Analysis
- user interaction
yes - max time kernel
34s - max time network
15s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
25/06/2026, 11:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
SolixSpoofer.exe
Resource
win11-20260513-en
windows11-21h2-x64
7 signatures
150 seconds
General
- Target SolixSpoofer.exe
- Size 983KB
- Sample260625-m7t26sbs8r
- SHA256 9a5345a1f3ac16c23654d8dc52fd5bd4b2f4b171ce40b62fdc05ca5363c3480a
- MD5 d1ea7a760895b1a0ddb0683ceebd1f68
- SHA1 4a97d3f87994f414690d46a52562e9c8e113a0f5
- SHA512 504f396853e5e4f1d737bb983cf203ee8c96dd1b526840f15a9e8659b7e72568a10143ddaf9a578fa8a9bf94fd1e1075da2a3d73b96fe704b33cadcbcbcfd851
- SSDEEP 6144:TljAXFgGgOrp94hYsMYLBwONHXovfZtJRznIdvfZGqeXW5wMy5:TljOgRjVUbIi
- TLSH T17B257566A6A665A4C07BC03CD552951EFD6034AA8338A2FF72C54E812F917F4EF3C781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\MuiCache MiniSearchHost.exe - Suspicious behavior: EnumeratesProcesses 15 IoCs
pid Process 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2204 taskmgr.exe Token: SeSystemProfilePrivilege 2204 taskmgr.exe Token: SeCreateGlobalPrivilege 2204 taskmgr.exe Token: 33 2204 taskmgr.exe Token: SeIncBasePriorityPrivilege 2204 taskmgr.exe - Suspicious use of FindShellTrayWindow 40 IoCs
pid Process 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe - Suspicious use of SendNotifyMessage 40 IoCs
pid Process 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe 2204 taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3424 MiniSearchHost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SolixSpoofer.exe"C:\Users\Admin\AppData\Local\Temp\SolixSpoofer.exe"1⤵PID:3504
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3424
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2204