Analysis
- geolocation tags
eueuropefrfrance - max time kernel
30s - max time network
2s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/06/2026, 16:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
LastActivityView.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
30 seconds
Behavioral task
behavioral2
Sample
LastActivityView.exe
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
6 signatures
30 seconds
General
- Target LastActivityView.exe
- Size 130KB
- Sample260623-vcaztaet3j
- SHA256 af86dc3f76d39b67b967a3b714e9e70ed43eec8d3871e9691cb45d84372b53fb
- MD5 f27a284ef9b018cdd2a98a7b78ccdcb3
- SHA1 67e260b11e6227c18cae8925b4f6899103c607f2
- SHA512 9a8811f13517748539308a70933b126a3348407f397bf30f903019379f927532c64015853b94acf21bdbc554d638a0265d4394d026e289103db06fe93fe5524b
- SSDEEP 3072:5e69eWHZXp1nPDhhloZqX6EsSiEF4Gw1aqL1p7BZ5CJ/:5e/+1nrhPKqX6EsS94H8B
- TLSH T181D37D0373E54471E4F31A725E765E3ACAB6FD705A30DA0B8790AC4E1DF1A44DA227A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LastActivityView.exe - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\ LastActivityView.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ LastActivityView.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2916 LastActivityView.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeBackupPrivilege 2916 LastActivityView.exe Token: SeBackupPrivilege 2916 LastActivityView.exe Token: SeSecurityPrivilege 2916 LastActivityView.exe Token: SeBackupPrivilege 2916 LastActivityView.exe Token: SeSecurityPrivilege 2916 LastActivityView.exe Token: SeSecurityPrivilege 2916 LastActivityView.exe Token: SeSecurityPrivilege 2916 LastActivityView.exe Token: SeSecurityPrivilege 2916 LastActivityView.exe Token: SeSecurityPrivilege 2916 LastActivityView.exe Token: SeSecurityPrivilege 2916 LastActivityView.exe Token: SeSecurityPrivilege 2916 LastActivityView.exe Token: SeSecurityPrivilege 2916 LastActivityView.exe Token: SeSecurityPrivilege 2916 LastActivityView.exe Token: SeSecurityPrivilege 2916 LastActivityView.exe Token: SeSecurityPrivilege 2916 LastActivityView.exe Token: SeSecurityPrivilege 2916 LastActivityView.exe Token: SeSecurityPrivilege 2916 LastActivityView.exe Token: SeSecurityPrivilege 2916 LastActivityView.exe Token: SeSecurityPrivilege 2916 LastActivityView.exe Token: SeSecurityPrivilege 2916 LastActivityView.exe Token: SeSecurityPrivilege 2916 LastActivityView.exe Token: SeSecurityPrivilege 2916 LastActivityView.exe Token: SeSecurityPrivilege 2916 LastActivityView.exe Token: SeSecurityPrivilege 2916 LastActivityView.exe Token: SeSecurityPrivilege 2916 LastActivityView.exe Token: SeSecurityPrivilege 2916 LastActivityView.exe Token: SeSecurityPrivilege 2916 LastActivityView.exe Token: SeSecurityPrivilege 2916 LastActivityView.exe Token: SeSecurityPrivilege 2916 LastActivityView.exe Token: SeSecurityPrivilege 2916 LastActivityView.exe Token: SeSecurityPrivilege 2916 LastActivityView.exe Token: SeSecurityPrivilege 2916 LastActivityView.exe Token: SeSecurityPrivilege 2916 LastActivityView.exe Token: SeSecurityPrivilege 2916 LastActivityView.exe Token: SeSecurityPrivilege 2916 LastActivityView.exe Token: SeSecurityPrivilege 2916 LastActivityView.exe Token: SeSecurityPrivilege 2916 LastActivityView.exe Token: SeSecurityPrivilege 2916 LastActivityView.exe Token: SeSecurityPrivilege 2916 LastActivityView.exe Token: SeSecurityPrivilege 2916 LastActivityView.exe Token: SeSecurityPrivilege 2916 LastActivityView.exe Token: SeSecurityPrivilege 2916 LastActivityView.exe Token: SeSecurityPrivilege 2916 LastActivityView.exe Token: SeSecurityPrivilege 2916 LastActivityView.exe Token: SeSecurityPrivilege 2916 LastActivityView.exe Token: SeSecurityPrivilege 2916 LastActivityView.exe Token: SeSecurityPrivilege 2916 LastActivityView.exe Token: SeSecurityPrivilege 2916 LastActivityView.exe Token: SeSecurityPrivilege 2916 LastActivityView.exe Token: SeSecurityPrivilege 2916 LastActivityView.exe Token: SeSecurityPrivilege 2916 LastActivityView.exe Token: SeSecurityPrivilege 2916 LastActivityView.exe Token: SeSecurityPrivilege 2916 LastActivityView.exe Token: SeSecurityPrivilege 2916 LastActivityView.exe Token: SeSecurityPrivilege 2916 LastActivityView.exe Token: SeSecurityPrivilege 2916 LastActivityView.exe Token: SeSecurityPrivilege 2916 LastActivityView.exe Token: SeSecurityPrivilege 2916 LastActivityView.exe Token: SeSecurityPrivilege 2916 LastActivityView.exe Token: SeSecurityPrivilege 2916 LastActivityView.exe Token: SeSecurityPrivilege 2916 LastActivityView.exe Token: SeSecurityPrivilege 2916 LastActivityView.exe Token: SeSecurityPrivilege 2916 LastActivityView.exe Token: SeSecurityPrivilege 2916 LastActivityView.exe