Analysis
- geolocation tags
cacanadananorth-americatoronto - max time kernel
30s - max time network
25s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/07/2026, 05:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
LastActivityView.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
30 seconds
Behavioral task
behavioral2
Sample
LastActivityView.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
30 seconds
General
- Target LastActivityView.exe
- Size 130KB
- Sample260712-gltavse16x
- SHA256 af86dc3f76d39b67b967a3b714e9e70ed43eec8d3871e9691cb45d84372b53fb
- MD5 f27a284ef9b018cdd2a98a7b78ccdcb3
- SHA1 67e260b11e6227c18cae8925b4f6899103c607f2
- SHA512 9a8811f13517748539308a70933b126a3348407f397bf30f903019379f927532c64015853b94acf21bdbc554d638a0265d4394d026e289103db06fe93fe5524b
- SSDEEP 3072:5e69eWHZXp1nPDhhloZqX6EsSiEF4Gw1aqL1p7BZ5CJ/:5e/+1nrhPKqX6EsS94H8B
- TLSH T181D37D0373E54471E4F31A725E765E3ACAB6FD705A30DA0B8790AC4E1DF1A44DA227A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LastActivityView.exe - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\ LastActivityView.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ LastActivityView.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5860 LastActivityView.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeBackupPrivilege 5860 LastActivityView.exe Token: SeBackupPrivilege 5860 LastActivityView.exe Token: SeSecurityPrivilege 5860 LastActivityView.exe Token: SeBackupPrivilege 5860 LastActivityView.exe Token: SeSecurityPrivilege 5860 LastActivityView.exe Token: SeSecurityPrivilege 5860 LastActivityView.exe Token: SeSecurityPrivilege 5860 LastActivityView.exe Token: SeSecurityPrivilege 5860 LastActivityView.exe Token: SeSecurityPrivilege 5860 LastActivityView.exe Token: SeSecurityPrivilege 5860 LastActivityView.exe Token: SeSecurityPrivilege 5860 LastActivityView.exe Token: SeSecurityPrivilege 5860 LastActivityView.exe Token: SeSecurityPrivilege 5860 LastActivityView.exe Token: SeSecurityPrivilege 5860 LastActivityView.exe Token: SeSecurityPrivilege 5860 LastActivityView.exe Token: SeSecurityPrivilege 5860 LastActivityView.exe Token: SeSecurityPrivilege 5860 LastActivityView.exe Token: SeSecurityPrivilege 5860 LastActivityView.exe Token: SeSecurityPrivilege 5860 LastActivityView.exe Token: SeSecurityPrivilege 5860 LastActivityView.exe Token: SeSecurityPrivilege 5860 LastActivityView.exe Token: SeSecurityPrivilege 5860 LastActivityView.exe Token: SeSecurityPrivilege 5860 LastActivityView.exe Token: SeSecurityPrivilege 5860 LastActivityView.exe Token: SeSecurityPrivilege 5860 LastActivityView.exe Token: SeSecurityPrivilege 5860 LastActivityView.exe Token: SeSecurityPrivilege 5860 LastActivityView.exe Token: SeSecurityPrivilege 5860 LastActivityView.exe Token: SeSecurityPrivilege 5860 LastActivityView.exe Token: SeSecurityPrivilege 5860 LastActivityView.exe Token: SeSecurityPrivilege 5860 LastActivityView.exe Token: SeSecurityPrivilege 5860 LastActivityView.exe Token: SeSecurityPrivilege 5860 LastActivityView.exe Token: SeSecurityPrivilege 5860 LastActivityView.exe Token: SeSecurityPrivilege 5860 LastActivityView.exe Token: SeSecurityPrivilege 5860 LastActivityView.exe Token: SeSecurityPrivilege 5860 LastActivityView.exe Token: SeSecurityPrivilege 5860 LastActivityView.exe Token: SeSecurityPrivilege 5860 LastActivityView.exe Token: SeSecurityPrivilege 5860 LastActivityView.exe Token: SeSecurityPrivilege 5860 LastActivityView.exe Token: SeSecurityPrivilege 5860 LastActivityView.exe Token: SeSecurityPrivilege 5860 LastActivityView.exe Token: SeSecurityPrivilege 5860 LastActivityView.exe Token: SeSecurityPrivilege 5860 LastActivityView.exe Token: SeSecurityPrivilege 5860 LastActivityView.exe Token: SeSecurityPrivilege 5860 LastActivityView.exe Token: SeSecurityPrivilege 5860 LastActivityView.exe Token: SeSecurityPrivilege 5860 LastActivityView.exe Token: SeSecurityPrivilege 5860 LastActivityView.exe Token: SeSecurityPrivilege 5860 LastActivityView.exe Token: SeSecurityPrivilege 5860 LastActivityView.exe Token: SeSecurityPrivilege 5860 LastActivityView.exe Token: SeSecurityPrivilege 5860 LastActivityView.exe Token: SeSecurityPrivilege 5860 LastActivityView.exe Token: SeSecurityPrivilege 5860 LastActivityView.exe Token: SeSecurityPrivilege 5860 LastActivityView.exe Token: SeSecurityPrivilege 5860 LastActivityView.exe Token: SeSecurityPrivilege 5860 LastActivityView.exe Token: SeSecurityPrivilege 5860 LastActivityView.exe Token: SeSecurityPrivilege 5860 LastActivityView.exe Token: SeSecurityPrivilege 5860 LastActivityView.exe Token: SeSecurityPrivilege 5860 LastActivityView.exe Token: SeSecurityPrivilege 5860 LastActivityView.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\LastActivityView.exe"C:\Users\Admin\AppData\Local\Temp\LastActivityView.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:5860
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:3412