Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
22/09/2026, 09:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe
- Size 4.4MB
- Sample260922-lnhdlashqd
- SHA256 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da
- MD5 498b2e9f04e92682aea59888ddccdcb1
- SHA1 909968f94cac6fe2b729fb9bcbe423a3d983dac0
- SHA512 044e5e1cecd2e040f5d6e4837b71a949385d3da453989c2d4281b45eebdbf5c7fff613abac3cd575253bbd0d3914a99be64d6ff6b6ed12b8bbd6e712e21bdaaf
- SSDEEP 49152:ZsX86bhPHHFJiAQ3v1TonH2neZ5bkU5a50Lhe+jJLRUg37+uhOqNJvJdcEcEEI2I:Z+JiAC1snH2neZ5QR50YwNSdZwt7Tzl
- TLSH T19426AE46A2A640EDD167C038C62B9A13E6753C2D03905EFB57D096616FA3BE07E7F312
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
pid Process 1816 AppSyncCore.exe 5060 AppSyncCore.exe 536 AppSyncCore.exe - Looks up external IP address via web service 1 TTPs 13 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 92 icanhazip.com 93 icanhazip.com 94 ip-api.com 30 checkip.amazonaws.com 60 api.ipify.org 80 ipinfo.io 105 checkip.amazonaws.com 109 ipinfo.io 111 icanhazip.com 32 checkip.amazonaws.com 59 api.ipify.org 77 api.ipify.org 79 ipinfo.io - Drops file in System32 directory 16 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D00881249E8ACE3C38D6E432A97CAF57 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\620BEF1064BD8E252C599957B3C91896 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D03E46CD585BBE111C712E6577BC5F07_D57CE96919754E8BF5FC12F0FA7A1698 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\361E212AA93B78D50715CB8707DAC000 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\620BEF1064BD8E252C599957B3C91896 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\361E212AA93B78D50715CB8707DAC000 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D00881249E8ACE3C38D6E432A97CAF57 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D03E46CD585BBE111C712E6577BC5F07_D57CE96919754E8BF5FC12F0FA7A1698 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AppSyncCore.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AppSyncCore.exe - Modifies data under HKEY_USERS 18 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" AppSyncCore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing AppSyncCore.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" AppSyncCore.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix AppSyncCore.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" AppSyncCore.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" AppSyncCore.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" AppSyncCore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ AppSyncCore.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" AppSyncCore.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 1148 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe 1148 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe 1148 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe 1148 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe 1148 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe 1148 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe 1148 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe 1148 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe 1148 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe 1148 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe 1148 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe 1148 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe 1148 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe 1148 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe 1148 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe 1148 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe 1148 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe 1148 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe 1148 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe 1148 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe 5060 AppSyncCore.exe 5060 AppSyncCore.exe 5060 AppSyncCore.exe 5060 AppSyncCore.exe 5060 AppSyncCore.exe 5060 AppSyncCore.exe 5060 AppSyncCore.exe 5060 AppSyncCore.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 3016 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe Token: SeIncreaseQuotaPrivilege 3016 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe Token: SeAssignPrimaryTokenPrivilege 3016 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe Token: SeDebugPrivilege 536 AppSyncCore.exe Token: SeIncreaseQuotaPrivilege 536 AppSyncCore.exe Token: SeAssignPrimaryTokenPrivilege 536 AppSyncCore.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1148 wrote to memory of 3016 1148 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe 98 PID 5060 wrote to memory of 536 5060 AppSyncCore.exe 111 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe"C:\Users\Admin\AppData\Local\Temp\486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe"1⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exeC:\Users\Admin\AppData\Local\Temp\486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe"C:\Users\Admin\AppData\Local\Temp\486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe" -agent2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3016
-
-
C:\ProgramData\AppRuntime\AppSyncCore.exeC:\ProgramData\AppRuntime\AppSyncCore.exe1⤵
- Executes dropped EXE
PID:1816
-
C:\ProgramData\AppRuntime\AppSyncCore.exeC:\ProgramData\AppRuntime\AppSyncCore.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\ProgramData\AppRuntime\AppSyncCore.exe"C:\ProgramData\AppRuntime\AppSyncCore.exe" -agent2⤵
- Executes dropped EXE
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:536
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\AppRuntime\AppSyncCore.exe
- Size 4.4MB
- SHA256 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da
- MD5 498b2e9f04e92682aea59888ddccdcb1
- SHA1 909968f94cac6fe2b729fb9bcbe423a3d983dac0
- SHA512 044e5e1cecd2e040f5d6e4837b71a949385d3da453989c2d4281b45eebdbf5c7fff613abac3cd575253bbd0d3914a99be64d6ff6b6ed12b8bbd6e712e21bdaaf
- SSDEEP 49152:ZsX86bhPHHFJiAQ3v1TonH2neZ5bkU5a50Lhe+jJLRUg37+uhOqNJvJdcEcEEI2I:Z+JiAC1snH2neZ5QR50YwNSdZwt7Tzl
- TLSH T19426AE46A2A640EDD167C038C62B9A13E6753C2D03905EFB57D096616FA3BE07E7F312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
- Size 1KB
- SHA256 6f7bfa4789bd506ccf81640feec036bac7c0354084ca472f55a79ce53b9c3ade
- MD5 b15dfb1600ace7f0c686862d26b733ad
- SHA1 3bfa41f3ea756f0377dbc2900736ca74c8d42702
- SHA512 3d261c2965f608b6af5490e10522db148140bb73a1332a132742db0d4c78783c93273c594e2465011a2062a043e0027281f6062f90aff584fc603162bd1d79fd
- TLSH T1A831B04EA2053023DA49BF72D8CE7E83CDB0374BABCAD45B19445E4229AAFC25FC40C5
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
- Size 528B
- SHA256 d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c
- MD5 047f3e9d21d6b325d592b1959e4362e6
- SHA1 5aeef5f985171cd69da397fd039854e44ebecdd2
- SHA512 4523896ed4a03afafd2075d8c8947236d34fe1da2c246a3f90c2be2a5c151c18bc58a6cde5a209abb8e06e80f662e24d0149640b3e98e8a872bfa8a04ef592a4
- TLSH T147F0500990082252C855FF55DFD6AC97DC76336136E595036D458E410C12F96AF950F5
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D00881249E8ACE3C38D6E432A97CAF57
- Size 308B
- SHA256 9b802710615d95070cd57e5dfda9f9b5f174d907f0e093746a56e6ebb36711af
- MD5 f577852ff4fc8a92338cba1122ebc7ae
- SHA1 c93adfe47d18e9d9c617484200b711c14ee0e4d4
- SHA512 b905949f182590cbddefa7797efb55a9210c15c1a8848c01fe43dfff528687845d24e2b62d61160c3d5343b404447132b44727dfeabfd50e8b1cbecca2c1b81d
- TLSH T1BFE07DC0536A17614760E404D483EA9F0CFC86C6134EB824A114C77600D3785D6401C9
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
- Size 174B
- SHA256 850ad40e1bee5cfe9f64968e3528053ff6c8d4b74ad877d8069d534dce525e52
- MD5 c842b7217fe8a66f439c642d11acf1e5
- SHA1 c3a64c7c0e3d7235c494f8b5884eb4e2c84a1727
- SHA512 b39986f011d3fdfaa793a76349877078350fa71a4e714f8b5f10155b765e29a4eff78e66b2dc274cdd3c6a1b77232e12ed9664776463f55b65fe23bf017bb927
- TLSH T11BC02B483330036CF0301D3F445287C04FFEC204DC4283B00F301108801CA020CB5C07
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
- Size 170B
- SHA256 1ee8521f5f255f6141e78f3654b970a4e8af88998c1423d7eccb1a80795cbf14
- MD5 ced627a0ab0bc387524b83c5888b6c0d
- SHA1 02f6522735040b2d8e706542a44fe6591f284719
- SHA512 d9ed99eb8716f64803f7e904a63b14fe453912d1f07ca0577309ff3d841e6918d9fa78adc2688a66fcac32998e58a7d61f05bc53e1cf9812848fc55a8c54a03d
- TLSH T178C09B14B3654715F11D553D79D5171417B54505F5C6C3144B7411358518E440872D09
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D00881249E8ACE3C38D6E432A97CAF57
- Size 192B
- SHA256 e074f479e72c40fb2349257355be2a9cf9073f29db82b96bf697203cef688cac
- MD5 468017b7d4e0bb89234202f1272388f6
- SHA1 ea7f58f28d23206a0b48b9705711f83e14de6363
- SHA512 58e84da7cf2d46c3a8f575cf4403d16032ea4c01c68d187bb1841b76d55c55ef5956cc5aa3e2ab6c4eeaf5612627980a2fdad1760a4ebd76968e27f90c005708
- TLSH T129C08C1873200320E135067ED591675207BAE21C8109D314ABF00208AB0CF11CD70DC4
- MD5 SHA1 SHA512 TLSH