Analysis
- user interaction
yes - max time kernel
16s - max time network
18s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
23/06/2026, 07:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
888 V2.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
888 V2.exe
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target 888 V2.exe
- Size 7.9MB
- Sample260623-ht7nwsbs8z
- SHA256 2fdf465d0f5ae8da2b7f96d03982a40af68a24ae51de1c6f43ac1d986f205e0d
- MD5 11abba5231205624505cbc5337a5e24d
- SHA1 e451b6f4d6757cbe845325f2006520370c5f1f1d
- SHA512 cc8babdc1fc3a6b7b473ec743006c803a4b8a82043035f87b3dbeb0f44bd604e0315655b49974296fdbb872c1dd46c6b120745dee0c0d31a9f91e2c052a411b7
- SSDEEP 196608:aYEDAZVGDmGe1unzMuyfhSk8TeUhsjpzG:JE5DmbyLyJS9
- TLSH T1CE860106F19346A8CF7297388565A237D6B07CC54371C3C76B9C6961ABB36F09ABE700
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2932 taskmgr.exe Token: SeSystemProfilePrivilege 2932 taskmgr.exe Token: SeCreateGlobalPrivilege 2932 taskmgr.exe Token: 33 2932 taskmgr.exe Token: SeIncBasePriorityPrivilege 2932 taskmgr.exe - Suspicious use of FindShellTrayWindow 36 IoCs
pid Process 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe - Suspicious use of SendNotifyMessage 35 IoCs
pid Process 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\888 V2.exe"C:\Users\Admin\AppData\Local\Temp\888 V2.exe"1⤵PID:2428
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2932