Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/10/2026, 06:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
67e7286517934f31ad769426d6e0c2791019e6d1bdc5477179c861ba41571a65.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
67e7286517934f31ad769426d6e0c2791019e6d1bdc5477179c861ba41571a65.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 67e7286517934f31ad769426d6e0c2791019e6d1bdc5477179c861ba41571a65.exe
- Size 896KB
- Sample261017-gxe8daxyfy
- SHA256 67e7286517934f31ad769426d6e0c2791019e6d1bdc5477179c861ba41571a65
- MD5 9bda83b11a80773699ef66110ff921f9
- SHA1 3e0d389a363badefd831a24cebaee1e75f596df1
- SHA512 21cd09bfb40550fa7a0b4fc2ce08aba5705217317688e3a8d0be13356523ab8e873f70f5e2271c80cf59e6d25d30f253b6210c487760debefc8160c68dbc110a
- SSDEEP 12288:4SvO2x9mONvKRILSFnOkx2LIaxya5FAQjU/Lik8CQ3uEuYyybAsLAk1:TvO2xJKRI2FOkx2LFEvcUQPxu6Es8k1
- TLSH T10D157C31E641C03AD4A7457686BA0BBFA5787D22131565C7E3D43E662FB32D2BA3130E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4448 561886bd - Unexpected DNS network traffic destination 22 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 181 223.5.5.5 1004 67e7286517934f31ad769426d6e0c2791019e6d1bdc5477179c861ba41571a65.exe Destination IP 235 223.5.5.5 1004 67e7286517934f31ad769426d6e0c2791019e6d1bdc5477179c861ba41571a65.exe Destination IP 288 114.114.114.114 1004 67e7286517934f31ad769426d6e0c2791019e6d1bdc5477179c861ba41571a65.exe Destination IP 334 114.114.114.114 1004 67e7286517934f31ad769426d6e0c2791019e6d1bdc5477179c861ba41571a65.exe Destination IP 388 114.114.114.114 1004 67e7286517934f31ad769426d6e0c2791019e6d1bdc5477179c861ba41571a65.exe Destination IP 6 223.5.5.5 1004 67e7286517934f31ad769426d6e0c2791019e6d1bdc5477179c861ba41571a65.exe Destination IP 93 114.114.114.114 4448 561886bd Destination IP 94 223.5.5.5 1004 67e7286517934f31ad769426d6e0c2791019e6d1bdc5477179c861ba41571a65.exe Destination IP 148 114.114.114.114 1004 67e7286517934f31ad769426d6e0c2791019e6d1bdc5477179c861ba41571a65.exe Destination IP 234 114.114.114.114 1004 67e7286517934f31ad769426d6e0c2791019e6d1bdc5477179c861ba41571a65.exe Destination IP 303 223.5.5.5 1004 67e7286517934f31ad769426d6e0c2791019e6d1bdc5477179c861ba41571a65.exe Destination IP 335 223.5.5.5 1004 67e7286517934f31ad769426d6e0c2791019e6d1bdc5477179c861ba41571a65.exe Destination IP 442 114.114.114.114 1004 67e7286517934f31ad769426d6e0c2791019e6d1bdc5477179c861ba41571a65.exe Destination IP 4 114.114.114.114 1004 67e7286517934f31ad769426d6e0c2791019e6d1bdc5477179c861ba41571a65.exe Destination IP 39 114.114.114.114 1004 67e7286517934f31ad769426d6e0c2791019e6d1bdc5477179c861ba41571a65.exe Destination IP 180 114.114.114.114 1004 67e7286517934f31ad769426d6e0c2791019e6d1bdc5477179c861ba41571a65.exe Destination IP 289 223.5.5.5 1004 67e7286517934f31ad769426d6e0c2791019e6d1bdc5477179c861ba41571a65.exe Destination IP 302 114.114.114.114 1004 67e7286517934f31ad769426d6e0c2791019e6d1bdc5477179c861ba41571a65.exe Destination IP 389 223.5.5.5 1004 67e7286517934f31ad769426d6e0c2791019e6d1bdc5477179c861ba41571a65.exe Destination IP 443 223.5.5.5 1004 67e7286517934f31ad769426d6e0c2791019e6d1bdc5477179c861ba41571a65.exe Destination IP 40 223.5.5.5 1004 67e7286517934f31ad769426d6e0c2791019e6d1bdc5477179c861ba41571a65.exe Destination IP 149 223.5.5.5 1004 67e7286517934f31ad769426d6e0c2791019e6d1bdc5477179c861ba41571a65.exe - Drops file in System32 directory 13 IoCs
description ioc Process File created C:\Windows\SysWOW64\561886bd 67e7286517934f31ad769426d6e0c2791019e6d1bdc5477179c861ba41571a65.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 561886bd File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 561886bd File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 561886bd File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 561886bd File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 561886bd File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 561886bd File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 561886bd File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 561886bd File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 561886bd File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 561886bd File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 561886bd File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 561886bd - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\4c26c0 561886bd File opened for modification C:\Windows\113058 67e7286517934f31ad769426d6e0c2791019e6d1bdc5477179c861ba41571a65.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 561886bd Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 67e7286517934f31ad769426d6e0c2791019e6d1bdc5477179c861ba41571a65.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 67e7286517934f31ad769426d6e0c2791019e6d1bdc5477179c861ba41571a65.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 561886bd - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 561886bd Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 67e7286517934f31ad769426d6e0c2791019e6d1bdc5477179c861ba41571a65.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 561886bd Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 561886bd Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 561886bd Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 561886bd Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 561886bd Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 561886bd Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 561886bd Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 561886bd Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 561886bd - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 4448 561886bd 4448 561886bd 4448 561886bd 4448 561886bd 4448 561886bd 4448 561886bd 4448 561886bd 4448 561886bd 1004 67e7286517934f31ad769426d6e0c2791019e6d1bdc5477179c861ba41571a65.exe 1004 67e7286517934f31ad769426d6e0c2791019e6d1bdc5477179c861ba41571a65.exe 1004 67e7286517934f31ad769426d6e0c2791019e6d1bdc5477179c861ba41571a65.exe 1004 67e7286517934f31ad769426d6e0c2791019e6d1bdc5477179c861ba41571a65.exe 1004 67e7286517934f31ad769426d6e0c2791019e6d1bdc5477179c861ba41571a65.exe 1004 67e7286517934f31ad769426d6e0c2791019e6d1bdc5477179c861ba41571a65.exe 1004 67e7286517934f31ad769426d6e0c2791019e6d1bdc5477179c861ba41571a65.exe 1004 67e7286517934f31ad769426d6e0c2791019e6d1bdc5477179c861ba41571a65.exe 1004 67e7286517934f31ad769426d6e0c2791019e6d1bdc5477179c861ba41571a65.exe 1004 67e7286517934f31ad769426d6e0c2791019e6d1bdc5477179c861ba41571a65.exe 1004 67e7286517934f31ad769426d6e0c2791019e6d1bdc5477179c861ba41571a65.exe 1004 67e7286517934f31ad769426d6e0c2791019e6d1bdc5477179c861ba41571a65.exe 1004 67e7286517934f31ad769426d6e0c2791019e6d1bdc5477179c861ba41571a65.exe 1004 67e7286517934f31ad769426d6e0c2791019e6d1bdc5477179c861ba41571a65.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1004 67e7286517934f31ad769426d6e0c2791019e6d1bdc5477179c861ba41571a65.exe Token: SeTcbPrivilege 1004 67e7286517934f31ad769426d6e0c2791019e6d1bdc5477179c861ba41571a65.exe Token: SeDebugPrivilege 4448 561886bd Token: SeTcbPrivilege 4448 561886bd
Processes
-
C:\Users\Admin\AppData\Local\Temp\67e7286517934f31ad769426d6e0c2791019e6d1bdc5477179c861ba41571a65.exe"C:\Users\Admin\AppData\Local\Temp\67e7286517934f31ad769426d6e0c2791019e6d1bdc5477179c861ba41571a65.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1004
-
C:\Windows\Syswow64\561886bdC:\Windows\Syswow64\561886bd1⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4448
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\561886bd
- Size 896KB
- SHA256 b524d4d277e03abd545db6e2782053d8c8a64ff62cba1fb54df8239dddc1b4bf
- MD5 1bf016eb48c2fa382256b8773e51dc9b
- SHA1 cb0e5ad6116a1b3f8c045cf65a220bc25abc46eb
- SHA512 eaddeb0ec3d6a41f3f1d4a087be712be30347193ab39015d996ed79fe079ba4af6b7439b66f4c2fe66c2bac8a30e202cba4ae04dcf339d437995a8ba9b51774d
- SSDEEP 12288:3SvO2x9mONvKRILSFnOkx2LIaxya5FAQjU/Lik8CQ3uEuYyybAsLAk1:CvO2xJKRI2FOkx2LFEvcUQPxu6Es8k1
- TLSH T1B6157C31E641C03AD4A7457686BA0BBFA5787D22131565C7E3D43E662FB32D2BA3130E
- MD5 SHA1 SHA512 SSDEEP TLSH