9ecba7f956188db16f65f3cd3092e508fca34d4b7e65b93accbc85353df3ebe4

Analysis

max time kernel
298s
max time network
205s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/05/2026, 13:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
resurse/install_flash_player_ax.exe
Size 2.7MB
Sample260517-qs8tkacw7q
SHA256 9ecba7f956188db16f65f3cd3092e508fca34d4b7e65b93accbc85353df3ebe4
MD5 ea65daa3e1216f26d6c7935d39e542d7
SHA1 07908231028f68098902d5aa52812b7e27f8497a
SHA512 184eca0bb8359e2f605fa3bf1836bdfc9780f05c9138f1de5739921575f0696258877b589281cd21fe28db2b6cfcfd2268a422cf9cee1548a2ca956680867d90
SSDEEP 49152:4urvl/FJeQ9FByKC3htkJbsr3n/xAodYNQTI4RiJ+K16lfviz50CQbdBqiMO4RB9:ZN/TeuryKuOq7pZWG8P0lfkgxS1R4K
TLSH
T1B2D53313ABE41176F0B37F706A39B46555B6BCA05A30D33FA64C38CE6E743904B617A2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery trojan

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
540	install_flash_player_ax.exe
540	install_flash_player_ax.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	install_flash_player_ax.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	install_flash_player_ax.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
540	install_flash_player_ax.exe
540	install_flash_player_ax.exe

C:\Users\Admin\AppData\Local\Temp\resurse\install_flash_player_ax.exe
"C:\Users\Admin\AppData\Local\Temp\resurse\install_flash_player_ax.exe"
1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6973.tmp

Path C:\Users\Admin\AppData\Local\Temp\6973.tmp
Size 304KB
SHA256 494af023522da4e9ba7dd2c2e978257716b6c72b4084bddedd92c02be833f32b
MD5 2c490344dd93745d1fb6518b4f1973b2
SHA1 052494f09cdf3608db19df77a51b161afc8ec19d
SHA512 24fd43c176c678a3ca56f6c63b17c8c2606d7cd77fdf51b14fbf2c8e94701785a6fd416fb863bf391de6c2d120f3321b0c7808f5b3a32455c8c9acdafc822050
SSDEEP 6144:pRhmeWe8QZKve6sRVTBNd8SHGysLqyoI52rC+9eoKb:p7bnxRVTqR12rC+9eoKb
TLSH
T18364F70277F88229F5F32F787DB6A2951AB6BE91BD34C25E5360244D0970B50EA71B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6974.tmp

Path C:\Users\Admin\AppData\Local\Temp\6974.tmp
Size 229KB
SHA256 ca276e6a6b437128c22c56f8a64b7e896ab6993812f94bef5d1dd19a1f305e65
MD5 57280a667209fb0cce84c75082b3b34c
SHA1 5d441e4a47af3f794aa2ccd449954f2686f64bd9
SHA512 e70a0724e7781574e15dfc7242a6f3b95ba4b8707d31e70dcc37fd49aba290128c991e0e740971ea456ccec90cddc02614e6a0ef2071672dda30c9b1c526079c
SSDEEP 3072:4La+ZxwcKgxkif+boirj8IVocB8hETT1yO4q13THAVpfh8KkT+rHJT7izNQ5SfSd:ya+TpK4xncBF/T48KkTuCzN/7Ja
TLSH
T1DA34CF5363990672F0B727706D7B73661AB6BC906C31D37FAB8C398E28347518262772
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download