Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
22/09/2026, 09:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7788b473cee44a648b54331317bdd7202cd3b4f646af0acc2b880ed3f8e33a1d.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
7788b473cee44a648b54331317bdd7202cd3b4f646af0acc2b880ed3f8e33a1d.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 7788b473cee44a648b54331317bdd7202cd3b4f646af0acc2b880ed3f8e33a1d.exe
- Size 4.4MB
- Sample260922-lnjawsshqe
- SHA256 7788b473cee44a648b54331317bdd7202cd3b4f646af0acc2b880ed3f8e33a1d
- MD5 f1984d300ae0420fdccca30d5a16b767
- SHA1 956970d5ebbcc000127b8decb0d2eb29f83def3e
- SHA512 7dbbeab1dcb5068e2c6917171715e658dfa145c628b7b8b1d181b5bbc6bbaf1c264a943e8e99aaa5e53d5578bfb3220798d1ee18097ae5e9aafd5972f1728d1f
- SSDEEP 49152:MsX86bhPHHFJiAQ3v1TonH2neZ5bkU5a50Lhe+jJLRUg37+uhOqNJvJdcEcEEI2T:M+JiAC1snH2neZ5QR50YwNSdZBt7TzlR
- TLSH T1B426AE46A2B640EDD167C038C62B9A13E6753C2D03905AFB57D096616FA3BE07E7F312
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 2804 AppSyncCore.exe 2072 AppSyncCore.exe - Looks up external IP address via web service 1 TTPs 9 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 82 api.ipify.org 85 ipinfo.io 104 checkip.amazonaws.com 84 ipinfo.io 97 icanhazip.com 100 ifconfig.me 107 ip-api.com 24 checkip.amazonaws.com 25 checkip.amazonaws.com - Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_B5D3A17E5BEDD2EDA793611A0A74E1E8 7788b473cee44a648b54331317bdd7202cd3b4f646af0acc2b880ed3f8e33a1d.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_B5D3A17E5BEDD2EDA793611A0A74E1E8 7788b473cee44a648b54331317bdd7202cd3b4f646af0acc2b880ed3f8e33a1d.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 7788b473cee44a648b54331317bdd7202cd3b4f646af0acc2b880ed3f8e33a1d.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 7788b473cee44a648b54331317bdd7202cd3b4f646af0acc2b880ed3f8e33a1d.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\166083ABEC71EE19A661F9DBBDEE639A 7788b473cee44a648b54331317bdd7202cd3b4f646af0acc2b880ed3f8e33a1d.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D03E46CD585BBE111C712E6577BC5F07_D57CE96919754E8BF5FC12F0FA7A1698 7788b473cee44a648b54331317bdd7202cd3b4f646af0acc2b880ed3f8e33a1d.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1 7788b473cee44a648b54331317bdd7202cd3b4f646af0acc2b880ed3f8e33a1d.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1 7788b473cee44a648b54331317bdd7202cd3b4f646af0acc2b880ed3f8e33a1d.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\166083ABEC71EE19A661F9DBBDEE639A 7788b473cee44a648b54331317bdd7202cd3b4f646af0acc2b880ed3f8e33a1d.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D03E46CD585BBE111C712E6577BC5F07_D57CE96919754E8BF5FC12F0FA7A1698 7788b473cee44a648b54331317bdd7202cd3b4f646af0acc2b880ed3f8e33a1d.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BCB67D7ECB470284AF35679F339E879F 7788b473cee44a648b54331317bdd7202cd3b4f646af0acc2b880ed3f8e33a1d.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BCB67D7ECB470284AF35679F339E879F 7788b473cee44a648b54331317bdd7202cd3b4f646af0acc2b880ed3f8e33a1d.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz 7788b473cee44a648b54331317bdd7202cd3b4f646af0acc2b880ed3f8e33a1d.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 7788b473cee44a648b54331317bdd7202cd3b4f646af0acc2b880ed3f8e33a1d.exe - Modifies data under HKEY_USERS 6 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 7788b473cee44a648b54331317bdd7202cd3b4f646af0acc2b880ed3f8e33a1d.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 7788b473cee44a648b54331317bdd7202cd3b4f646af0acc2b880ed3f8e33a1d.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 7788b473cee44a648b54331317bdd7202cd3b4f646af0acc2b880ed3f8e33a1d.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 7788b473cee44a648b54331317bdd7202cd3b4f646af0acc2b880ed3f8e33a1d.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 7788b473cee44a648b54331317bdd7202cd3b4f646af0acc2b880ed3f8e33a1d.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 7788b473cee44a648b54331317bdd7202cd3b4f646af0acc2b880ed3f8e33a1d.exe - Modifies system certificate store 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F 7788b473cee44a648b54331317bdd7202cd3b4f646af0acc2b880ed3f8e33a1d.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F\Blob = 5c0000000100000004000000000800000f00000001000000200000001504593902ec8a0bab29f03bf35c3058b5fd1807a74dab92cb61ed4a9908afa40b000000010000006200000041006d0061007a006f006e00200053006500720076006900630065007300200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020002d002d002000470032000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000002500000030233021060b6086480186fd6e0107180330123010060a2b0601040182373c0101030200c0620000000100000020000000568d6905a2c88708a4b3025190edcfedb1974a606a13c6e5290fcb2ae63edab51400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf21191831d000000010000001000000052135310639a10f77f886b229b9f7afc7f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d701030000000100000014000000925a8f8d2c6d04e0665f596aff22d863e8256f3f19000000010000001000000014d4b19434670e6dc091d154abb20edc2000000001000000f3030000308203ef308202d7a003020102020100300d06092a864886f70d01010b0500308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183300d06092a864886f70d01010b050003820101004b36a6847769dd3b199f6723086f0e61c9fd84dc5fd83681cdd81b412d9f60ddc71a68d9d16e86e18823cf13de43cfe234b3049d1f29d5bff85ec8d5c1bdee926f3274f291822fbd82427aad2ab7207d4dbc7a5512c215eabdf76a952e6c749fcf1cb4f2c501a385d0723ead73ab0b9b750c6d45b78e94ac9637b5a0d08f15470ee3e883dd8ffdef410177cc27a9628533f23708ef71cf7706dec8191d8840cf7d461dff1ec7e1ceff23dbc6fa8d554ea902e74711463ef4fdbd7b2926bba961623728b62d2af6108664c970a7d2adb7297079ea3cda63259ffd68b730ec70fb758ab76d6067b21ec8b9e9d8a86f028b670d4d265771da20fcc14a508db128ba 7788b473cee44a648b54331317bdd7202cd3b4f646af0acc2b880ed3f8e33a1d.exe - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 4888 7788b473cee44a648b54331317bdd7202cd3b4f646af0acc2b880ed3f8e33a1d.exe 4888 7788b473cee44a648b54331317bdd7202cd3b4f646af0acc2b880ed3f8e33a1d.exe 4888 7788b473cee44a648b54331317bdd7202cd3b4f646af0acc2b880ed3f8e33a1d.exe 4888 7788b473cee44a648b54331317bdd7202cd3b4f646af0acc2b880ed3f8e33a1d.exe 4888 7788b473cee44a648b54331317bdd7202cd3b4f646af0acc2b880ed3f8e33a1d.exe 4888 7788b473cee44a648b54331317bdd7202cd3b4f646af0acc2b880ed3f8e33a1d.exe 4888 7788b473cee44a648b54331317bdd7202cd3b4f646af0acc2b880ed3f8e33a1d.exe 4888 7788b473cee44a648b54331317bdd7202cd3b4f646af0acc2b880ed3f8e33a1d.exe 4888 7788b473cee44a648b54331317bdd7202cd3b4f646af0acc2b880ed3f8e33a1d.exe 4888 7788b473cee44a648b54331317bdd7202cd3b4f646af0acc2b880ed3f8e33a1d.exe 4888 7788b473cee44a648b54331317bdd7202cd3b4f646af0acc2b880ed3f8e33a1d.exe 4888 7788b473cee44a648b54331317bdd7202cd3b4f646af0acc2b880ed3f8e33a1d.exe 4888 7788b473cee44a648b54331317bdd7202cd3b4f646af0acc2b880ed3f8e33a1d.exe 4888 7788b473cee44a648b54331317bdd7202cd3b4f646af0acc2b880ed3f8e33a1d.exe 4888 7788b473cee44a648b54331317bdd7202cd3b4f646af0acc2b880ed3f8e33a1d.exe 4888 7788b473cee44a648b54331317bdd7202cd3b4f646af0acc2b880ed3f8e33a1d.exe 4888 7788b473cee44a648b54331317bdd7202cd3b4f646af0acc2b880ed3f8e33a1d.exe 4888 7788b473cee44a648b54331317bdd7202cd3b4f646af0acc2b880ed3f8e33a1d.exe 4888 7788b473cee44a648b54331317bdd7202cd3b4f646af0acc2b880ed3f8e33a1d.exe 4888 7788b473cee44a648b54331317bdd7202cd3b4f646af0acc2b880ed3f8e33a1d.exe 4888 7788b473cee44a648b54331317bdd7202cd3b4f646af0acc2b880ed3f8e33a1d.exe 4888 7788b473cee44a648b54331317bdd7202cd3b4f646af0acc2b880ed3f8e33a1d.exe 4888 7788b473cee44a648b54331317bdd7202cd3b4f646af0acc2b880ed3f8e33a1d.exe 4888 7788b473cee44a648b54331317bdd7202cd3b4f646af0acc2b880ed3f8e33a1d.exe 4888 7788b473cee44a648b54331317bdd7202cd3b4f646af0acc2b880ed3f8e33a1d.exe 4888 7788b473cee44a648b54331317bdd7202cd3b4f646af0acc2b880ed3f8e33a1d.exe 2072 AppSyncCore.exe 2072 AppSyncCore.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 976 7788b473cee44a648b54331317bdd7202cd3b4f646af0acc2b880ed3f8e33a1d.exe Token: SeIncreaseQuotaPrivilege 976 7788b473cee44a648b54331317bdd7202cd3b4f646af0acc2b880ed3f8e33a1d.exe Token: SeAssignPrimaryTokenPrivilege 976 7788b473cee44a648b54331317bdd7202cd3b4f646af0acc2b880ed3f8e33a1d.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4888 wrote to memory of 976 4888 7788b473cee44a648b54331317bdd7202cd3b4f646af0acc2b880ed3f8e33a1d.exe 89 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\7788b473cee44a648b54331317bdd7202cd3b4f646af0acc2b880ed3f8e33a1d.exe"C:\Users\Admin\AppData\Local\Temp\7788b473cee44a648b54331317bdd7202cd3b4f646af0acc2b880ed3f8e33a1d.exe"1⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\7788b473cee44a648b54331317bdd7202cd3b4f646af0acc2b880ed3f8e33a1d.exeC:\Users\Admin\AppData\Local\Temp\7788b473cee44a648b54331317bdd7202cd3b4f646af0acc2b880ed3f8e33a1d.exe1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\7788b473cee44a648b54331317bdd7202cd3b4f646af0acc2b880ed3f8e33a1d.exe"C:\Users\Admin\AppData\Local\Temp\7788b473cee44a648b54331317bdd7202cd3b4f646af0acc2b880ed3f8e33a1d.exe" -agent2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:976
-
-
C:\ProgramData\AppRuntime\AppSyncCore.exeC:\ProgramData\AppRuntime\AppSyncCore.exe1⤵
- Executes dropped EXE
PID:2804
-
C:\ProgramData\AppRuntime\AppSyncCore.exeC:\ProgramData\AppRuntime\AppSyncCore.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2072
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\AppRuntime\AppSyncCore.exe
- Size 4.4MB
- SHA256 7788b473cee44a648b54331317bdd7202cd3b4f646af0acc2b880ed3f8e33a1d
- MD5 f1984d300ae0420fdccca30d5a16b767
- SHA1 956970d5ebbcc000127b8decb0d2eb29f83def3e
- SHA512 7dbbeab1dcb5068e2c6917171715e658dfa145c628b7b8b1d181b5bbc6bbaf1c264a943e8e99aaa5e53d5578bfb3220798d1ee18097ae5e9aafd5972f1728d1f
- SSDEEP 49152:MsX86bhPHHFJiAQ3v1TonH2neZ5bkU5a50Lhe+jJLRUg37+uhOqNJvJdcEcEEI2T:M+JiAC1snH2neZ5QR50YwNSdZBt7TzlR
- TLSH T1B426AE46A2B640EDD167C038C62B9A13E6753C2D03905AFB57D096616FA3BE07E7F312
- MD5 SHA1 SHA512 SSDEEP TLSH