Analysis
- user interaction
yes - max time kernel
148s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/07/2026, 09:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
tx_1784194923492.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
tx_1784194923492.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target tx_1784194923492.exe
- Size 268KB
- Sample260716-lrkccsdw3s
- SHA256 06e8c8c4d5176e7dfc37d2354a08caf5f29b695118b3bd6d1fdfd6d84dbcfdff
- MD5 1a50e99091d61f0d9510c6b8e6eba7f3
- SHA1 931d0b94aa49ac3ac40462bb205c9a903ae4250d
- SHA512 47b074f51e7c70bad1a7b5ef3592101f8f56453d25ff403cb3acae77e2c4cc1b333f834c0d0649760b043e85fa3640d8611e209d6b355787f36d1381d3ee40b6
- SSDEEP 6144:7jk6/NZmTBlNKjbwxVEP1dCJFBExdecbCTEj/4IINVWh3ReFqjjxp5twhvpdJ:zz5Rm6wJpd
- TLSH T14244836AEF849CABC4F798F77C102A3FE0C4656347F46EE644C2597D1A4884E17B9E80
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix StartMenuExperienceHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" StartMenuExperienceHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" StartMenuExperienceHost.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 5812 taskmgr.exe Token: SeSystemProfilePrivilege 5812 taskmgr.exe Token: SeCreateGlobalPrivilege 5812 taskmgr.exe Token: 33 5812 taskmgr.exe Token: SeIncBasePriorityPrivilege 5812 taskmgr.exe - Suspicious use of FindShellTrayWindow 50 IoCs
pid Process 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe - Suspicious use of SendNotifyMessage 50 IoCs
pid Process 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe 5812 taskmgr.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 5812 taskmgr.exe 5812 taskmgr.exe 1668 StartMenuExperienceHost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tx_1784194923492.exe"C:\Users\Admin\AppData\Local\Temp\tx_1784194923492.exe"1⤵PID:3052
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5812
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:1912
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1668
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 591B
- SHA256 dc216c11d6381abdcb6a4b927fd9ea68d336ff63c88639e4a242acf037f90c68
- MD5 03c08670d283322f0e61ee3d5dcb7bad
- SHA1 c82040e59df0159f5cc0fd8cc795d4b73c1bf5e2
- SHA512 173493c828071e601a1d823c4c0f325c638aec3166c071a8b39dbb7ce57d84903415b051a5effc6bdd5ea4d2f9dcf8471bcb380a37133ede15ab2017cb2b1986
- TLSH T19BF09707E7A55221C0222638888116F02B25D5D68ECB227381016B5E7EB33002B008B4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 599B
- SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
- MD5 658ab8c32d4cc5deb36ac5f63da4658b
- SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
- SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
- TLSH T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
- MD5 SHA1 SHA512 TLSH