cc5f663115ee706eb3de099eed4cad8a6980c379c6151726c5849d1599dcd43e

Analysis

max time kernel
149s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 02:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cc5f663115ee706eb3de099eed4cad8a6980c379c6151726c5849d1599dcd43e.exe
Size 5.1MB
Sample260809-c1c5zaydpg
SHA256 cc5f663115ee706eb3de099eed4cad8a6980c379c6151726c5849d1599dcd43e
MD5 ada02897616fce5050e437292ca42b7a
SHA1 4f41834cf2b46e2f117d71f89d242f18e85db5b6
SHA512 65f5a071e459ea95eb9dc929629d925a28873eb7c1ad299ee0896d7461799624e84d901c4bea947040923c08f50ce74e9e224b261484fa600abd0bd825a072cb
SSDEEP 98304:4FXhBDW7BTVm/GARem7m0vXSbzKBkHJBjk3Ymz2LF/k/WEFN5MN9Q:4D0BTsr7mwXfkbk3Ym6BM/HuNq
TLSH
T1E436339ABDD2E430C045C3BA829330BEB33EB7A188613C5A3AC97D505D96E19653DFD1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution persistence

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 5472 created 3124	5472	LockAppHost14a02b.exe	81

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
5472	LockAppHost14a02b.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5472 set thread context of 3252	5472	LockAppHost14a02b.exe	96

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
728	sc.exe
3208	sc.exe
2964	sc.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3192	cc5f663115ee706eb3de099eed4cad8a6980c379c6151726c5849d1599dcd43e.exe
3192	cc5f663115ee706eb3de099eed4cad8a6980c379c6151726c5849d1599dcd43e.exe
5472	LockAppHost14a02b.exe
5472	LockAppHost14a02b.exe
5472	LockAppHost14a02b.exe
5472	LockAppHost14a02b.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3192	cc5f663115ee706eb3de099eed4cad8a6980c379c6151726c5849d1599dcd43e.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5472	LockAppHost14a02b.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3192 wrote to memory of 728	3192	cc5f663115ee706eb3de099eed4cad8a6980c379c6151726c5849d1599dcd43e.exe	89
PID 3192 wrote to memory of 2964	3192	cc5f663115ee706eb3de099eed4cad8a6980c379c6151726c5849d1599dcd43e.exe	91
PID 3192 wrote to memory of 3208	3192	cc5f663115ee706eb3de099eed4cad8a6980c379c6151726c5849d1599dcd43e.exe	93
PID 5472 wrote to memory of 3252	5472	LockAppHost14a02b.exe	96

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:3124
- C:\Users\Admin\AppData\Local\Temp\cc5f663115ee706eb3de099eed4cad8a6980c379c6151726c5849d1599dcd43e.exe
  "C:\Users\Admin\AppData\Local\Temp\cc5f663115ee706eb3de099eed4cad8a6980c379c6151726c5849d1599dcd43e.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:3192
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" delete "MicrosoftEdgeUpdateTaskMachine_3aa5"
    3⤵
    - Launches sc.exe
    PID:728
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" create "MicrosoftEdgeUpdateTaskMachine_3aa5" binpath= "C:\ProgramData\Microsoft\Network\Diagnostics\73BF5F50\LockAppHost14a02b.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:2964
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" start "MicrosoftEdgeUpdateTaskMachine_3aa5"
    3⤵
    - Launches sc.exe
    PID:3208
- C:\Windows\System32\nslookup.exe
  "C:\Windows\System32\nslookup.exe"
  2⤵
  PID:3252

C:\ProgramData\Microsoft\Network\Diagnostics\73BF5F50\LockAppHost14a02b.exe
C:\ProgramData\Microsoft\Network\Diagnostics\73BF5F50\LockAppHost14a02b.exe
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

LockAppHost14a02b.exe

Path C:\ProgramData\Microsoft\Network\Diagnostics\73BF5F50\LockAppHost14a02b.exe
Size 5.1MB
SHA256 cc5f663115ee706eb3de099eed4cad8a6980c379c6151726c5849d1599dcd43e
MD5 ada02897616fce5050e437292ca42b7a
SHA1 4f41834cf2b46e2f117d71f89d242f18e85db5b6
SHA512 65f5a071e459ea95eb9dc929629d925a28873eb7c1ad299ee0896d7461799624e84d901c4bea947040923c08f50ce74e9e224b261484fa600abd0bd825a072cb
SSDEEP 98304:4FXhBDW7BTVm/GARem7m0vXSbzKBkHJBjk3Ymz2LF/k/WEFN5MN9Q:4D0BTsr7mwXfkbk3Ym6BM/HuNq
TLSH
T1E436339ABDD2E430C045C3BA829330BEB33EB7A188613C5A3AC97D505D96E19653DFD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3192-10-0x0000000140239000-0x00000001403F0000-memory.dmp

Download

memory/3192-0-0x0000000140239000-0x00000001403F0000-memory.dmp

Download

memory/3192-6-0x0000000000560000-0x0000000000561000-memory.dmp

Download

memory/3192-2-0x0000000140000000-0x00000001408FF000-memory.dmp

Download

memory/3192-7-0x0000000140000000-0x00000001408FF000-memory.dmp

Download

memory/3192-1-0x00007FF93A590000-0x00007FF93A592000-memory.dmp

Download

memory/3192-9-0x0000000140000000-0x00000001408FF000-memory.dmp

Download

memory/3192-5-0x0000000140000000-0x00000001408FF000-memory.dmp

Download

memory/3252-18-0x0000000140000000-0x0000000140231000-memory.dmp

Download

memory/5472-12-0x0000000140000000-0x00000001408FF000-memory.dmp

Download

memory/5472-23-0x0000000140001000-0x0000000140008000-memory.dmp

Download

memory/5472-15-0x0000000140000000-0x00000001408FF000-memory.dmp

Download

memory/5472-24-0x0000000140000000-0x00000001408FF000-memory.dmp

Download

memory/5472-25-0x0000000140000000-0x00000001408FF000-memory.dmp

Download