c0d75ae711adc3feb91de32bb8ff0bdf21781826926ed5c4d242818102dc777b

Analysis

user interaction
yes
max time kernel
380s
max time network
363s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/06/2026, 09:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
stereo fix 2026 (1).rar
Size 192KB
Sample260620-lezxaad18p
SHA256 c0d75ae711adc3feb91de32bb8ff0bdf21781826926ed5c4d242818102dc777b
MD5 bfb6fd90b7cf79a45c01a22863bdb254
SHA1 77348e4cb0e9f61f47028f15dffa5ba05170008c
SHA512 0b693ae2593d126ed0114ff5c4be64cfbeaa29f6630b69baf2139c38af52b8ee32372340e90a6c68518006e76b7a503421df45f547ecce11267bb6896381686a
SSDEEP 3072:F0w5stlhRcVgNcBuGfvypLNMXF8aZJ4kSsG1qpxS35VnwepA:FHgTcBuuvypeV8+zMYpkpRa
TLSH
T1A81423BCD312B28CDF50500B25119D63B7161A4739BB1E4BEBAD173F52ED0288E4F999
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5804	Lightcord Stereo FIX.exe
4128	Lightcord Stereo FIX.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	7zFM.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1784	7zFM.exe
1784	7zFM.exe
1784	7zFM.exe
1784	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1784	7zFM.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	1784	7zFM.exe
Token: 35	1784	7zFM.exe
Token: SeSecurityPrivilege	1784	7zFM.exe
Token: SeSecurityPrivilege	1784	7zFM.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1784	7zFM.exe
1784	7zFM.exe
1784	7zFM.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5804	Lightcord Stereo FIX.exe
4128	Lightcord Stereo FIX.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1784 wrote to memory of 5804	1784	7zFM.exe	88
PID 1784 wrote to memory of 4128	1784	7zFM.exe	92

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\stereo fix 2026 (1).rar"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Users\Admin\AppData\Local\Temp\7zO8F64DC6A\Lightcord Stereo FIX.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO8F64DC6A\Lightcord Stereo FIX.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5804
- C:\Users\Admin\AppData\Local\Temp\7zO8F69C4AA\Lightcord Stereo FIX.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO8F69C4AA\Lightcord Stereo FIX.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4128

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1052

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:4168

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:1560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Lightcord Stereo FIX.exe

Path C:\Users\Admin\AppData\Local\Temp\7zO8F64DC6A\Lightcord Stereo FIX.exe
Size 356KB
SHA256 0abfbc7afb77481e8b10618bd48b8b337172af54e5ff52a718f4f7c9a41cb7c7
MD5 19b458f1d8c6fbfabf7250426f1298dd
SHA1 10ff0a68ec9aaa4c47bb49ee3081c24e370c45be
SHA512 4589a5219e85ea1e1ceb2240f0d14c90d2009bb4cd3e43b89354998abce76c7f65ff791c03e05586315a6fd956cc838cdae4d30515056efd3b222c58fcd4faeb
SSDEEP 6144:5F5c4V3Q0HZbhAItlCD6BDaFPmqVLaVYpQhHHCi4W06Wo9dypMBfPUikgianN0o:j64ZLHZbhAIt5qPzVLaVYpQHL4W06WhP
TLSH
T1C774AE55F2F050F9D06A9274D1BBAA0BEB363C9D16208B8A33ED15495FF327059FA312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download