Resubmissions
17/05/2026, 05:09
260517-ftmmlsf19j317/05/2026, 05:08
260517-fsr6pscv3s317/05/2026, 05:06
260517-frwgqsf16j3Analysis
- user interaction
yes - max time kernel
181s - max time network
153s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
17/05/2026, 05:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bedrockpack.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
5 signatures
900 seconds
General
- Target bedrockpack.exe
- Size 12.5MB
- Sample260517-ftmmlsf19j
- SHA256 13a3c650df2e1db9cfcbf0acd31abf63c0ff070d17c044332226f90587b4823b
- MD5 47c3dc15024f7f553989f221a5ec2094
- SHA1 ff657a89467c58d14c0bd14a850c4bc5df932815
- SHA512 12e85f18ffdcbd82d04c5d24ddfe7cef66d3cbdef3f5d4bd91ad617a3dce24511a289a260c81655fd6c287ace0a0cd51feef0635c7cd0bd53b0475e2b1949e37
- SSDEEP 98304:+UqKZxbJKMN1dooez69EA1hzYc9FfTFuWdVIQt/05d6jX:+jgJ51dpSwYS5JHIC05S
- TLSH T193D68D43EC626AE9C6ADA235C9B65242BA767C458B3163D73B60F3347F727C06679300
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3880 taskmgr.exe Token: SeSystemProfilePrivilege 3880 taskmgr.exe Token: SeCreateGlobalPrivilege 3880 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe 3880 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bedrockpack.exe"C:\Users\Admin\AppData\Local\Temp\bedrockpack.exe"1⤵PID:716
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\bedrockpack.exe"C:\Users\Admin\AppData\Local\Temp\bedrockpack.exe"1⤵PID:3056
-
C:\Users\Admin\Desktop\bedrockpack.exe"C:\Users\Admin\Desktop\bedrockpack.exe"1⤵PID:2976
-
C:\Users\Admin\Desktop\bedrockpack.exe"C:\Users\Admin\Desktop\bedrockpack.exe"1⤵PID:3312
-
C:\Users\Admin\Desktop\bedrockpack.exe"C:\Users\Admin\Desktop\bedrockpack.exe"1⤵PID:1060
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3880
-
C:\Users\Admin\Desktop\bedrockpack.exe"C:\Users\Admin\Desktop\bedrockpack.exe"1⤵PID:2736
-
C:\Users\Admin\Desktop\bedrockpack.exe"C:\Users\Admin\Desktop\bedrockpack.exe"1⤵PID:2528
-
C:\Users\Admin\Desktop\bedrockpack.exe"C:\Users\Admin\Desktop\bedrockpack.exe"1⤵PID:2924
-
C:\Users\Admin\Desktop\bedrockpack.exe"C:\Users\Admin\Desktop\bedrockpack.exe"1⤵PID:5104
-
C:\Users\Admin\Desktop\bedrockpack.exe"C:\Users\Admin\Desktop\bedrockpack.exe"1⤵PID:4152
-
C:\Users\Admin\Desktop\bedrockpack.exe"C:\Users\Admin\Desktop\bedrockpack.exe"1⤵PID:3456
-
C:\Users\Admin\Desktop\bedrockpack.exe"C:\Users\Admin\Desktop\bedrockpack.exe"1⤵PID:3412
-
C:\Users\Admin\Desktop\bedrockpack.exe"C:\Users\Admin\Desktop\bedrockpack.exe"1⤵PID:4608
-
C:\Users\Admin\Desktop\bedrockpack.exe"C:\Users\Admin\Desktop\bedrockpack.exe"1⤵PID:4332
-
C:\Users\Admin\Desktop\bedrockpack.exe"C:\Users\Admin\Desktop\bedrockpack.exe"1⤵PID:572
-
C:\Users\Admin\Desktop\bedrockpack.exe"C:\Users\Admin\Desktop\bedrockpack.exe"1⤵PID:1332
-
C:\Users\Admin\Desktop\bedrockpack.exe"C:\Users\Admin\Desktop\bedrockpack.exe"1⤵PID:2760
-
C:\Users\Admin\Desktop\bedrockpack.exe"C:\Users\Admin\Desktop\bedrockpack.exe"1⤵PID:4656
-
C:\Users\Admin\Desktop\bedrockpack.exe"C:\Users\Admin\Desktop\bedrockpack.exe"1⤵PID:4136
-
C:\Users\Admin\Desktop\bedrockpack.exe"C:\Users\Admin\Desktop\bedrockpack.exe"1⤵PID:4904
-
C:\Users\Admin\Desktop\bedrockpack.exe"C:\Users\Admin\Desktop\bedrockpack.exe"1⤵PID:2984
-
C:\Users\Admin\Desktop\bedrockpack.exe"C:\Users\Admin\Desktop\bedrockpack.exe"1⤵PID:4884
-
C:\Users\Admin\Desktop\bedrockpack.exe"C:\Users\Admin\Desktop\bedrockpack.exe"1⤵PID:224
-
C:\Users\Admin\Desktop\bedrockpack.exe"C:\Users\Admin\Desktop\bedrockpack.exe"1⤵PID:5000
-
C:\Users\Admin\Desktop\bedrockpack.exe"C:\Users\Admin\Desktop\bedrockpack.exe"1⤵PID:3516
-
C:\Users\Admin\Desktop\bedrockpack.exe"C:\Users\Admin\Desktop\bedrockpack.exe"1⤵PID:4460
-
C:\Users\Admin\Desktop\bedrockpack.exe"C:\Users\Admin\Desktop\bedrockpack.exe"1⤵PID:3456
-
C:\Users\Admin\Desktop\bedrockpack.exe"C:\Users\Admin\Desktop\bedrockpack.exe"1⤵PID:2356
-
C:\Users\Admin\Desktop\bedrockpack.exe"C:\Users\Admin\Desktop\bedrockpack.exe"1⤵PID:1884
-
C:\Users\Admin\Desktop\bedrockpack.exe"C:\Users\Admin\Desktop\bedrockpack.exe"1⤵PID:3524
-
C:\Users\Admin\Desktop\bedrockpack.exe"C:\Users\Admin\Desktop\bedrockpack.exe"1⤵PID:2216
-
C:\Users\Admin\Desktop\bedrockpack.exe"C:\Users\Admin\Desktop\bedrockpack.exe"1⤵PID:2260
-
C:\Users\Admin\Desktop\bedrockpack.exe"C:\Users\Admin\Desktop\bedrockpack.exe"1⤵PID:3920
-
C:\Users\Admin\Desktop\bedrockpack.exe"C:\Users\Admin\Desktop\bedrockpack.exe"1⤵PID:2908
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Public\Desktop\Firefox.lnk
- Size 1KB
- SHA256 b3a5d7bf63e4b3fabc579b484580292376a2c62cf471b60cd347b05d6eac4f0f
- MD5 8164c9cebef50a509a212f368bf63785
- SHA1 0064183b9d318e098c7944effef2db5919bcf685
- SHA512 294e0f5b11be76d4f1085d3cf19f15ab52c729c4661827d1e9f57989b4de0cfbe61baafe2e8dc25cdcded50649335bea9d1207dd27e99d0c546ce178a4429672
- TLSH T16111CC000FFB0AD6F0F785327B316B635337BD02AB66572D808922984DBB250857AF93
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\Desktop\Google Chrome.lnk
- Size 2KB
- SHA256 e07596a87443eb6658ba9a6b1f46bb1f4e1cf3efbe2c0c664209b482f7f2eb75
- MD5 c90d469db325e07b58fee125114fbac0
- SHA1 da563d6c226873978d18482a09a1a0e51e434a6c
- SHA512 11dfcb08aa09f99129d1c82467ef03cb4b6817b8c0002b4df82267c650c5812cf5e8c670f8b3249aa49f0e690defacd822b57d2a3a7cb06559eb05fb6e318fdf
- TLSH T1C84148113BFA1798F2E38732AE3377310F7BF8169A14461E60D5528808F161405A8BB7
- MD5 SHA1 SHA512 TLSH