cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6

Analysis

max time kernel
40s
max time network
24s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 20:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe
Size 2.8MB
Sample260802-y9dnrafd28
SHA256 cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6
MD5 c680a2a162aea8539f6869778ba31a6f
SHA1 2fc8f13bfcf9a46be3666b8d5bb05be28881b7ce
SHA512 05dc0954aedbb78d7d9c22cbac463352162f339d886f3284e0396bee7b31376e22a816074b7bf20e3f5fc2265f2278b04d7ae3357420b69cba9a83889646ec9d
SSDEEP 49152:fZnzZ/CI8qLg/3/0FS6lGyRJqQ8VBagUsHMsU2gQQVOvdDXnKb0jJ4uZxRP5jOKD:fJjrs/3cFnlUrhs6gQQV0dDXnKuNRJO7
TLSH
T1C9D5235CFCF302B1E437C3F75693A1AEB12D37818AE44D5B768867101D532292DBA27A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution persistence spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4572	schtasks.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
3008	cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe
3008	cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe
3008	cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe
3008	cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe
1796	SmartScreenHost27dac.exe
1796	SmartScreenHost27dac.exe
1796	SmartScreenHost27dac.exe
1796	SmartScreenHost27dac.exe
3008	cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe
3008	cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe
3008	cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe
3008	cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe
2688	powershell.exe
2688	powershell.exe
2688	powershell.exe
3008	cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe
3008	cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe
3008	cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe
3008	cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe
2688	powershell.exe
2688	powershell.exe
2688	powershell.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3008	cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2688	powershell.exe

Suspicious use of SetWindowsHookEx 49 IoCs

pid	Process
3008	cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe
3008	cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe
3008	cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe
3008	cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe
3008	cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe
3008	cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe
3008	cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe
3008	cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe
3008	cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe
3008	cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe
3008	cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe
3008	cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe
3008	cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe
3008	cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe
3008	cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe
3008	cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe
3008	cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe
3008	cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe
3008	cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe
3008	cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe
3008	cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe
3008	cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe
3008	cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe
3008	cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe
3008	cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe
3008	cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe
3008	cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe
3008	cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe
3008	cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe
3008	cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe
3008	cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe
3008	cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe
3008	cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe
3008	cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe
3008	cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe
3008	cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe
3008	cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe
3008	cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe
3008	cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe
3008	cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe
3008	cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe
3008	cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe
3008	cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe
3008	cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe
3008	cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe
3008	cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe
3008	cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe
3008	cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe
3008	cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 4572	3008	cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe	89
PID 3008 wrote to memory of 2688	3008	cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe	93

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe
"C:\Users\Admin\AppData\Local\Temp\cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /tn "DeviceMetadataRetrieval_e122" /tr "C:\Users\Admin\AppData\Roaming\MediaPlayer5FF8\SmartScreenHost27dac.exe" /sc minute /mo 1 /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4572
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell Stop-Process -Force -Id 3008; Start-Sleep -Seconds 3; Remove-Item 'C:\Users\Admin\AppData\Local\Temp\cc337416747a2edee389ac4093a1d9fef944db6475b75de39cf051d949f884b6.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2688

C:\Users\Admin\AppData\Roaming\MediaPlayer5FF8\SmartScreenHost27dac.exe
C:\Users\Admin\AppData\Roaming\MediaPlayer5FF8\SmartScreenHost27dac.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1796