ec83f835bd0c5cfa16240ac2933bfe0949a11ce182b061d6e7ccf0d8fe922551

Analysis

user interaction
yes
max time kernel
30s
max time network
14s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 15:00

Target
fastflag_injector_patched.exe
Size 306KB
Sample261024-sdtgfavwbs
SHA256 ec83f835bd0c5cfa16240ac2933bfe0949a11ce182b061d6e7ccf0d8fe922551
MD5 bc2df896686cc5e91cfe5763bb73c9d0
SHA1 9f78da51e5a9d938efce8433bf810b0eac93a99d
SHA512 8678f01bd6a0cc0150f9323c56db84a3783dccb185ebd37fc5628e499d045b7e63704203ad197287f653587c58503b1feaf651b908753d696ef9bdcff7135477
SSDEEP 3072:LNHfQKQ/ohz9I8ezuDfA7J/uPOMGdl+Geyml1gjyEKZGfzcCWVneEDYlTtzqTAah:3Q/ohz9I8uOGrml1gvlTtzqyMVZ5
TLSH
T18F64B51FEAA650E1D5BAC078D192713FFCB070A64330A7D797815A4B1B62BE4E83E750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings	fastflag_injector_patched.exe

C:\Users\Admin\AppData\Local\Temp\fastflag_injector_patched.exe
"C:\Users\Admin\AppData\Local\Temp\fastflag_injector_patched.exe"
1⤵
- Modifies registry class
PID:4672

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5044

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact