0111b0e981e1c6c7222e481f58cfbfe6600e606470832c0df8678decfe6d5c14

Analysis

user interaction
yes
max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 22:10

Target
OpticalFlares_1.3.8 (168).exe
Size 39.4MB
Sample260804-13v1kaer21
SHA256 0111b0e981e1c6c7222e481f58cfbfe6600e606470832c0df8678decfe6d5c14
MD5 e440f9133247851bd5936ef3d37792cf
SHA1 7ad8f69dda85937f5358ee8afe2984f7844ad46b
SHA512 9f6c9ca155afe70a30b287eda6b7691ba8b4344525029a4ab3c8f203827c80d1146d60428089a64fbff699f5afb65a27e1ff510894ca3335f667210cce8b2738
SSDEEP 786432:9h66n18tU6ayzBPhiiXM9TZpAyykMAblSUDTAyy9brK+sw+bJ2/8at5QHmc:9h6E8tmSBZiiXM97lfcbi51Symc
TLSH
T11F97335BB39900E6C87AC03C8597964BE27238110374A7EB37AD965A6F777F01A3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5588	OpticalFlares_1.3.8 (168).exe
5588	OpticalFlares_1.3.8 (168).exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 5588	1856	OpticalFlares_1.3.8 (168).exe	89

C:\Users\Admin\AppData\Local\Temp\OpticalFlares_1.3.8 (168).exe
"C:\Users\Admin\AppData\Local\Temp\OpticalFlares_1.3.8 (168).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Users\Admin\AppData\Local\Temp\OpticalFlares_1.3.8 (168).exe
  "C:\Users\Admin\AppData\Local\Temp\OpticalFlares_1.3.8 (168).exe" /UAC
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:5588

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact