Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/09/2026, 17:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exe
- Size 4.4MB
- Sample260922-v53wasbf34
- SHA256 0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132
- MD5 1e9d1fe7aba4cb4e8d695b520ef47232
- SHA1 4aab1ea6c96ecc2390e033b48c4ddfb0355cb55e
- SHA512 d10f5db2750f03a3147096f14c5d85659b4bfb946ab5d8e4c70e93ff444e48df575357be0555700cb1e3e63721823e26245943b54e3471b707ee190986477c1d
- SSDEEP 49152:MsX86bhPHHFJiAQ3v1TonH2neZ5bkU5a50Lhe+jJLRUg37+uhOqNJvJdcEcEEI2Z:M+JiAC1snH2neZ5QR50YwNSdZBt7Tzl
- TLSH T1A626AE46A2B640EDD167C038C62B9A13E6753C2D03905AFB57D096616FA3BE07E7F312
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Looks up external IP address via web service 1 TTPs 9 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 checkip.amazonaws.com 1 api.ipify.org 1 ipinfo.io 8 checkip.amazonaws.com 20 api.ipify.org 1 icanhazip.com 1 ip-api.com 27 ipinfo.io 31 icanhazip.com - Drops file in System32 directory 18 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894 0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8 0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D00881249E8ACE3C38D6E432A97CAF57 0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12 0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894 0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D03E46CD585BBE111C712E6577BC5F07_D57CE96919754E8BF5FC12F0FA7A1698 0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D03E46CD585BBE111C712E6577BC5F07_D57CE96919754E8BF5FC12F0FA7A1698 0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\620BEF1064BD8E252C599957B3C91896 0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12 0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8 0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BCB67D7ECB470284AF35679F339E879F 0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\620BEF1064BD8E252C599957B3C91896 0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\166083ABEC71EE19A661F9DBBDEE639A 0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D00881249E8ACE3C38D6E432A97CAF57 0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BCB67D7ECB470284AF35679F339E879F 0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\166083ABEC71EE19A661F9DBBDEE639A 0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz 0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exe - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 1336 0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exe 1336 0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exe 1336 0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exe 1336 0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exe 1336 0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exe 1336 0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exe 1336 0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exe 1336 0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exe 1336 0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exe 1336 0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exe 1336 0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exe 1336 0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exe 1336 0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exe 1336 0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exe 1336 0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exe 1336 0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exe 1336 0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exe 1336 0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exe 1336 0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exe 1336 0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exe 1336 0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exe 1336 0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exe 1336 0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exe 1336 0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exe 1336 0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exe 1336 0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exe 1336 0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exe 1336 0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1336 wrote to memory of 3520 1336 0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exe"C:\Users\Admin\AppData\Local\Temp\0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exe"1⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exeC:\Users\Admin\AppData\Local\Temp\0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exe1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exe"C:\Users\Admin\AppData\Local\Temp\0c7e3416ce25a629e8d3f7d89202a5234674d30385df63c0a40496a2d3a64132.exe" -agent2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:3520
-