Analysis
- max time kernel
149s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/05/2026, 16:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f6279114d880d396ab810cbdd2632cdc43a4dfe63c90bcffc4e032c5cf3a7ef7.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
f6279114d880d396ab810cbdd2632cdc43a4dfe63c90bcffc4e032c5cf3a7ef7.exe
Resource
win11-20260130-en
windows11-21h2-x64
6 signatures
150 seconds
General
- Target f6279114d880d396ab810cbdd2632cdc43a4dfe63c90bcffc4e032c5cf3a7ef7.exe
- Size 3.1MB
- Sample260509-vf7sysd17k
- SHA256 f6279114d880d396ab810cbdd2632cdc43a4dfe63c90bcffc4e032c5cf3a7ef7
- MD5 c68cc8dd5ce8360e9d60529d4f1bb52a
- SHA1 0e651a657b69b5005a8c29854eab84ff67e1fcc5
- SHA512 aa8bfe6f12f9890d06d6f36d06195d8733a9cc3d4ffd04101eb79b820699e12e921c30fbac443881934cb584369e74e65331d3d890cb567de664ec6431993f27
- SSDEEP 49152:lYu3nGYq9SGjQEQrZboYE2sS9Uoxs8W7qko8Q5Pfsjytmi5kOnBamDPEwy8NhmEX:72Yq9SOLUoDSKlnmNejg+yTLEwbh
- TLSH T1F9E5E032B580C07BD2A35134D6AC6B67587C7F787BA081C7A3E82C5D6AE45D39235B23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 16 ip-api.com - Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1672 sc.exe 656 sc.exe 704 sc.exe 5008 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 13 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f6279114d880d396ab810cbdd2632cdc43a4dfe63c90bcffc4e032c5cf3a7ef7.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3744 wmic.exe Token: SeSecurityPrivilege 3744 wmic.exe Token: SeTakeOwnershipPrivilege 3744 wmic.exe Token: SeLoadDriverPrivilege 3744 wmic.exe Token: SeSystemProfilePrivilege 3744 wmic.exe Token: SeSystemtimePrivilege 3744 wmic.exe Token: SeProfSingleProcessPrivilege 3744 wmic.exe Token: SeIncBasePriorityPrivilege 3744 wmic.exe Token: SeCreatePagefilePrivilege 3744 wmic.exe Token: SeBackupPrivilege 3744 wmic.exe Token: SeRestorePrivilege 3744 wmic.exe Token: SeShutdownPrivilege 3744 wmic.exe Token: SeDebugPrivilege 3744 wmic.exe Token: SeSystemEnvironmentPrivilege 3744 wmic.exe Token: SeRemoteShutdownPrivilege 3744 wmic.exe Token: SeUndockPrivilege 3744 wmic.exe Token: SeManageVolumePrivilege 3744 wmic.exe Token: 33 3744 wmic.exe Token: 34 3744 wmic.exe Token: 35 3744 wmic.exe Token: 36 3744 wmic.exe Token: SeIncreaseQuotaPrivilege 3744 wmic.exe Token: SeSecurityPrivilege 3744 wmic.exe Token: SeTakeOwnershipPrivilege 3744 wmic.exe Token: SeLoadDriverPrivilege 3744 wmic.exe Token: SeSystemProfilePrivilege 3744 wmic.exe Token: SeSystemtimePrivilege 3744 wmic.exe Token: SeProfSingleProcessPrivilege 3744 wmic.exe Token: SeIncBasePriorityPrivilege 3744 wmic.exe Token: SeCreatePagefilePrivilege 3744 wmic.exe Token: SeBackupPrivilege 3744 wmic.exe Token: SeRestorePrivilege 3744 wmic.exe Token: SeShutdownPrivilege 3744 wmic.exe Token: SeDebugPrivilege 3744 wmic.exe Token: SeSystemEnvironmentPrivilege 3744 wmic.exe Token: SeRemoteShutdownPrivilege 3744 wmic.exe Token: SeUndockPrivilege 3744 wmic.exe Token: SeManageVolumePrivilege 3744 wmic.exe Token: 33 3744 wmic.exe Token: 34 3744 wmic.exe Token: 35 3744 wmic.exe Token: 36 3744 wmic.exe Token: SeIncreaseQuotaPrivilege 1460 wmic.exe Token: SeSecurityPrivilege 1460 wmic.exe Token: SeTakeOwnershipPrivilege 1460 wmic.exe Token: SeLoadDriverPrivilege 1460 wmic.exe Token: SeSystemProfilePrivilege 1460 wmic.exe Token: SeSystemtimePrivilege 1460 wmic.exe Token: SeProfSingleProcessPrivilege 1460 wmic.exe Token: SeIncBasePriorityPrivilege 1460 wmic.exe Token: SeCreatePagefilePrivilege 1460 wmic.exe Token: SeBackupPrivilege 1460 wmic.exe Token: SeRestorePrivilege 1460 wmic.exe Token: SeShutdownPrivilege 1460 wmic.exe Token: SeDebugPrivilege 1460 wmic.exe Token: SeSystemEnvironmentPrivilege 1460 wmic.exe Token: SeRemoteShutdownPrivilege 1460 wmic.exe Token: SeUndockPrivilege 1460 wmic.exe Token: SeManageVolumePrivilege 1460 wmic.exe Token: 33 1460 wmic.exe Token: 34 1460 wmic.exe Token: 35 1460 wmic.exe Token: 36 1460 wmic.exe Token: SeIncreaseQuotaPrivilege 1460 wmic.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4332 wrote to memory of 4836 4332 f6279114d880d396ab810cbdd2632cdc43a4dfe63c90bcffc4e032c5cf3a7ef7.exe 85 PID 4836 wrote to memory of 1672 4836 cmd.exe 87 PID 4332 wrote to memory of 3744 4332 f6279114d880d396ab810cbdd2632cdc43a4dfe63c90bcffc4e032c5cf3a7ef7.exe 88 PID 4332 wrote to memory of 384 4332 f6279114d880d396ab810cbdd2632cdc43a4dfe63c90bcffc4e032c5cf3a7ef7.exe 92 PID 384 wrote to memory of 656 384 cmd.exe 94 PID 4332 wrote to memory of 1460 4332 f6279114d880d396ab810cbdd2632cdc43a4dfe63c90bcffc4e032c5cf3a7ef7.exe 95 PID 4332 wrote to memory of 4164 4332 f6279114d880d396ab810cbdd2632cdc43a4dfe63c90bcffc4e032c5cf3a7ef7.exe 99 PID 4164 wrote to memory of 704 4164 cmd.exe 101 PID 4332 wrote to memory of 1724 4332 f6279114d880d396ab810cbdd2632cdc43a4dfe63c90bcffc4e032c5cf3a7ef7.exe 102 PID 4332 wrote to memory of 2444 4332 f6279114d880d396ab810cbdd2632cdc43a4dfe63c90bcffc4e032c5cf3a7ef7.exe 107 PID 2444 wrote to memory of 5008 2444 cmd.exe 109 PID 4332 wrote to memory of 3588 4332 f6279114d880d396ab810cbdd2632cdc43a4dfe63c90bcffc4e032c5cf3a7ef7.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\f6279114d880d396ab810cbdd2632cdc43a4dfe63c90bcffc4e032c5cf3a7ef7.exe"C:\Users\Admin\AppData\Local\Temp\f6279114d880d396ab810cbdd2632cdc43a4dfe63c90bcffc4e032c5cf3a7ef7.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C sc start winmgmt2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Windows\SysWOW64\sc.exesc start winmgmt3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1672
-
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic BaseBoard get SerialNumber2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3744
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C sc start winmgmt2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:384 -
C:\Windows\SysWOW64\sc.exesc start winmgmt3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:656
-
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic BaseBoard get SerialNumber2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1460
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C sc start winmgmt2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Windows\SysWOW64\sc.exesc start winmgmt3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:704
-
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic BaseBoard get SerialNumber2⤵
- System Location Discovery: System Language Discovery
PID:1724
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C sc start winmgmt2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Windows\SysWOW64\sc.exesc start winmgmt3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:5008
-
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic BaseBoard get SerialNumber2⤵
- System Location Discovery: System Language Discovery
PID:3588
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\cloud
- Size 135B
- SHA256 be7a52d6d1b2e5e2c7a9e338f3ab71b4b2e76797f19cc06d5899aece2701365b
- MD5 fc31b34eb1f36e5ff23be7f4621aa04e
- SHA1 cef8d9c3577f04c9e102f942ee9bbe98dec50df5
- SHA512 c5289e754453876b9646124952850f27325af5345c7522b9478a51c794277d5d0fa55cc105cbcab4dd72a2f76b107b97cea49a0296512c086412ddeb92441a65
- TLSH T14CC02BAF30C7901B0360C3503AC0156B8581810D4B4CD101A0862C2E438C154644C5CA
- MD5 SHA1 SHA512 TLSH