Resubmissions
26/06/2026, 14:42
260626-r21d8acs6y26/06/2026, 12:43
260626-pyc4eact3l326/06/2026, 12:43
260626-px2qdact2p3Analysis
- user interaction
yes - max time kernel
106s - max time network
96s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
26/06/2026, 12:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
idk.exe
Resource
win11-20260513-en
windows11-21h2-x64
7 signatures
150 seconds
General
- Target idk.exe
- Size 172KB
- Sample260626-pyc4eact3l
- SHA256 2082603358d16c0c77fd942069cbe05a8de3c1ed6124dd2405b1e8a1d5b5962c
- MD5 3303cd5f2692021684b107a39a6dad04
- SHA1 916b5963414b356b804d67c198456921326c3bb3
- SHA512 b565716423a119f3476ff2fb2fb086ee4525e3827aa552faba292f0bf6eb837535be22331572b3164937d48a966e8396fb48d4958fb49d921f74667ed932dfb3
- SSDEEP 1536:JgfQdwOJgBIYvH5MAwdUeeZifnG6mLttPBHi0GBXpJsD9H:+fgwOcIYvZMrUee+G6mLttPBspypH
- TLSH T18304B72A32690CB2C9A6C07AAC428367CDB03455133D95FF9181C9D9AF327ECBA7CD55
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\MuiCache MiniSearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.WindowsTerminal_8wekyb3d8bbwe\StartTerminalOnLoginTask taskmgr.exe - Suspicious behavior: EnumeratesProcesses 21 IoCs
pid Process 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 708 taskmgr.exe Token: SeSystemProfilePrivilege 708 taskmgr.exe Token: SeCreateGlobalPrivilege 708 taskmgr.exe Token: 33 708 taskmgr.exe Token: SeIncBasePriorityPrivilege 708 taskmgr.exe - Suspicious use of FindShellTrayWindow 46 IoCs
pid Process 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe - Suspicious use of SendNotifyMessage 46 IoCs
pid Process 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe 708 taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3468 MiniSearchHost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\idk.exe"C:\Users\Admin\AppData\Local\Temp\idk.exe"1⤵PID:2360
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3468
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:708
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
- Size 22KB
- SHA256 7048b5d81341553ff7a7d3b0ed08e1b074e6ddf127cd70ac13a1ae2a5c01bf3c
- MD5 0ccbec66c7cbda05350c610260f6cd4d
- SHA1 b8f20e98436d09c350a79270bef3a766ad2ad789
- SHA512 614e95580b75f1c46d39cc88a49a292fc4b49afc9162e4c63606065356c5df00d0a6df5b086e1ec79e9cf75ac6496669e91d09290b633d17ffe2ffd7eeae8164
- SSDEEP 384:2JWJ4Vca12krtuVm+AglBOVjeQ8RJodighIjUXy7Wg5Pjm5q+GDa50ZQOYAV2cBA:e+4VcWr1l8RJyig+jUXwJsq+GDa50ZQd
- TLSH T132A24C743AF51319F3B29F759AF1A95A643AB866AC00DB4D0162038D0977D92CDB0F3B
- MD5 SHA1 SHA512 SSDEEP TLSH