Analysis
- user interaction
yes - max time kernel
148s - max time network
122s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/07/2026, 20:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ImguiPortfolio5.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
ImguiPortfolio5.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target ImguiPortfolio5.exe
- Size 3.0MB
- Sample260706-yspppagy4j
- SHA256 69bf7cc472f38f81b69ad74007b666350af1557783ac5f5bbb819ee434dd5d35
- MD5 903288da2077ffc8ae34d33f1edfb798
- SHA1 2b5bf4b30510b0eb637f4e4ea0e0777318eee26e
- SHA512 c12e88bd45f6b2137b4aa5ffed5f8c77df04ef12b56893c8e68b85f48be6b86dc68d567e8fb2362343d66431104626741fd53b585543fc2de94d2efa78b488f9
- SSDEEP 49152:mQYDPQPpigu6w4LkuQTlf2hlJ6vfTsJEQvvYRUceppCapzHpGYf/:m4FauuN2XJ6vfTsJEKcqpGYf/
- TLSH T132E5AF86F2D268ECC527D23442A76B37B630B85002229F7757D49B342E53ED05F9AF29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2956 taskmgr.exe Token: SeSystemProfilePrivilege 2956 taskmgr.exe Token: SeCreateGlobalPrivilege 2956 taskmgr.exe Token: 33 2956 taskmgr.exe Token: SeIncBasePriorityPrivilege 2956 taskmgr.exe - Suspicious use of FindShellTrayWindow 36 IoCs
pid Process 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe - Suspicious use of SendNotifyMessage 36 IoCs
pid Process 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe 2956 taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2956 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ImguiPortfolio5.exe"C:\Users\Admin\AppData\Local\Temp\ImguiPortfolio5.exe"1⤵PID:5732
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2956