Analysis
- user interaction
yes - max time kernel
141s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
17/07/2026, 01:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
reboot_launcher.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
reboot_launcher.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target reboot_launcher.exe
- Size 86KB
- Sample260717-bmsg3acw2s
- SHA256 07a3f464e479003a9c598cb8a8feab17cc55298d74de34315ae78c31256fb9c7
- MD5 0a99c1fbc2e19352240c29620e90ce32
- SHA1 660838cdb049777eec8c9fb32ee74605fb75c3ca
- SHA512 b79200fe59fda6b04783dbf497c9cae62ef93ae288e013426c316dae645c76ae7a0632a901f469caa763abcc5b3082f52762e53d7dab00d9f9bd716f4e12d491
- SSDEEP 1536:Zf1w1URPkttf87x1k2zaspKmJ/G6huT06G69nlE14x8hoUE3xIN1dh4+Y0e2QpoR:115RMEnk2uWKmJ/G6hujG69mkN3xI7TJ
- TLSH T12083AE17B3A901E9E79A433C8A531E89D376BC491765D7CF07D0822B1F63AD0AD3B650
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 Taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A Taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName Taskmgr.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Taskmgr.exe - Suspicious behavior: EnumeratesProcesses 33 IoCs
pid Process 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe - Suspicious use of AdjustPrivilegeToken 47 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1680 WMIC.exe Token: SeSecurityPrivilege 1680 WMIC.exe Token: SeTakeOwnershipPrivilege 1680 WMIC.exe Token: SeLoadDriverPrivilege 1680 WMIC.exe Token: SeSystemProfilePrivilege 1680 WMIC.exe Token: SeSystemtimePrivilege 1680 WMIC.exe Token: SeProfSingleProcessPrivilege 1680 WMIC.exe Token: SeIncBasePriorityPrivilege 1680 WMIC.exe Token: SeCreatePagefilePrivilege 1680 WMIC.exe Token: SeBackupPrivilege 1680 WMIC.exe Token: SeRestorePrivilege 1680 WMIC.exe Token: SeShutdownPrivilege 1680 WMIC.exe Token: SeDebugPrivilege 1680 WMIC.exe Token: SeSystemEnvironmentPrivilege 1680 WMIC.exe Token: SeRemoteShutdownPrivilege 1680 WMIC.exe Token: SeUndockPrivilege 1680 WMIC.exe Token: SeManageVolumePrivilege 1680 WMIC.exe Token: 33 1680 WMIC.exe Token: 34 1680 WMIC.exe Token: 35 1680 WMIC.exe Token: 36 1680 WMIC.exe Token: SeDebugPrivilege 4492 Taskmgr.exe Token: SeSystemProfilePrivilege 4492 Taskmgr.exe Token: SeCreateGlobalPrivilege 4492 Taskmgr.exe Token: SeIncreaseQuotaPrivilege 1680 WMIC.exe Token: SeSecurityPrivilege 1680 WMIC.exe Token: SeTakeOwnershipPrivilege 1680 WMIC.exe Token: SeLoadDriverPrivilege 1680 WMIC.exe Token: SeSystemProfilePrivilege 1680 WMIC.exe Token: SeSystemtimePrivilege 1680 WMIC.exe Token: SeProfSingleProcessPrivilege 1680 WMIC.exe Token: SeIncBasePriorityPrivilege 1680 WMIC.exe Token: SeCreatePagefilePrivilege 1680 WMIC.exe Token: SeBackupPrivilege 1680 WMIC.exe Token: SeRestorePrivilege 1680 WMIC.exe Token: SeShutdownPrivilege 1680 WMIC.exe Token: SeDebugPrivilege 1680 WMIC.exe Token: SeSystemEnvironmentPrivilege 1680 WMIC.exe Token: SeRemoteShutdownPrivilege 1680 WMIC.exe Token: SeUndockPrivilege 1680 WMIC.exe Token: SeManageVolumePrivilege 1680 WMIC.exe Token: 33 1680 WMIC.exe Token: 34 1680 WMIC.exe Token: 35 1680 WMIC.exe Token: 36 1680 WMIC.exe Token: 33 4492 Taskmgr.exe Token: SeIncBasePriorityPrivilege 4492 Taskmgr.exe - Suspicious use of FindShellTrayWindow 58 IoCs
pid Process 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe - Suspicious use of SendNotifyMessage 58 IoCs
pid Process 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe 4492 Taskmgr.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3904 wrote to memory of 4492 3904 cmd.exe 106 PID 3904 wrote to memory of 1680 3904 cmd.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\reboot_launcher.exe"C:\Users\Admin\AppData\Local\Temp\reboot_launcher.exe"1⤵PID:3912
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Windows\system32\Taskmgr.exetaskmgr2⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4492
-
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1680
-