a6dc627f22572ee4a0def2b96d5edb0b4e7205ae54c97d1161e60850e32ff4f3

Analysis

max time kernel
900s
max time network
481s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 10:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
leviticus.(13940729).nfo
Size 6KB
Sample260808-l5aebadm41
SHA256 a6dc627f22572ee4a0def2b96d5edb0b4e7205ae54c97d1161e60850e32ff4f3
MD5 aabc2cec42a954086ed23b130e087054
SHA1 d4acb61b761d325712a23389f936e05177878a84
SHA512 6582b4541d2ae287bc45c9275498f5123632ea879ade871b2e2b5fd2573b3dc63636aa19e377be3e57a1d5f6e3c43136ffdba8d98a43515e50931f1e4fdcd168
SSDEEP 24:f1/7tr017K1/3LeIrkfRXM3veqrvjnzBfuZKnpRYx/2gucs+u4ZwaUQae1VOrxHh:eXWekvFpCxzwsZ1kVII3b5gqOnJ+X
TLSH
T105D1F73F45526993695CB1932488C976C520037EE5B82A80FECF8F3857BF202BB5CC5A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\ECFirmwareMajorRelease	msinfo32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\ECFirmwareMinorRelease	msinfo32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msinfo32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2572	msinfo32.exe

C:\Windows\system32\msinfo32.exe
C:\Windows\system32\msinfo32.exe "C:\Users\Admin\AppData\Local\Temp\leviticus.(13940729).nfo"
1⤵
- Enumerates system info in registry
- Suspicious behavior: GetForegroundWindowSpam
PID:2572

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1376

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:4380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads