Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
09/05/2026, 16:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f6279114d880d396ab810cbdd2632cdc43a4dfe63c90bcffc4e032c5cf3a7ef7.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
f6279114d880d396ab810cbdd2632cdc43a4dfe63c90bcffc4e032c5cf3a7ef7.exe
Resource
win11-20260130-en
windows11-21h2-x64
6 signatures
150 seconds
General
- Target f6279114d880d396ab810cbdd2632cdc43a4dfe63c90bcffc4e032c5cf3a7ef7.exe
- Size 3.1MB
- Sample260509-vf7sysd17k
- SHA256 f6279114d880d396ab810cbdd2632cdc43a4dfe63c90bcffc4e032c5cf3a7ef7
- MD5 c68cc8dd5ce8360e9d60529d4f1bb52a
- SHA1 0e651a657b69b5005a8c29854eab84ff67e1fcc5
- SHA512 aa8bfe6f12f9890d06d6f36d06195d8733a9cc3d4ffd04101eb79b820699e12e921c30fbac443881934cb584369e74e65331d3d890cb567de664ec6431993f27
- SSDEEP 49152:lYu3nGYq9SGjQEQrZboYE2sS9Uoxs8W7qko8Q5Pfsjytmi5kOnBamDPEwy8NhmEX:72Yq9SOLUoDSKlnmNejg+yTLEwbh
- TLSH T1F9E5E032B580C07BD2A35134D6AC6B67587C7F787BA081C7A3E82C5D6AE45D39235B23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 5 ip-api.com - Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4768 sc.exe 936 sc.exe 1000 sc.exe 2568 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 13 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f6279114d880d396ab810cbdd2632cdc43a4dfe63c90bcffc4e032c5cf3a7ef7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1012 wmic.exe Token: SeSecurityPrivilege 1012 wmic.exe Token: SeTakeOwnershipPrivilege 1012 wmic.exe Token: SeLoadDriverPrivilege 1012 wmic.exe Token: SeSystemProfilePrivilege 1012 wmic.exe Token: SeSystemtimePrivilege 1012 wmic.exe Token: SeProfSingleProcessPrivilege 1012 wmic.exe Token: SeIncBasePriorityPrivilege 1012 wmic.exe Token: SeCreatePagefilePrivilege 1012 wmic.exe Token: SeBackupPrivilege 1012 wmic.exe Token: SeRestorePrivilege 1012 wmic.exe Token: SeShutdownPrivilege 1012 wmic.exe Token: SeDebugPrivilege 1012 wmic.exe Token: SeSystemEnvironmentPrivilege 1012 wmic.exe Token: SeRemoteShutdownPrivilege 1012 wmic.exe Token: SeUndockPrivilege 1012 wmic.exe Token: SeManageVolumePrivilege 1012 wmic.exe Token: 33 1012 wmic.exe Token: 34 1012 wmic.exe Token: 35 1012 wmic.exe Token: 36 1012 wmic.exe Token: SeIncreaseQuotaPrivilege 1012 wmic.exe Token: SeSecurityPrivilege 1012 wmic.exe Token: SeTakeOwnershipPrivilege 1012 wmic.exe Token: SeLoadDriverPrivilege 1012 wmic.exe Token: SeSystemProfilePrivilege 1012 wmic.exe Token: SeSystemtimePrivilege 1012 wmic.exe Token: SeProfSingleProcessPrivilege 1012 wmic.exe Token: SeIncBasePriorityPrivilege 1012 wmic.exe Token: SeCreatePagefilePrivilege 1012 wmic.exe Token: SeBackupPrivilege 1012 wmic.exe Token: SeRestorePrivilege 1012 wmic.exe Token: SeShutdownPrivilege 1012 wmic.exe Token: SeDebugPrivilege 1012 wmic.exe Token: SeSystemEnvironmentPrivilege 1012 wmic.exe Token: SeRemoteShutdownPrivilege 1012 wmic.exe Token: SeUndockPrivilege 1012 wmic.exe Token: SeManageVolumePrivilege 1012 wmic.exe Token: 33 1012 wmic.exe Token: 34 1012 wmic.exe Token: 35 1012 wmic.exe Token: 36 1012 wmic.exe Token: SeIncreaseQuotaPrivilege 4560 wmic.exe Token: SeSecurityPrivilege 4560 wmic.exe Token: SeTakeOwnershipPrivilege 4560 wmic.exe Token: SeLoadDriverPrivilege 4560 wmic.exe Token: SeSystemProfilePrivilege 4560 wmic.exe Token: SeSystemtimePrivilege 4560 wmic.exe Token: SeProfSingleProcessPrivilege 4560 wmic.exe Token: SeIncBasePriorityPrivilege 4560 wmic.exe Token: SeCreatePagefilePrivilege 4560 wmic.exe Token: SeBackupPrivilege 4560 wmic.exe Token: SeRestorePrivilege 4560 wmic.exe Token: SeShutdownPrivilege 4560 wmic.exe Token: SeDebugPrivilege 4560 wmic.exe Token: SeSystemEnvironmentPrivilege 4560 wmic.exe Token: SeRemoteShutdownPrivilege 4560 wmic.exe Token: SeUndockPrivilege 4560 wmic.exe Token: SeManageVolumePrivilege 4560 wmic.exe Token: 33 4560 wmic.exe Token: 34 4560 wmic.exe Token: 35 4560 wmic.exe Token: 36 4560 wmic.exe Token: SeIncreaseQuotaPrivilege 4560 wmic.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4724 wrote to memory of 1084 4724 f6279114d880d396ab810cbdd2632cdc43a4dfe63c90bcffc4e032c5cf3a7ef7.exe 79 PID 1084 wrote to memory of 4768 1084 cmd.exe 81 PID 4724 wrote to memory of 1012 4724 f6279114d880d396ab810cbdd2632cdc43a4dfe63c90bcffc4e032c5cf3a7ef7.exe 82 PID 4724 wrote to memory of 1728 4724 f6279114d880d396ab810cbdd2632cdc43a4dfe63c90bcffc4e032c5cf3a7ef7.exe 85 PID 1728 wrote to memory of 936 1728 cmd.exe 87 PID 4724 wrote to memory of 4560 4724 f6279114d880d396ab810cbdd2632cdc43a4dfe63c90bcffc4e032c5cf3a7ef7.exe 88 PID 4724 wrote to memory of 996 4724 f6279114d880d396ab810cbdd2632cdc43a4dfe63c90bcffc4e032c5cf3a7ef7.exe 90 PID 996 wrote to memory of 1000 996 cmd.exe 92 PID 4724 wrote to memory of 4728 4724 f6279114d880d396ab810cbdd2632cdc43a4dfe63c90bcffc4e032c5cf3a7ef7.exe 93 PID 4724 wrote to memory of 2512 4724 f6279114d880d396ab810cbdd2632cdc43a4dfe63c90bcffc4e032c5cf3a7ef7.exe 95 PID 2512 wrote to memory of 2568 2512 cmd.exe 97 PID 4724 wrote to memory of 1612 4724 f6279114d880d396ab810cbdd2632cdc43a4dfe63c90bcffc4e032c5cf3a7ef7.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\f6279114d880d396ab810cbdd2632cdc43a4dfe63c90bcffc4e032c5cf3a7ef7.exe"C:\Users\Admin\AppData\Local\Temp\f6279114d880d396ab810cbdd2632cdc43a4dfe63c90bcffc4e032c5cf3a7ef7.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C sc start winmgmt2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Windows\SysWOW64\sc.exesc start winmgmt3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:4768
-
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic BaseBoard get SerialNumber2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1012
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C sc start winmgmt2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Windows\SysWOW64\sc.exesc start winmgmt3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:936
-
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic BaseBoard get SerialNumber2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4560
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C sc start winmgmt2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Windows\SysWOW64\sc.exesc start winmgmt3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1000
-
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic BaseBoard get SerialNumber2⤵
- System Location Discovery: System Language Discovery
PID:4728
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C sc start winmgmt2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Windows\SysWOW64\sc.exesc start winmgmt3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2568
-
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic BaseBoard get SerialNumber2⤵
- System Location Discovery: System Language Discovery
PID:1612
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\cloud.f1d9ce13.tmp
- Size 135B
- SHA256 be7a52d6d1b2e5e2c7a9e338f3ab71b4b2e76797f19cc06d5899aece2701365b
- MD5 fc31b34eb1f36e5ff23be7f4621aa04e
- SHA1 cef8d9c3577f04c9e102f942ee9bbe98dec50df5
- SHA512 c5289e754453876b9646124952850f27325af5345c7522b9478a51c794277d5d0fa55cc105cbcab4dd72a2f76b107b97cea49a0296512c086412ddeb92441a65
- TLSH T14CC02BAF30C7901B0360C3503AC0156B8581810D4B4CD101A0862C2E438C154644C5CA
- MD5 SHA1 SHA512 TLSH