41f1e07d35f0495805bb26cdfcc1ece6f5e701d2d0605478eaebd50375ab740a

Analysis

max time kernel
2s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 11:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fabian.exe
Size 397KB
Sample260710-npklfsbw21
SHA256 41f1e07d35f0495805bb26cdfcc1ece6f5e701d2d0605478eaebd50375ab740a
MD5 922d2a0f26cf99c81dc103f592c68dab
SHA1 0acb42f147f4535cb4a35e09802963156e27934e
SHA512 da6a78a4385b22aea7f91402dbd7aeb8f3408fa66b2c446b8def424888fc020cbb9c4644e4338f99790cd470400b04e15e9138f475e97a2bd52741c26dbf5834
SSDEEP 6144:SttMaEBydTbqGLl1oqMZHuAx9mynJFq2i3YkWQ2VpX7lkW6aOj9ld0ak+jWnlf7X:S4ETmWynX7lkW6Xbk+Wlz
TLSH
T1E7846C2AD69629A9F237813CCDFB1611E9723C0C03A189DB13A6A6FC0D57EEC9775701
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence ransomware spyware stealer trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fabian.exe

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	fabian.exe

Disables Task Manager via registry modification
defense_evasion

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4696	netsh.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fabian.exe	fabian.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\FabianUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fabian.exe"	fabian.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fabian.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2752	cmd.exe
6796	PING.EXE
6848	cmd.exe
7176	cmd.exe
3120	cmd.exe
5960	PING.EXE

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Process not Found

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
3512	notepad.exe
6744	notepad.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
5960	PING.EXE
6796	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3292	schtasks.exe
4400	schtasks.exe
1120	schtasks.exe
6784	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1224	fabian.exe
1224	fabian.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5716	Process not Found
Token: SeCreatePagefilePrivilege	5716	Process not Found
Token: SeShutdownPrivilege	5716	Process not Found
Token: SeCreatePagefilePrivilege	5716	Process not Found
Token: SeShutdownPrivilege	5716	Process not Found
Token: SeCreatePagefilePrivilege	5716	Process not Found
Token: SeShutdownPrivilege	5716	Process not Found
Token: SeCreatePagefilePrivilege	5716	Process not Found
Token: SeShutdownPrivilege	5716	Process not Found
Token: SeCreatePagefilePrivilege	5716	Process not Found
Token: SeShutdownPrivilege	5716	Process not Found
Token: SeCreatePagefilePrivilege	5716	Process not Found
Token: SeShutdownPrivilege	5716	Process not Found
Token: SeCreatePagefilePrivilege	5716	Process not Found
Token: SeShutdownPrivilege	5716	Process not Found
Token: SeCreatePagefilePrivilege	5716	Process not Found

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5716	Process not Found

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
5716	Process not Found
5716	Process not Found
5716	Process not Found
5716	Process not Found
5716	Process not Found
5716	Process not Found
5716	Process not Found

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1224	fabian.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 4664	1224	fabian.exe	88
PID 4664 wrote to memory of 3292	4664	cmd.exe	89
PID 1224 wrote to memory of 4276	1224	fabian.exe	90
PID 4276 wrote to memory of 4400	4276	cmd.exe	91
PID 1224 wrote to memory of 1232	1224	fabian.exe	93
PID 1224 wrote to memory of 3120	1224	fabian.exe	94
PID 1224 wrote to memory of 3512	1224	fabian.exe	92
PID 5716 wrote to memory of 5836	5716	Process not Found

System policy modification 1 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	fabian.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fabian.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\fabian.exe
"C:\Users\Admin\AppData\Local\Temp\fabian.exe"
1⤵
- UAC bypass
- Disables RegEdit via registry modification
- Drops startup file
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "FabianStartup" /tr "C:\Users\Admin\AppData\Local\Temp\fabian.exe" /sc onstart /f /rl highest
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4664
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "FabianStartup" /tr "C:\Users\Admin\AppData\Local\Temp\fabian.exe" /sc onstart /f /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3292
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "FabianLogon" /tr "C:\Users\Admin\AppData\Local\Temp\fabian.exe" /sc onlogon /f /rl highest
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4276
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "FabianLogon" /tr "C:\Users\Admin\AppData\Local\Temp\fabian.exe" /sc onlogon /f /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4400
- C:\Windows\SYSTEM32\notepad.exe
  notepad.exe C:\Users\Admin\Desktop\gg.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3512
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
  2⤵
  PID:1232
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
    3⤵
    PID:3404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 google.com > nul 2>&1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3120
- - C:\Windows\system32\PING.EXE
    ping -n 1 google.com
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh interface set interface "Ethernet" admin=disable
  2⤵
  PID:4772
- - C:\Windows\system32\netsh.exe
    netsh interface set interface "Ethernet" admin=disable
    3⤵
    PID:5088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
  2⤵
  PID:1520
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
    3⤵
    PID:6372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 google.com > nul 2>&1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2752
- - C:\Windows\system32\PING.EXE
    ping -n 1 google.com
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:6796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off
  2⤵
  PID:6680
- - C:\Windows\system32\netsh.exe
    netsh advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    PID:4696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 google.com > nul 2>&1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:7176

C:\Users\Admin\AppData\Local\Temp\fabian.exe
C:\Users\Admin\AppData\Local\Temp\fabian.exe
1⤵
PID:3004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "FabianStartup" /tr "C:\Users\Admin\AppData\Local\Temp\fabian.exe" /sc onstart /f /rl highest
  2⤵
  PID:3048
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "FabianStartup" /tr "C:\Users\Admin\AppData\Local\Temp\fabian.exe" /sc onstart /f /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1120
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "FabianLogon" /tr "C:\Users\Admin\AppData\Local\Temp\fabian.exe" /sc onlogon /f /rl highest
  2⤵
  PID:6660
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "FabianLogon" /tr "C:\Users\Admin\AppData\Local\Temp\fabian.exe" /sc onlogon /f /rl highest
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6784
- C:\Windows\notepad.exe
  notepad.exe C:\Users\Admin\Desktop\gg.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:6744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
  2⤵
  PID:6816
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 google.com > nul 2>&1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:6848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh interface set interface "Ethernet" admin=disable
  2⤵
  PID:6920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

enc_key.txt

Path C:\Users\Admin\AppData\Local\Temp\enc_key.txt
Size 13B
SHA256 3bc42cad0f2a4875d84fb810d428cf1f10c03315e1205c83b62675363d28faf6
MD5 45849a0a7a1688fb34f48d570846e1e6
SHA1 850ba69f70e25a7dc0d275959467fcc091eee3d6
SHA512 4a61e379ce600181a8533dfad7c17c2b6f0fdb097b6c67424592caa1f41bcc62f02334bd74a3babe9542cd819847cfa655d5d5497a075130952f093635c59268
MD5 SHA1 SHA512

Submit Download

screen.bmp

Path C:\Users\Admin\AppData\Local\Temp\screen.bmp
Size 5.9MB
SHA256 70eca0de372b82ec4c8ed8c286f52c72e59629e8889ab6bdd34b0790dc0ea6ee
MD5 e1c6e14866f2a9ee6bc9095c4a14ea8a
SHA1 b8bd81b2e0d2aac040f6a59a556ce82983930196
SHA512 1ce3ebb2ef83d3c0d4c5cff0df89326cdde8ee10886fca9e687cfd6bfc093f560e00932595e6d3cbee8ef2c2e7015246f760c430629ea712ab57abfe5226c581
SSDEEP 3:k/rhtGlklFlt/l:naf
MD5 SHA1 SHA512 SSDEEP

Submit Download

LIGHTITUP_1.txt

Path C:\Users\Admin\Desktop\LIGHTITUP_1.txt
Size 4B
SHA256 3929bb06a4676e42d87978d0ee07313fcc89e60f9ace6253b3477cbab607c91b
MD5 ce00890b6ee0e4063d0c434ab5f8cb97
SHA1 18b308a0228bd12e4938d057905c515941462356
SHA512 a07891cc8e26fdc09057a569b663089dc613bf67252d4082c183d8d1a0f70b33e4d63846a04db812d9df2cf73bffe5975bc0f07ad2fe1c38e305743efa29421a
MD5 SHA1 SHA512

Submit Download

nuke_log.txt

Path C:\Users\Admin\Desktop\nuke_log.txt
Size 19B
SHA256 08a806b6c73eac2fa489a767369c89a70bec5e02d1e4894f59dcbe8538c4a5fa
MD5 8884975ec789c9523dfb8956ede16c83
SHA1 50ecdabbbdf56e538908919fa0b534e4899cb531
SHA512 ddd18eedb3311434ea7b0f8b6babaef1b996539c59d72e78d63298b066bf33773a8e9a15b176d053b89e3d9c6d939d72b4ab167eab00f18faa3df948c762b6f9
MD5 SHA1 SHA512

Submit Download

memory/1224-10-0x0000019CF7470000-0x0000019CF751E000-memory.dmp

Download

memory/3004-47-0x0000023D18610000-0x0000023D186BE000-memory.dmp

Download

memory/5716-6-0x0000000003AA0000-0x0000000003AA1000-memory.dmp

Download

memory/5716-0-0x00000000035A0000-0x00000000035A1000-memory.dmp

Download