Analysis
- user interaction
yes - max time kernel
62s - max time network
63s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
19/06/2026, 23:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target Setup.exe
- Size 102KB
- Sample260619-24v8dsds2y
- SHA256 7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab
- MD5 0323998e0e85eca5fd90d9f8ecbbd6c2
- SHA1 56dc080f728d7a276495d6a4371670f9ea71519b
- SHA512 2b56c210d6c690cef89ca03563cec186576c50f6b1b60b287afd46a14cc5c9dfce31dd458066098951a79daf3b367fdb0787d3bdc74fbd8f69425877f263b0e5
- SSDEEP 3072:53Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:1Q+IFCumUGekHRvEuO3go9kfnQ
- TLSH T167A3F206BB1615BEE922803EEA970666D7B0FB6217514CC71211A2301FB7FC19E379E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4248 taskmgr.exe Token: SeSystemProfilePrivilege 4248 taskmgr.exe Token: SeCreateGlobalPrivilege 4248 taskmgr.exe Token: 33 4248 taskmgr.exe Token: SeIncBasePriorityPrivilege 4248 taskmgr.exe - Suspicious use of FindShellTrayWindow 41 IoCs
pid Process 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe - Suspicious use of SendNotifyMessage 40 IoCs
pid Process 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵PID:4188
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2984
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4248