Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260630-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/07/2026, 10:43
Static task
static1
Behavioral task
behavioral1
Sample
7918d9419f46b5c38cf4b5f2ff6097c89426a9e744995749815fcbf86edac089.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
7918d9419f46b5c38cf4b5f2ff6097c89426a9e744995749815fcbf86edac089.exe
Resource
win11ltsc2024-20260630-en
General
- Target 7918d9419f46b5c38cf4b5f2ff6097c89426a9e744995749815fcbf86edac089.exe
- Size 706KB
- Sample260702-mshqlags4y
- SHA256 7918d9419f46b5c38cf4b5f2ff6097c89426a9e744995749815fcbf86edac089
- MD5 a5a5d22c4bb58c11bcd765b9a72a6699
- SHA1 c01902ea966481b48f337cc7df2c046c8d2c4b78
- SHA512 7db4e357533d0348e39e2c44cf832eb699b5cee94e609382727a9412ff05d3aab58cc4012652ae8378b2ef948c5f5ff937253fbf0f3b8460c1f962f1718762c3
- SSDEEP 12288:YdVZtMNDJm7P99ZYWJKI2K7X4lnMLcueFvtiou3NG+wO5EXACuTkKQh4dyaxVakF:m3MhkR9ZYWJKI2K7X4lnML2VIU+zEXM8
- TLSH T19FF49D1275E5BCB6C47242312B3BA7E5573EED200B21C9DFA3D406699A7C0C27B32796
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UAC bypass 3 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" 7918d9419f46b5c38cf4b5f2ff6097c89426a9e744995749815fcbf86edac089.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" 7918d9419f46b5c38cf4b5f2ff6097c89426a9e744995749815fcbf86edac089.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7918d9419f46b5c38cf4b5f2ff6097c89426a9e744995749815fcbf86edac089.exe - System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 7918d9419f46b5c38cf4b5f2ff6097c89426a9e744995749815fcbf86edac089.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" 7918d9419f46b5c38cf4b5f2ff6097c89426a9e744995749815fcbf86edac089.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7918d9419f46b5c38cf4b5f2ff6097c89426a9e744995749815fcbf86edac089.exe"C:\Users\Admin\AppData\Local\Temp\7918d9419f46b5c38cf4b5f2ff6097c89426a9e744995749815fcbf86edac089.exe"1⤵
- UAC bypass
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- System policy modification
PID:1992
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1