Analysis
- user interaction
yes - max time kernel
150s - max time network
131s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/07/2026, 00:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
vanguard emulator (3).exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
vanguard emulator (3).exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target vanguard emulator (3).exe
- Size 63.6MB
- Sample260710-arprascv8y
- SHA256 d052bd4d46d91be3ae984d0bad85bc5cf673392109b2e212954d8fa477506e45
- MD5 cb1d46bbf0de6896c96982496809a823
- SHA1 45475ca4cf45df103565e148de3b641e67b5ebc1
- SHA512 a57e063a4ce60025897635d54f84cc4c92b9caeadb048178cabdb8181faff67dc73e7a585c4c9cff4fe5178be63902aed61bd588652d8e5d9d008618edac4f4e
- SSDEEP 786432:Q9xridiXUJvmWj2IU7Uprpk8IWkjOMKYm+wHDwB:Q9xridiXwvmWj2IU7UprOfoHD
- TLSH T196E7724C24500AE9925BE815EAA7CF1B5FE9D6DB5BE8244DBCA88E340CD3CB71D1074B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 836 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4304 vanguard emulator (3).exe Token: SeSystemtimePrivilege 4304 vanguard emulator (3).exe Token: SeDebugPrivilege 836 taskmgr.exe Token: SeSystemProfilePrivilege 836 taskmgr.exe Token: SeCreateGlobalPrivilege 836 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe 836 taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 836 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\vanguard emulator (3).exe"C:\Users\Admin\AppData\Local\Temp\vanguard emulator (3).exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4304
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:836
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:4952