Analysis
- user interaction
yes - max time kernel
376s - max time network
369s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
17/07/2026, 00:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
malware_extraido.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
900 seconds
Behavioral task
behavioral2
Sample
malware_extraido.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
9 signatures
900 seconds
General
- Target malware_extraido.exe
- Size 5.7MB
- Sample260717-apl8dsbz9t
- SHA256 732e7cd508f08a38b7959ec0d8059509e52d50ae94c0e4e43927ce4e7fd13529
- MD5 7ea09d43d49d36fb30cb3f571dde6f2a
- SHA1 8728ac22986ae64eca111388cacca2fe389d62df
- SHA512 335d86622e9628b61ee676cf7831af03b39a858950ac108b10780ca71982e2b0e9ff2795885ae8f3398215826cde1193e337e391751825feee19db9576948419
- SSDEEP 49152:2JWJDsmXY5DReVjQH8Vguit9ph+rGgcbLFn3wWIaeMme88n2fEtKK+GntXYGwhXa:2re+3GhcnneJe88YWW
- TLSH T12F56CF53FA95C2E9C09EC1B8C71B5227EB72B88D0920B79B6BE84A113F57B205F4D354
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 Taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A Taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName Taskmgr.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1068 Taskmgr.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1068 Taskmgr.exe Token: SeSystemProfilePrivilege 1068 Taskmgr.exe Token: SeCreateGlobalPrivilege 1068 Taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe 1068 Taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4032 malware_extraido.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2976 wrote to memory of 1068 2976 launchtm.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\malware_extraido.exe"C:\Users\Admin\AppData\Local\Temp\malware_extraido.exe"1⤵PID:3092
-
C:\Windows\system32\launchtm.exelaunchtm.exe /21⤵
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Windows\System32\Taskmgr.exe"C:\Windows\System32\Taskmgr.exe" /22⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1068
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\malware_extraido.exe"C:\Users\Admin\AppData\Local\Temp\malware_extraido.exe"1⤵
- Suspicious use of SetWindowsHookEx
PID:4032