cc5f663115ee706eb3de099eed4cad8a6980c379c6151726c5849d1599dcd43e

Analysis

max time kernel
149s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 21:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cc5f663115ee706eb3de099eed4cad8a6980c379c6151726c5849d1599dcd43e.exe
Size 5.1MB
Sample260808-zyfveadm91
SHA256 cc5f663115ee706eb3de099eed4cad8a6980c379c6151726c5849d1599dcd43e
MD5 ada02897616fce5050e437292ca42b7a
SHA1 4f41834cf2b46e2f117d71f89d242f18e85db5b6
SHA512 65f5a071e459ea95eb9dc929629d925a28873eb7c1ad299ee0896d7461799624e84d901c4bea947040923c08f50ce74e9e224b261484fa600abd0bd825a072cb
SSDEEP 98304:4FXhBDW7BTVm/GARem7m0vXSbzKBkHJBjk3Ymz2LF/k/WEFN5MN9Q:4D0BTsr7mwXfkbk3Ym6BM/HuNq
TLSH
T1E436339ABDD2E430C045C3BA829330BEB33EB7A188613C5A3AC97D505D96E19653DFD1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution persistence

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3264 created 1820	3264	LockAppHost14a02b.exe	80

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
3264	LockAppHost14a02b.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3264 set thread context of 1856	3264	LockAppHost14a02b.exe	96

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6116	sc.exe
4160	sc.exe
1668	sc.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4108	cc5f663115ee706eb3de099eed4cad8a6980c379c6151726c5849d1599dcd43e.exe
4108	cc5f663115ee706eb3de099eed4cad8a6980c379c6151726c5849d1599dcd43e.exe
3264	LockAppHost14a02b.exe
3264	LockAppHost14a02b.exe
3264	LockAppHost14a02b.exe
3264	LockAppHost14a02b.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4108	cc5f663115ee706eb3de099eed4cad8a6980c379c6151726c5849d1599dcd43e.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3264	LockAppHost14a02b.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4108 wrote to memory of 1668	4108	cc5f663115ee706eb3de099eed4cad8a6980c379c6151726c5849d1599dcd43e.exe	89
PID 4108 wrote to memory of 6116	4108	cc5f663115ee706eb3de099eed4cad8a6980c379c6151726c5849d1599dcd43e.exe	91
PID 4108 wrote to memory of 4160	4108	cc5f663115ee706eb3de099eed4cad8a6980c379c6151726c5849d1599dcd43e.exe	93
PID 3264 wrote to memory of 1856	3264	LockAppHost14a02b.exe	96

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:1820
- C:\Users\Admin\AppData\Local\Temp\cc5f663115ee706eb3de099eed4cad8a6980c379c6151726c5849d1599dcd43e.exe
  "C:\Users\Admin\AppData\Local\Temp\cc5f663115ee706eb3de099eed4cad8a6980c379c6151726c5849d1599dcd43e.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:4108
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" delete "MicrosoftEdgeUpdateTaskMachine_3aa5"
    3⤵
    - Launches sc.exe
    PID:1668
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" create "MicrosoftEdgeUpdateTaskMachine_3aa5" binpath= "C:\ProgramData\Microsoft\Network\Diagnostics\73BF5F50\LockAppHost14a02b.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:6116
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" start "MicrosoftEdgeUpdateTaskMachine_3aa5"
    3⤵
    - Launches sc.exe
    PID:4160
- C:\Windows\System32\nslookup.exe
  "C:\Windows\System32\nslookup.exe"
  2⤵
  PID:1856

C:\ProgramData\Microsoft\Network\Diagnostics\73BF5F50\LockAppHost14a02b.exe
C:\ProgramData\Microsoft\Network\Diagnostics\73BF5F50\LockAppHost14a02b.exe
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

LockAppHost14a02b.exe

Path C:\ProgramData\Microsoft\Network\Diagnostics\73BF5F50\LockAppHost14a02b.exe
Size 5.1MB
SHA256 cc5f663115ee706eb3de099eed4cad8a6980c379c6151726c5849d1599dcd43e
MD5 ada02897616fce5050e437292ca42b7a
SHA1 4f41834cf2b46e2f117d71f89d242f18e85db5b6
SHA512 65f5a071e459ea95eb9dc929629d925a28873eb7c1ad299ee0896d7461799624e84d901c4bea947040923c08f50ce74e9e224b261484fa600abd0bd825a072cb
SSDEEP 98304:4FXhBDW7BTVm/GARem7m0vXSbzKBkHJBjk3Ymz2LF/k/WEFN5MN9Q:4D0BTsr7mwXfkbk3Ym6BM/HuNq
TLSH
T1E436339ABDD2E430C045C3BA829330BEB33EB7A188613C5A3AC97D505D96E19653DFD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1856-18-0x0000000140000000-0x0000000140231000-memory.dmp

Download

memory/3264-24-0x0000000140000000-0x00000001408FF000-memory.dmp

Download

memory/3264-23-0x0000000140000000-0x00000001408FF000-memory.dmp

Download

memory/3264-12-0x0000000140000000-0x00000001408FF000-memory.dmp

Download

memory/4108-7-0x0000000140000000-0x00000001408FF000-memory.dmp

Download

memory/4108-9-0x0000000140000000-0x00000001408FF000-memory.dmp

Download

memory/4108-10-0x0000000140239000-0x00000001403F0000-memory.dmp

Download

memory/4108-5-0x0000000140000000-0x00000001408FF000-memory.dmp

Download

memory/4108-6-0x0000000000420000-0x0000000000421000-memory.dmp

Download

memory/4108-1-0x00007FF8DB690000-0x00007FF8DB692000-memory.dmp

Download

memory/4108-2-0x0000000140000000-0x00000001408FF000-memory.dmp

Download

memory/4108-0-0x0000000140239000-0x00000001403F0000-memory.dmp

Download