Overview
overview
8Static
static
3减速器D...��.lnk
windows10-2004-x64
7减速器D...��.lnk
windows11-ltsc_2024-x64
3减速器D...��.lnk
windows10-2004-x64
7减速器D...��.lnk
windows11-ltsc_2024-x64
8减速器D...��.lnk
windows10-2004-x64
7减速器D...��.lnk
windows11-ltsc_2024-x64
3减速器D...��.lnk
windows10-2004-x64
7减速器D...��.lnk
windows11-ltsc_2024-x64
8减速器D...��.lnk
windows10-2004-x64
7减速器D...��.lnk
windows11-ltsc_2024-x64
8减速器D...��.lnk
windows10-2004-x64
3减速器D...��.lnk
windows11-ltsc_2024-x64
8减速器D...��.lnk
windows10-2004-x64
7减速器D...��.lnk
windows11-ltsc_2024-x64
8减速器D...��.lnk
windows10-2004-x64
7减速器D...��.lnk
windows11-ltsc_2024-x64
8减速器D...ek.exe
windows10-2004-x64
4减速器D...ek.exe
windows11-ltsc_2024-x64
4减速器D....2.exe
windows10-2004-x64
3减速器D....2.exe
windows11-ltsc_2024-x64
3减速器D...��.chm
windows10-2004-x64
1减速器D...��.chm
windows11-ltsc_2024-x64
8Analysis
- max time kernel
150s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/07/2026, 12:19
Static task
static1
Behavioral task
behavioral1
Sample
减速器Designer v2.9.2 便携版/exe/Systemtool/任务管理器.lnk
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
减速器Designer v2.9.2 便携版/exe/Systemtool/任务管理器.lnk
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
减速器Designer v2.9.2 便携版/exe/Systemtool/区域.lnk
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
减速器Designer v2.9.2 便携版/exe/Systemtool/区域.lnk
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
减速器Designer v2.9.2 便携版/exe/Systemtool/命令提示符.lnk
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
减速器Designer v2.9.2 便携版/exe/Systemtool/命令提示符.lnk
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
减速器Designer v2.9.2 便携版/exe/Systemtool/控制面板.lnk
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
减速器Designer v2.9.2 便携版/exe/Systemtool/控制面板.lnk
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
减速器Designer v2.9.2 便携版/exe/Systemtool/系统信息.lnk
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
减速器Designer v2.9.2 便携版/exe/Systemtool/系统信息.lnk
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
减速器Designer v2.9.2 便携版/exe/Systemtool/系统规格.lnk
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
减速器Designer v2.9.2 便携版/exe/Systemtool/系统规格.lnk
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
减速器Designer v2.9.2 便携版/exe/Systemtool/计算机管理.lnk
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
减速器Designer v2.9.2 便携版/exe/Systemtool/计算机管理.lnk
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
减速器Designer v2.9.2 便携版/exe/Systemtool/证书.lnk
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
减速器Designer v2.9.2 便携版/exe/Systemtool/证书.lnk
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
Behavioral task
behavioral17
Sample
减速器Designer v2.9.2 便携版/exe/geek/geek.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
减速器Designer v2.9.2 便携版/exe/geek/geek.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
Behavioral task
behavioral19
Sample
减速器Designer v2.9.2 便携版/减速器Designer v2.9.2.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
减速器Designer v2.9.2 便携版/减速器Designer v2.9.2.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
Behavioral task
behavioral21
Sample
减速器Designer v2.9.2 便携版/减速器Designer说明书.chm
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
减速器Designer v2.9.2 便携版/减速器Designer说明书.chm
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
General
- Target 减速器Designer v2.9.2 便携版/exe/Systemtool/任务管理器.lnk
- Size 1KB
- Sample260709-phg3esbt4y
- SHA256 81d4bf5be47cfc36267eaece1605c02d5def0439b51e85ea8d82200f2baa8f2b
- MD5 e4fd91f4fcbe756fdbfeb1780dbbdfee
- SHA1 59bb13eab43ef08e8b0520e1e4d78235d9a02a90
- SHA512 8e0972b1683d0d47c210c6a1df9e04c13e72ac0d54931d4d747f9ed7d799ab411e0dec56ec42797cab79a41da015a5dcb7569f0a8caeb3f4d719364ee494ef76
- TLSH T16C21140616890A16C37B8DB710E7A342D322F4A3AD878E6D42C013982C70176FC7AE6F
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A Taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName Taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 Taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4616 Taskmgr.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4616 Taskmgr.exe Token: SeSystemProfilePrivilege 4616 Taskmgr.exe Token: SeCreateGlobalPrivilege 4616 Taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe 4616 Taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4616 Taskmgr.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4828 wrote to memory of 4616 4828 cmd.exe 89
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\减速器Designer v2.9.2 便携版\exe\Systemtool\任务管理器.lnk"1⤵
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Windows\system32\Taskmgr.exe"C:\Windows\system32\Taskmgr.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4616
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:2652