1c9c56ef8849271ac6df841f3e14e65845200a2ab5ab17a21392ba0e84c22395

Analysis

max time kernel
298s
max time network
209s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/05/2026, 13:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
resurse/uninstall_flash_player.exe
Size 227KB
Sample260517-qs8tkacw7q
SHA256 1c9c56ef8849271ac6df841f3e14e65845200a2ab5ab17a21392ba0e84c22395
MD5 f7d4e31914fabe1cb3bd35bd200d3dd7
SHA1 a492e6141929a02e603b708ac09cb06406774a15
SHA512 abe3e7ebad054661ec3e8428f0bce5a0e74ec3a855b6fdd4df0a7cccbb3287876de270f7e98fd3a8b58ac359c15e725ed84fa9e4697c18d414a52041bbdcf01e
SSDEEP 3072:F0tNJ/69bpjrp8KVocBvovgXnsyW0U/slqpPcwDcuuhX0GJeHImIsgu:WtNJ/6n29cBzXzWIePlu5dX7sR
TLSH
T1B234CF1377D48676F0B22770AD3AB75616B2BCA02C31D71EA78C3A4E2D327548762772
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery trojan

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1840	uninstall_flash_player.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	uninstall_flash_player.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninstall_flash_player.exe

C:\Users\Admin\AppData\Local\Temp\resurse\uninstall_flash_player.exe
"C:\Users\Admin\AppData\Local\Temp\resurse\uninstall_flash_player.exe"
1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
PID:1840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6491.tmp

Path C:\Users\Admin\AppData\Local\Temp\6491.tmp
Size 304KB
SHA256 64021f9696848bbe85a3ff52db35cb6af383e94fc10403bd81a99b3a55cb122e
MD5 623182a6ca855a0ea17c0477b5678d22
SHA1 a3f51f69cae75084981ac9240dc750bd8c2cbba5
SHA512 39f88fc48e6cb191c1d0254bec7532d2f401d719279c23f00d0016346c8f52ff4806ee980070e290da62c06976f190a8df0ba31a427199ab20edf644c24e6c24
SSDEEP 6144:wiWpavEKFYqCIIVDayXaTBydJYSHG6WLqyoIr6:w5pgDNCVaTXXv6
TLSH
T1AC64070277F88229F5F32F783DBAA2955AB6BE91BD34C25E5360144D0970B60DA71B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download