Analysis
- user interaction
yes - max time kernel
150s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/06/2026, 18:34
Static task
static1
Behavioral task
behavioral1
Sample
export.txt
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
export.txt
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target export.txt
- Size 12KB
- Sample260628-w7tk3sbx4v
- SHA256 1f8c356834a0d853261bb0092c928aa5e8c98889bbc5424549006229167be392
- MD5 cc4638ea3f866613b93105433dc6cd26
- SHA1 1593c03fe834876ca12431d918587fc69f815f20
- SHA512 f021ffca61f3a015a0c76d0f882d046fd9631c413a3cda266c1551a4c6b2db5e32816ae51ccd3d428566581513865e1698a2b75e49229385c20d07c38ac6f9f3
- SSDEEP 192:dN2s1+nMoY5QUq9m8dniMsRP0N86S9krc1qbyodNMqKS8IpZF7oo1Z8JZb:vlonMbQUq9m8dn+n99uPPX8Ij1Z8Db
- TLSH T19042945431B1CD766B56C2A382C67CFB624E76F1E7D221407E84AB2F057A42ABCC3D24
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Opens file in notepad (likely ransom note) 1 IoCs
pid Process 3756 NOTEPAD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2276 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2276 taskmgr.exe Token: SeSystemProfilePrivilege 2276 taskmgr.exe Token: SeCreateGlobalPrivilege 2276 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe 2276 taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2276 taskmgr.exe
Processes
-
C:\Windows\system32\NOTEPAD.EXEC:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\export.txt1⤵
- Opens file in notepad (likely ransom note)
PID:3756
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2276
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:3264