Analysis
- max time kernel
148s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/09/2026, 09:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe
- Size 4.4MB
- Sample260922-lnhdlashqd
- SHA256 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da
- MD5 498b2e9f04e92682aea59888ddccdcb1
- SHA1 909968f94cac6fe2b729fb9bcbe423a3d983dac0
- SHA512 044e5e1cecd2e040f5d6e4837b71a949385d3da453989c2d4281b45eebdbf5c7fff613abac3cd575253bbd0d3914a99be64d6ff6b6ed12b8bbd6e712e21bdaaf
- SSDEEP 49152:ZsX86bhPHHFJiAQ3v1TonH2neZ5bkU5a50Lhe+jJLRUg37+uhOqNJvJdcEcEEI2I:Z+JiAC1snH2neZ5QR50YwNSdZwt7Tzl
- TLSH T19426AE46A2A640EDD167C038C62B9A13E6753C2D03905EFB57D096616FA3BE07E7F312
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
pid Process 4652 AppSyncCore.exe 5964 AppSyncCore.exe 5148 AppSyncCore.exe - Looks up external IP address via web service 1 TTPs 6 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 checkip.amazonaws.com 1 ip-api.com 1 ipinfo.io 1 ipapi.co 4 checkip.amazonaws.com 21 checkip.amazonaws.com - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0379F18B6250EBA9F1427CCCECB3157 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0379F18B6250EBA9F1427CCCECB3157 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_B5D3A17E5BEDD2EDA793611A0A74E1E8 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_B5D3A17E5BEDD2EDA793611A0A74E1E8 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D03E46CD585BBE111C712E6577BC5F07_D57CE96919754E8BF5FC12F0FA7A1698 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D03E46CD585BBE111C712E6577BC5F07_D57CE96919754E8BF5FC12F0FA7A1698 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AppSyncCore.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AppSyncCore.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe - Modifies data under HKEY_USERS 18 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" AppSyncCore.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" AppSyncCore.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix AppSyncCore.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" AppSyncCore.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" AppSyncCore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing AppSyncCore.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" AppSyncCore.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ AppSyncCore.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" AppSyncCore.exe - Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 5748 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe 5748 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe 5748 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe 5748 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe 5748 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe 5748 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe 5748 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe 5748 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe 5748 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe 5748 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe 5964 AppSyncCore.exe 5964 AppSyncCore.exe 5964 AppSyncCore.exe 5964 AppSyncCore.exe 5964 AppSyncCore.exe 5964 AppSyncCore.exe 5964 AppSyncCore.exe 5964 AppSyncCore.exe 5964 AppSyncCore.exe 5964 AppSyncCore.exe 5964 AppSyncCore.exe 5964 AppSyncCore.exe 5964 AppSyncCore.exe 5964 AppSyncCore.exe 5964 AppSyncCore.exe 5964 AppSyncCore.exe 5964 AppSyncCore.exe 5964 AppSyncCore.exe 5964 AppSyncCore.exe 5964 AppSyncCore.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 6032 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe Token: SeIncreaseQuotaPrivilege 6032 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe Token: SeAssignPrimaryTokenPrivilege 6032 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe Token: SeDebugPrivilege 5148 AppSyncCore.exe Token: SeIncreaseQuotaPrivilege 5148 AppSyncCore.exe Token: SeAssignPrimaryTokenPrivilege 5148 AppSyncCore.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 5748 wrote to memory of 6032 5748 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe 91 PID 5964 wrote to memory of 5148 5964 AppSyncCore.exe 96 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe"C:\Users\Admin\AppData\Local\Temp\486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe"1⤵PID:5164
-
C:\Users\Admin\AppData\Local\Temp\486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exeC:\Users\Admin\AppData\Local\Temp\486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5748 -
C:\Users\Admin\AppData\Local\Temp\486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe"C:\Users\Admin\AppData\Local\Temp\486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da.exe" -agent2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:6032
-
-
C:\ProgramData\AppRuntime\AppSyncCore.exeC:\ProgramData\AppRuntime\AppSyncCore.exe1⤵
- Executes dropped EXE
PID:4652
-
C:\ProgramData\AppRuntime\AppSyncCore.exeC:\ProgramData\AppRuntime\AppSyncCore.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5964 -
C:\ProgramData\AppRuntime\AppSyncCore.exe"C:\ProgramData\AppRuntime\AppSyncCore.exe" -agent2⤵
- Executes dropped EXE
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5148
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\AppRuntime\AppSyncCore.exe
- Size 4.4MB
- SHA256 486af893a65b0bfd676271ccac76e06437fafe2f520792c3fc3a84d113cf96da
- MD5 498b2e9f04e92682aea59888ddccdcb1
- SHA1 909968f94cac6fe2b729fb9bcbe423a3d983dac0
- SHA512 044e5e1cecd2e040f5d6e4837b71a949385d3da453989c2d4281b45eebdbf5c7fff613abac3cd575253bbd0d3914a99be64d6ff6b6ed12b8bbd6e712e21bdaaf
- SSDEEP 49152:ZsX86bhPHHFJiAQ3v1TonH2neZ5bkU5a50Lhe+jJLRUg37+uhOqNJvJdcEcEEI2I:Z+JiAC1snH2neZ5QR50YwNSdZwt7Tzl
- TLSH T19426AE46A2A640EDD167C038C62B9A13E6753C2D03905EFB57D096616FA3BE07E7F312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_B5D3A17E5BEDD2EDA793611A0A74E1E8
- Size 1KB
- SHA256 614984594e402cdafa693c8ae9f5e7a987021202e270a1aa71333e4a9cf3eac9
- MD5 5dc5231d1dc249501852b7898c393fe2
- SHA1 e5e6790d3fb55b0c2e7dc0854b2fe3958ac72ebb
- SHA512 ec053fa701c7640d81769f62e488d8d68c6d0b6cbd61c882e39d948765addc2cd0713f3e3c8974fbe653d88b6f75de4bee3cb15e761327d5713f0959910d4ef8
- TLSH T1D421E9F2271CA878EBE27D9408DED6323D74BDCD94F10596592480F390807B50E879DE
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894
- Size 1KB
- SHA256 39d3c3c9e01b3a3d88efef8b9a1876840dc07f1212c4b3c0a71ac5c917362244
- MD5 5ff309231e92c57b5135179b6db63fb8
- SHA1 df745e451c918b9f4dee41e289d1552e42e2eecd
- SHA512 1550b149ea82e72dee8224913f7c6d49f9782ac0bd4c77c7296087117c3dd7b4538645c1aeb2f86951f742686a1708a6d0a386f857cbd3387265be9587140488
- TLSH T1C431E7F90BA4F2A15E92AD420A8EE13D7F7492EA3CE21C636469801158D1BF2340541C
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D03E46CD585BBE111C712E6577BC5F07_D57CE96919754E8BF5FC12F0FA7A1698
- Size 471B
- SHA256 433337db468a9c8db50e39ec35302e4d8f9be0fd31778de95ab86486ad39e912
- MD5 5f325de118af8047ca27f55a4f8b6f1b
- SHA1 2ee458925dfe7b9e28d0a8fd427051b37989a563
- SHA512 d2472e126f614a70bb1080e4f481fdf58aa9091202fbbcaad88a55d5dfe15d01062ba3177feced3e3b7c0dc49029eaf5e2305e85b525c5196df521c67695327f
- TLSH T1ECF0971FCFE4AE012F85C8491BE8C2B97423E34308D9800362392199A9AA369DD03863
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_B5D3A17E5BEDD2EDA793611A0A74E1E8
- Size 438B
- SHA256 f91b58bc69dcb194d0fc35adb553c8a50ae346561e0d66aa86a0c6e11d776ad2
- MD5 177e3c2986305d331c0f33bcb01881d4
- SHA1 0390787a50bfc76bf1182d87c459671f8356c9c8
- SHA512 ba1e74fa92cceb1034f9efc09b6f9ae876df67d24051b0ceb178cbf5d69ef05f01ea1a42ae677b404ce63e209ddfc1d647c6ca7bb74fd430dfcf686bc0629993
- TLSH T1A7F06828AAFF811EF937E9B667DE5630C436F1371504A3B413B01209A700E40EC76A13
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894
- Size 432B
- SHA256 1618d0f68c8f5dd509a3995286c6a595bbc41eea5865d37dcf504690399f3942
- MD5 0f70dbbb024b3b528b0d8c0c4641df58
- SHA1 7d62dda68103f68eb4bca06c72b0dfd145184cb1
- SHA512 bf166d6f47f38654fc2c077dc766ed93247c0813270939a17eab16d816ef4c9362445f9581e5335b8ef3426838f5e966819985aa46ac755daec3285cc53dfed3
- TLSH T120E0686535FE8319F1B1EB7E0BCABC22C0BBF1231048B3A256D057557A999C00D35A36
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D03E46CD585BBE111C712E6577BC5F07_D57CE96919754E8BF5FC12F0FA7A1698
- Size 418B
- SHA256 1132af3441f02a0ef2052149469f0a2294e529edd88a88c51e0f71457f440f48
- MD5 a8064ddb76b6c30fed7f8a2a450c1788
- SHA1 b518a26daf06bfee51360920f864ffd9206d6804
- SHA512 108375c215f32267de35f4e8c623cd12b4bef18779ba6a30cb742de3722ab48e9c7a29d7591a6bd161c94dcdf42d7490c68ca4d9333cd891218e6864ce9d2979
- TLSH T1EFE0681802F9411FF23697B84FD8A0A1CD46F027D810E2B30A62134C92119009C255F4
- MD5 SHA1 SHA512 TLSH