dfbbc09b63f105f414ac5d38be6504bd828d9bd64a63bbe44178e7b7236e4987

Analysis

user interaction
yes
max time kernel
148s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 22:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fastflag_injector_gui_enhanced.exe
Size 131KB
Sample260702-11xrdact5p
SHA256 dfbbc09b63f105f414ac5d38be6504bd828d9bd64a63bbe44178e7b7236e4987
MD5 9c2b21bc2ecd88ecee9d19d632848891
SHA1 d11fea650ac55a206abf2fcc051745f9e41353aa
SHA512 9ce77c6c615eddd1f98f5e2cc56fc2f41b071bb212d28069cfc71ac359c81029fa3aa7eec920bfbe11f02dfd6f9b16a1aba88ce84278bffade64a738ae5ed8ce
SSDEEP 3072:k3ZTBss7PK8H/REMnC0L8BaI/Ya1nM0RMvXSYo:kp9Ne8fRESJ8BhYa19RVYo
TLSH
T1BED34B2ABA59106DD27AC4B8CA530513EB727C860760A7DF63909DB10F229D4FF7BB01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000\Control Panel\Colors	fastflag_injector_gui_enhanced.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	fastflag_injector_gui_enhanced.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	fastflag_injector_gui_enhanced.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	fastflag_injector_gui_enhanced.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	fastflag_injector_gui_enhanced.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	fastflag_injector_gui_enhanced.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	fastflag_injector_gui_enhanced.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 010000000200000000000000ffffffff	fastflag_injector_gui_enhanced.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	fastflag_injector_gui_enhanced.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	fastflag_injector_gui_enhanced.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	fastflag_injector_gui_enhanced.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	fastflag_injector_gui_enhanced.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	fastflag_injector_gui_enhanced.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	fastflag_injector_gui_enhanced.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	fastflag_injector_gui_enhanced.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = ffffffff	fastflag_injector_gui_enhanced.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	fastflag_injector_gui_enhanced.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	fastflag_injector_gui_enhanced.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	fastflag_injector_gui_enhanced.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	fastflag_injector_gui_enhanced.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	fastflag_injector_gui_enhanced.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	fastflag_injector_gui_enhanced.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\NodeSlot = "3"	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	fastflag_injector_gui_enhanced.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	fastflag_injector_gui_enhanced.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 = 14001f0005398e082303024b98265d99428e115f0000	fastflag_injector_gui_enhanced.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	fastflag_injector_gui_enhanced.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	fastflag_injector_gui_enhanced.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	fastflag_injector_gui_enhanced.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Downloads"	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings	fastflag_injector_gui_enhanced.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f481cffcda87848be43b5fdf8091c1c60d00000	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\NotificationData	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	fastflag_injector_gui_enhanced.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	fastflag_injector_gui_enhanced.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	fastflag_injector_gui_enhanced.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	fastflag_injector_gui_enhanced.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	fastflag_injector_gui_enhanced.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff	fastflag_injector_gui_enhanced.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	fastflag_injector_gui_enhanced.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	fastflag_injector_gui_enhanced.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	fastflag_injector_gui_enhanced.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	fastflag_injector_gui_enhanced.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5688	fastflag_injector_gui_enhanced.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
5688	fastflag_injector_gui_enhanced.exe
5688	fastflag_injector_gui_enhanced.exe
5688	fastflag_injector_gui_enhanced.exe
5688	fastflag_injector_gui_enhanced.exe
5688	fastflag_injector_gui_enhanced.exe
5688	fastflag_injector_gui_enhanced.exe
5688	fastflag_injector_gui_enhanced.exe
5688	fastflag_injector_gui_enhanced.exe
5688	fastflag_injector_gui_enhanced.exe
5688	fastflag_injector_gui_enhanced.exe
5688	fastflag_injector_gui_enhanced.exe
5688	fastflag_injector_gui_enhanced.exe
5688	fastflag_injector_gui_enhanced.exe
5688	fastflag_injector_gui_enhanced.exe
5688	fastflag_injector_gui_enhanced.exe

C:\Users\Admin\AppData\Local\Temp\fastflag_injector_gui_enhanced.exe
"C:\Users\Admin\AppData\Local\Temp\fastflag_injector_gui_enhanced.exe"
1⤵
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads