Analysis
- max time kernel
149s - max time network
111s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
04/06/2026, 09:27
General
- Target Install.exe
- Size 4.1MB
- Sample260604-lesszabz5s
- SHA256 807e72c85ab94278d9e0bb16ce82c18762a609092ab9d35305db042d61cdddfd
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3984-0-0x000001803D500000-0x000001803DDBA000-memory.dmp
memory/3984-1-0x000001803E1C0000-0x000001803E1C1000-memory.dmp
memory/3984-2-0x0000018059A80000-0x0000018059A90000-memory.dmp
memory/3984-3-0x0000018059960000-0x0000018059A10000-memory.dmp
memory/3984-4-0x0000018059C10000-0x0000018059C86000-memory.dmp
memory/3984-5-0x0000018059A80000-0x0000018059A90000-memory.dmp
memory/3984-6-0x0000018059A80000-0x0000018059A90000-memory.dmp
memory/3984-7-0x000001805B060000-0x000001805B234000-memory.dmp
memory/3984-8-0x0000018059A80000-0x0000018059A90000-memory.dmp
memory/3984-9-0x0000018059BE0000-0x0000018059C02000-memory.dmp
memory/3984-10-0x0000018059A80000-0x0000018059A90000-memory.dmp
memory/3984-11-0x0000018059A80000-0x0000018059A90000-memory.dmp
memory/3984-12-0x0000018059A80000-0x0000018059A90000-memory.dmp
memory/3984-13-0x0000018059A80000-0x0000018059A90000-memory.dmp
memory/3984-14-0x0000018059A80000-0x0000018059A90000-memory.dmp
memory/3984-15-0x0000018059A80000-0x0000018059A90000-memory.dmp