 6 223.5.5.5 1708 34e7d8b67ab7b8a61c05fc591707138879c8438ca8fad44c58e2ff38cd6a76e9.exe Destination IP 47 223.5.5.5 1708 34e7d8b67ab7b8a61c05fc591707138879c8438ca8fad44c58e2ff38cd6a76e9.exe Destination IP 111 114.114.114.114 2232 7c54a162 Destination IP 182 223.5.5.5 1708 34e7d8b67ab7b8a61c05fc591707138879c8438ca8fad44c58e2ff38cd6a76e9.exe Destination IP 217 223.5.5.5 1708 34e7d8b67ab7b8a61c05fc591707138879c8438ca8fad44c58e2ff38cd6a76e9.exe Destination IP 278 223.5.5.5 1708 34e7d8b67ab7b8a61c05fc591707138879c8438ca8fad44c58e2ff38cd6a76e9.exe Destination IP 414 114.114.114.114 1708 34e7d8b67ab7b8a61c05fc591707138879c8438ca8fad44c58e2ff38cd6a76e9.exe Destination IP 112 223.5.5.5 1708 34e7d8b67ab7b8a61c05fc591707138879c8438ca8fad44c58e2ff38cd6a76e9.exe Destination IP 216 114.114.114.114 1708 34e7d8b67ab7b8a61c05fc591707138879c8438ca8fad44c58e2ff38cd6a76e9.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 7c54a162 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 7c54a162 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 7c54a162 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 7c54a162 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 7c54a162 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 7c54a162 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 7c54a162 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 7c54a162 File created C:\Windows\SysWOW64\7c54a162 34e7d8b67ab7b8a61c05fc591707138879c8438ca8fad44c58e2ff38cd6a76e9.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 7c54a162 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 7c54a162 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 7c54a162 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 7c54a162 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\263670 7c54a162 File opened for modification C:\Windows\1d3dd8 34e7d8b67ab7b8a61c05fc591707138879c8438ca8fad44c58e2ff38cd6a76e9.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 7c54a162 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 7c54a162 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 34e7d8b67ab7b8a61c05fc591707138879c8438ca8fad44c58e2ff38cd6a76e9.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 34e7d8b67ab7b8a61c05fc591707138879c8438ca8fad44c58e2ff38cd6a76e9.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 34e7d8b67ab7b8a61c05fc591707138879c8438ca8fad44c58e2ff38cd6a76e9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7c54a162 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 7c54a162 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 7c54a162 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 7c54a162 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 7c54a162 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 7c54a162 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 7c54a162 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 7c54a162 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 7c54a162 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 7c54a162 - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2232 7c54a162 2232 7c54a162 2232 7c54a162 2232 7c54a162 2232 7c54a162 2232 7c54a162 2232 7c54a162 2232 7c54a162 1708 34e7d8b67ab7b8a61c05fc591707138879c8438ca8fad44c58e2ff38cd6a76e9.exe 1708 34e7d8b67ab7b8a61c05fc591707138879c8438ca8fad44c58e2ff38cd6a76e9.exe 1708 34e7d8b67ab7b8a61c05fc591707138879c8438ca8fad44c58e2ff38cd6a76e9.exe 1708 34e7d8b67ab7b8a61c05fc591707138879c8438ca8fad44c58e2ff38cd6a76e9.exe 1708 34e7d8b67ab7b8a61c05fc591707138879c8438ca8fad44c58e2ff38cd6a76e9.exe 1708 34e7d8b67ab7b8a61c05fc591707138879c8438ca8fad44c58e2ff38cd6a76e9.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1708 34e7d8b67ab7b8a61c05fc591707138879c8438ca8fad44c58e2ff38cd6a76e9.exe Token: SeTcbPrivilege 1708 34e7d8b67ab7b8a61c05fc591707138879c8438ca8fad44c58e2ff38cd6a76e9.exe Token: SeDebugPrivilege 2232 7c54a162 Token: SeTcbPrivilege 2232 7c54a162
Processes
-
C:\Users\Admin\AppData\Local\Temp\34e7d8b67ab7b8a61c05fc591707138879c8438ca8fad44c58e2ff38cd6a76e9.exe"C:\Users\Admin\AppData\Local\Temp\34e7d8b67ab7b8a61c05fc591707138879c8438ca8fad44c58e2ff38cd6a76e9.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1708
-
C:\Windows\Syswow64\7c54a162C:\Windows\Syswow64\7c54a1621⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2232
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\7c54a162
- Size 511KB
- SHA256 ce8eafd333f9e8d71f066e8030d1c889ecd50cb074cb6400ddb657a43cd0d8ce
- MD5 b539f00eb55bd02b83810c261bd605ed
- SHA1 ba588f1fc1bced144c00c23ee37dbd4a2214a28e
- SHA512 9de484a757b3ec4343d6ea3ce961131ee1424628dc04a36e704ef3b6eba8200f1d8f9e6b00d60f8ea7ba6509858f82bd57f02c2ec195a2e478fa05c80bb9546a
- SSDEEP 6144:8cTgav1cdCTuoPbgwmOLJvKRILSFvdFDcEOkCybEaQRXr9HNdvOax5Rv0:8SvO2x9mONvKRILSFnOkx2LIax5F0
- TLSH T1BCB45C26F6908036C4B34575C5F64BAAFAB4BC21631156CBA3943A6A1F737D2BD3130E
- MD5 SHA1 SHA512 SSDEEP TLSH