Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
02/06/2026, 12:15
Static task
static1
Behavioral task
behavioral1
Sample
flashplayer32_0r0_371_win.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
flashplayer32_0r0_371_win.exe
Resource
win11-20260513-en
6 signatures
150 seconds
General
- Target flashplayer32_0r0_371_win.exe
- Size 20.3MB
- Sample260602-pe287acy5x
- SHA256 036c1b22557628a37f05fb948a2cd8e7bb4c5b487331a48675d1f89751b4144d
- MD5 6a300ad373c88854c06233588b5b34a5
- SHA1 7552d26324cb45af40b162928c2901059165253d
- SHA512 6a4b942177febed2cd48774163861894e3a29e1e6b46a322b3efd2536651eee5c4f0fec9115f45983b3f97b986b6149074b0224af995a0c8b3785cd2476b15d3
- SSDEEP 393216:R3qisivuNs19r0mx6wEaUNbMcVH747Zy6jVMSOxz+npef83fJVPv0jeR:VDGsLr0O6wdU+KHEVy6ZrpD3fnPvAeR
- TLSH T15D27331293F9AAA2D4B279F9856363D517A53F160E3BC0AD5F833D0CD835A83493C6B1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Macromed\Temp\{43CA03D6-37CE-4EE2-85D3-C27BA6204562}\fpb.tmp flashplayer32_0r0_371_win.exe File created C:\Windows\SysWOW64\Macromed\Temp\{63A3F30A-F4B4-4E30-B0D2-547B03ACC880}\fpb.tmp flashplayer32_0r0_371_win.exe - Loads dropped DLL 3 IoCs
pid Process 1528 flashplayer32_0r0_371_win.exe 1528 flashplayer32_0r0_371_win.exe 1528 flashplayer32_0r0_371_win.exe - Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA flashplayer32_0r0_371_win.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flashplayer32_0r0_371_win.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1528 flashplayer32_0r0_371_win.exe 1528 flashplayer32_0r0_371_win.exe 1528 flashplayer32_0r0_371_win.exe 1528 flashplayer32_0r0_371_win.exe 1528 flashplayer32_0r0_371_win.exe 1528 flashplayer32_0r0_371_win.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1528 flashplayer32_0r0_371_win.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\flashplayer32_0r0_371_win.exe"C:\Users\Admin\AppData\Local\Temp\flashplayer32_0r0_371_win.exe"1⤵
- Drops file in System32 directory
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1528
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\Macromed\Temp\{43CA03D6-37CE-4EE2-85D3-C27BA6204562}\fpb.tmp
- Size 1.4MB
- SHA256 9cb2ad03af6ee4b74aa9ad748069e26b8b7ac88e797b072396ce3340c115d0b2
- MD5 9569d2503dacca6823a2ef7ce6e527c3
- SHA1 6a92163154507a0bfd3b1afd2e37529612c373f0
- SHA512 fb5a8283685dd1965ffd5436f9ce5b7ea41d065e4dae211bbfedf5852ad53caa0cfefc279ed1f00f4fffcb10061fc25bf808de4dd4ad9937a89788257cd1fa31
- SSDEEP 24576:i626osHaVPXRpTcH+VKT1SodVah5Z/wFsNtFCRhj8jQNj/Xhu:i62u6JRpTPykodgh5hIqOR58Ubu
- TLSH T175656C11A3F99EA1D5A239F84563A7D407A93F5A0E3AC1ED5FC33D4CD834A4349386E2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Macromed\Temp\{63A3F30A-F4B4-4E30-B0D2-547B03ACC880}\fpb.tmp
- Size 577KB
- SHA256 b50ab173b4a2e544e89c6be4f5eb826869e48b7804eb134f72af842ebcb1dcc6
- MD5 04f66795c8f92be76ce5eb3990d3eab9
- SHA1 75aee0713b147308e3d442e4c53a2ed4a5392951
- SHA512 85d42b9d5179d02d71043b1a5c1e49c26a22ba5ce8bca3db3cb3ce4b9969316dcc92b0d3d2bb9cf452447d79edd9d5871d91786ed91ff161440520f9a6a810c2
- SSDEEP 6144:rExI1zk3rbI7JHJDtVQWjAcjiVRJk1aA5e8MQJh3rtTAXTvZduxRNTBJkl/Cfp63:gxX3rh4efA5kQJ9rOXTvGRNTo4e
- TLSH T1DDC4F702B7E88539F1F72B387E7AA6900A7A7E61AD34D55E93A4150D0E70780E670F73
- MD5 SHA1 SHA512 SSDEEP TLSH