Analysis
- user interaction
yes - max time kernel
303s - max time network
175s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/07/2026, 00:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
malware_extraido.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
900 seconds
Behavioral task
behavioral2
Sample
malware_extraido.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
9 signatures
900 seconds
General
- Target malware_extraido.exe
- Size 5.7MB
- Sample260717-apl8dsbz9t
- SHA256 732e7cd508f08a38b7959ec0d8059509e52d50ae94c0e4e43927ce4e7fd13529
- MD5 7ea09d43d49d36fb30cb3f571dde6f2a
- SHA1 8728ac22986ae64eca111388cacca2fe389d62df
- SHA512 335d86622e9628b61ee676cf7831af03b39a858950ac108b10780ca71982e2b0e9ff2795885ae8f3398215826cde1193e337e391751825feee19db9576948419
- SSDEEP 49152:2JWJDsmXY5DReVjQH8Vguit9ph+rGgcbLFn3wWIaeMme88n2fEtKK+GntXYGwhXa:2re+3GhcnneJe88YWW
- TLSH T12F56CF53FA95C2E9C09EC1B8C71B5227EB72B88D0920B79B6BE84A113F57B205F4D354
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 Taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A Taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName Taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Taskmgr.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 4124 Taskmgr.exe 2684 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 4124 Taskmgr.exe Token: SeSystemProfilePrivilege 4124 Taskmgr.exe Token: SeCreateGlobalPrivilege 4124 Taskmgr.exe Token: 33 4124 Taskmgr.exe Token: SeIncBasePriorityPrivilege 4124 Taskmgr.exe Token: SeDebugPrivilege 2684 taskmgr.exe Token: SeSystemProfilePrivilege 2684 taskmgr.exe Token: SeCreateGlobalPrivilege 2684 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe 4124 Taskmgr.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4124 Taskmgr.exe 2684 taskmgr.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4884 wrote to memory of 4124 4884 launchtm.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\malware_extraido.exe"C:\Users\Admin\AppData\Local\Temp\malware_extraido.exe"1⤵PID:2408
-
C:\Windows\system32\launchtm.exelaunchtm.exe /21⤵
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Windows\System32\Taskmgr.exe"C:\Windows\System32\Taskmgr.exe" /22⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4124
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\malware_extraido.exe"C:\Users\Admin\AppData\Local\Temp\malware_extraido.exe"1⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\malware_extraido.exe"C:\Users\Admin\AppData\Local\Temp\malware_extraido.exe"1⤵PID:5616
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2684
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\TaskManager\settings.json
- Size 14KB
- SHA256 487ed43664046dd409e55d761fe78c7d4723b84e6915dfdeffcfbfb3842ff37e
- MD5 31049acfe87698244bc910e5c13c1d7d
- SHA1 d33d8956f6473de5cdc2dff1ec447ca817ebd954
- SHA512 86062aefbc9324dae73f655502442f9d608e414f5d6b04ec8fdcde300c1cc27d3868c5b865ec5c3ed4d2471ef2439944bcff9402cc7afa194b99d770d4ba6f3d
- SSDEEP 384:sriol3FwaVp8lzrZZrzDqT5fERZW7j5UVqdc741ybah:Giol3FwaVp8lzrZlCT5fERZW7j5UQh
- TLSH T103627929A465DE2C87A01ED02C3F294F5E963310BFE696F4E1FF4E0476818AD2326765
- MD5 SHA1 SHA512 SSDEEP TLSH