12aa97cc1af4828cb5fffd0379ef762b0bdad64f8958cf07eb89e7f7ce60367e

Resubmissions

30/08/2026, 17:31

260830-v3x72afk3w6

30/08/2026, 17:28

260830-v14l2awfqc6

30/08/2026, 17:22

260830-vxwr1sytfw6

30/08/2026, 17:10

260830-vp2nasweme6

Analysis

max time kernel
150s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/08/2026, 17:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Prestige Launcher.exe
Size 200KB
Sample260830-vp2nasweme
SHA256 12aa97cc1af4828cb5fffd0379ef762b0bdad64f8958cf07eb89e7f7ce60367e
MD5 c2dd4bd151dc8d78be496f684b6d804b
SHA1 d6473bbe6d73df10c58e5c3facec43771272085e
SHA512 5ea16b004d133118cb37bba24e136595225df2157a689e828702986458e11aa22f09ac0018a44217fa3f860f2a38a6102d3cbd8aea02d9d41e1598f70f7a71bd
SSDEEP 3072:QMTYNSwRexO5i9KWye7LpshhMDbF++++TmbQHB5RWWKuQNUrYnpZi+4MHBsGi:NYNP3i9VkwV++++TLTG/i7MhsGi
TLSH
T13214BE57B7A430F8E6BB823984511B02E776B8320B319BDF07B4065A5F277C58D39B62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
4	1464	Prestige Launcher.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	Prestige Launcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	Prestige Launcher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Prestige Launcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Prestige Launcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Prestige Launcher.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1464	Prestige Launcher.exe
1464	Prestige Launcher.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1464	Prestige Launcher.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1464	Prestige Launcher.exe

cURL User-Agent 1 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	6	curl/8.0.0

C:\Users\Admin\AppData\Local\Temp\Prestige Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Prestige Launcher.exe"
1⤵
- Downloads MZ/PE file
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1464-0-0x0000000180000000-0x00000001804BC000-memory.dmp

Download

memory/1464-8-0x0000000180000000-0x00000001804BC000-memory.dmp

Download

memory/1464-10-0x0000000180000000-0x00000001804BC000-memory.dmp

Download