Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
17/10/2026, 04:32
Behavioral task
behavioral1
Sample
f94d217000d3cf06607e918a2146c46fa503849ebd5706ab54dde755419e7782.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target f94d217000d3cf06607e918a2146c46fa503849ebd5706ab54dde755419e7782.exe
- Size 560KB
- Sample261017-e5yctasw4l
- SHA256 f94d217000d3cf06607e918a2146c46fa503849ebd5706ab54dde755419e7782
- MD5 0616225da7a163cdd6093415b2df79c1
- SHA1 358059e8cd15b337a745337595d6789057a5f0d5
- SHA512 7b43510f6c55f63be9ac9513c29cb50e0d50cbf9db28c92776ccb8e56a5d044f1751de8fae63745161553889757a64183c823b8904ec977509ec8ba0d39b7511
- SSDEEP 6144:FUJJuV1cdhIoA7vJ0CLoCgvDLe4AmFvirGcEOkCybEaQRuy8K:FYsVOdhElvkCgvDLe4usOkxHy
- TLSH T1C1C48D29B6D0C036C5B39574C4A186BAEAB17432372549CFA3D5475A0F337E2BA7930E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2696 7de9fbe8 - Unexpected DNS network traffic destination 21 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 279 114.114.114.114 4560 f94d217000d3cf06607e918a2146c46fa503849ebd5706ab54dde755419e7782.exe Destination IP 328 223.5.5.5 4560 f94d217000d3cf06607e918a2146c46fa503849ebd5706ab54dde755419e7782.exe Destination IP 456 223.5.5.5 4560 f94d217000d3cf06607e918a2146c46fa503849ebd5706ab54dde755419e7782.exe Destination IP 515 114.114.114.114 4560 f94d217000d3cf06607e918a2146c46fa503849ebd5706ab54dde755419e7782.exe Destination IP 111 114.114.114.114 2696 7de9fbe8 Destination IP 184 223.5.5.5 4560 f94d217000d3cf06607e918a2146c46fa503849ebd5706ab54dde755419e7782.exe Destination IP 219 223.5.5.5 4560 f94d217000d3cf06607e918a2146c46fa503849ebd5706ab54dde755419e7782.exe Destination IP 363 114.114.114.114 4560 f94d217000d3cf06607e918a2146c46fa503849ebd5706ab54dde755419e7782.exe Destination IP 394 114.114.114.114 4560 f94d217000d3cf06607e918a2146c46fa503849ebd5706ab54dde755419e7782.exe Destination IP 455 114.114.114.114 4560 f94d217000d3cf06607e918a2146c46fa503849ebd5706ab54dde755419e7782.exe Destination IP 46 114.114.114.114 4560 f94d217000d3cf06607e918a2146c46fa503849ebd5706ab54dde755419e7782.exe Destination IP 218 114.114.114.114 4560 f94d217000d3cf06607e918a2146c46fa503849ebd5706ab54dde755419e7782.exe Destination IP 326 114.114.114.114 4560 f94d217000d3cf06607e918a2146c46fa503849ebd5706ab54dde755419e7782.exe Destination IP 3 114.114.114.114 4560 f94d217000d3cf06607e918a2146c46fa503849ebd5706ab54dde755419e7782.exe Destination IP 4 223.5.5.5 4560 f94d217000d3cf06607e918a2146c46fa503849ebd5706ab54dde755419e7782.exe Destination IP 47 223.5.5.5 4560 f94d217000d3cf06607e918a2146c46fa503849ebd5706ab54dde755419e7782.exe Destination IP 112 223.5.5.5 4560 f94d217000d3cf06607e918a2146c46fa503849ebd5706ab54dde755419e7782.exe Destination IP 280 223.5.5.5 4560 f94d217000d3cf06607e918a2146c46fa503849ebd5706ab54dde755419e7782.exe Destination IP 364 223.5.5.5 4560 f94d217000d3cf06607e918a2146c46fa503849ebd5706ab54dde755419e7782.exe Destination IP 395 223.5.5.5 4560 f94d217000d3cf06607e918a2146c46fa503849ebd5706ab54dde755419e7782.exe Destination IP 179 114.114.114.114 4560 f94d217000d3cf06607e918a2146c46fa503849ebd5706ab54dde755419e7782.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 7de9fbe8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 7de9fbe8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 7de9fbe8 File created C:\Windows\SysWOW64\7de9fbe8 f94d217000d3cf06607e918a2146c46fa503849ebd5706ab54dde755419e7782.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 7de9fbe8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 7de9fbe8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 7de9fbe8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 7de9fbe8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 7de9fbe8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 7de9fbe8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 7de9fbe8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 7de9fbe8 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 7de9fbe8 -
resource yara_rule behavioral1/memory/4560-0-0x0000000000870000-0x00000000008FC000-memory.dmp upx behavioral1/files/0x00170000000242c7-2.dat upx behavioral1/memory/2696-5-0x0000000000550000-0x00000000005DC000-memory.dmp upx behavioral1/memory/4560-18-0x0000000000870000-0x00000000008FC000-memory.dmp upx behavioral1/memory/2696-19-0x0000000000550000-0x00000000005DC000-memory.dmp upx behavioral1/memory/2696-38-0x0000000000550000-0x00000000005DC000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\2e2810 7de9fbe8 File opened for modification C:\Windows\4e11a0 f94d217000d3cf06607e918a2146c46fa503849ebd5706ab54dde755419e7782.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain f94d217000d3cf06607e918a2146c46fa503849ebd5706ab54dde755419e7782.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 7de9fbe8 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 7de9fbe8 Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname f94d217000d3cf06607e918a2146c46fa503849ebd5706ab54dde755419e7782.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f94d217000d3cf06607e918a2146c46fa503849ebd5706ab54dde755419e7782.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7de9fbe8 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 7de9fbe8 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 7de9fbe8 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 7de9fbe8 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 7de9fbe8 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 7de9fbe8 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 7de9fbe8 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 7de9fbe8 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 7de9fbe8 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 7de9fbe8 - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2696 7de9fbe8 2696 7de9fbe8 2696 7de9fbe8 2696 7de9fbe8 2696 7de9fbe8 2696 7de9fbe8 2696 7de9fbe8 2696 7de9fbe8 4560 f94d217000d3cf06607e918a2146c46fa503849ebd5706ab54dde755419e7782.exe 4560 f94d217000d3cf06607e918a2146c46fa503849ebd5706ab54dde755419e7782.exe 4560 f94d217000d3cf06607e918a2146c46fa503849ebd5706ab54dde755419e7782.exe 4560 f94d217000d3cf06607e918a2146c46fa503849ebd5706ab54dde755419e7782.exe 4560 f94d217000d3cf06607e918a2146c46fa503849ebd5706ab54dde755419e7782.exe 4560 f94d217000d3cf06607e918a2146c46fa503849ebd5706ab54dde755419e7782.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4560 f94d217000d3cf06607e918a2146c46fa503849ebd5706ab54dde755419e7782.exe Token: SeTcbPrivilege 4560 f94d217000d3cf06607e918a2146c46fa503849ebd5706ab54dde755419e7782.exe Token: SeDebugPrivilege 2696 7de9fbe8 Token: SeTcbPrivilege 2696 7de9fbe8
Processes
-
C:\Users\Admin\AppData\Local\Temp\f94d217000d3cf06607e918a2146c46fa503849ebd5706ab54dde755419e7782.exe"C:\Users\Admin\AppData\Local\Temp\f94d217000d3cf06607e918a2146c46fa503849ebd5706ab54dde755419e7782.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4560
-
C:\Windows\Syswow64\7de9fbe8C:\Windows\Syswow64\7de9fbe81⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2696
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\7de9fbe8
- Size 560KB
- SHA256 5c2f40e5c4b94a6da46051b859f25f26429e58a27a42740c67d6f1da17c28d1e
- MD5 8e41c6b1fc13245f330b000b5994f449
- SHA1 7eaf985c736f5141d6ea8bf01c1fddcd07e603c1
- SHA512 2dafb5b1be3c0897ef8adf7941a8f56e31f99369b77c34c18996b6d23e75e1eca08ac175b0f6415d7d408fff8f39aa4250116c628b1b0f7384de580a96ce2e00
- SSDEEP 6144:OUJJuV1cdhIoA7vJ0CLoCgvDLe4AmFvirGcEOkCybEaQRuy8K:OYsVOdhElvkCgvDLe4usOkxHy
- TLSH T12DC48D29B6D0C036C5B39574C4A186BAEAB17432372549CFA3D5475A0F337E2BA7930E
- MD5 SHA1 SHA512 SSDEEP TLSH