Analysis
- max time kernel
150s - max time network
160s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/07/2026, 16:21
Behavioral task
behavioral1
Sample
72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe
- Size 3.2MB
- Sample260707-tt2cnaas7p
- SHA256 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222
- MD5 f10eaa31445a1e2a717d2d0288d2f603
- SHA1 e52b7b185e3cc80a8d77b78577ea933762d31e6f
- SHA512 25892b34613590c8a6a3efafb14aa3b84e8e87f1a111a59ccc32e2667904a5d7ee694febc602225508f70ab1e4c3fbbee5e3c22ceed8340a0b910d83f0d5a8d4
- SSDEEP 49152:KA3u/YXMUjnoFm5+Mp1DOXQPiUNGvqSB6H0/je8zBJkQZkS68Pio5:TNnogPPxH0/je8zBJk6
- TLSH T14AF58D46E7A800B8D0B7C178CA569A17E7727805137197DF07E08A6A6F23BE15F3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 1 raw.githubusercontent.com 4 raw.githubusercontent.com - Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 ip-api.com - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5512 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe 5512 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe 5512 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe 5512 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe 5512 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe 5512 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe 5512 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe 5512 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe 5512 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe 5512 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe 5512 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe 5512 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe 5512 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe 5512 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe 5512 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe 5512 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe 5512 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe 5512 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe 5512 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe 5512 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe 5512 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe 5512 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe 5512 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe 5512 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe 5512 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe 5512 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe 5512 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe 5512 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe 5512 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe 5512 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe 5512 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe 5512 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe 5512 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe 5512 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe 5512 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe 5512 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe 5512 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe 5512 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe 5512 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe 5512 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe 5512 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe 5512 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe 5512 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe 5512 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe 5512 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe 5512 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe 5512 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe 5512 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe 5512 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe 5512 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe 5512 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe 5512 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe 5512 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe 5512 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe 5512 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe 5512 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe 5512 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe 5512 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe 5512 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe 5512 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe 5512 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe 5512 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe 5512 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe 5512 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 5512 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe Token: SeShutdownPrivilege 5512 72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe"C:\Users\Admin\AppData\Local\Temp\72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5512
-
C:\Users\Admin\AppData\Local\Temp\72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exeC:\Users\Admin\AppData\Local\Temp\72aae2ca881c89fcb3f8170674d12ec2f12fad88fdbc66fa438b0d696a40b222.exe1⤵PID:3260