Analysis
- user interaction
yes - max time kernel
116s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/07/2026, 04:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
vex - cracked.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
900 seconds
Behavioral task
behavioral2
Sample
vex - cracked.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
9 signatures
900 seconds
General
- Target vex - cracked.exe
- Size 3.3MB
- Sample260717-flb6xabs5p
- SHA256 0a02a538aff69b104f536985edd0fad9781657ca375fc30aefc1264ba142a441
- MD5 34c25fecc777476f6d8791707294eae9
- SHA1 95c51eebd0ec02c2d54fd8de98104d1c8da1cfeb
- SHA512 05149cacaaf386b3350bdf8a8dde18f0e06fb9b53a3acb58418b82933ed8bc6c2ba974c2feb0d47fc6c3b6b32c7a24599ae76887148ac10d4ff423ed0db90489
- SSDEEP 49152:5DyRuNkpI544DWIw7rn6ODcrpWGeMMoT8+HE92hGLwE8Pnm8gapl/:ot64bVc1Wj+pl/
- TLSH T1F3F5C226A2A0419BC327DD7841CDD232A6E13CFC8AD4B19F96D07D977A126F019ED23D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4620 vex - cracked.exe 4620 vex - cracked.exe 4620 vex - cracked.exe 4620 vex - cracked.exe 4620 vex - cracked.exe 4620 vex - cracked.exe 4620 vex - cracked.exe 4620 vex - cracked.exe 4620 vex - cracked.exe 4620 vex - cracked.exe 4620 vex - cracked.exe 4620 vex - cracked.exe 4620 vex - cracked.exe 4620 vex - cracked.exe 4620 vex - cracked.exe 4620 vex - cracked.exe 4620 vex - cracked.exe 4620 vex - cracked.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 4620 vex - cracked.exe 2560 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 29 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4620 vex - cracked.exe Token: SeSecurityPrivilege 4620 vex - cracked.exe Token: SeTakeOwnershipPrivilege 4620 vex - cracked.exe Token: SeLoadDriverPrivilege 4620 vex - cracked.exe Token: SeSystemProfilePrivilege 4620 vex - cracked.exe Token: SeSystemtimePrivilege 4620 vex - cracked.exe Token: SeProfSingleProcessPrivilege 4620 vex - cracked.exe Token: SeIncBasePriorityPrivilege 4620 vex - cracked.exe Token: SeCreatePagefilePrivilege 4620 vex - cracked.exe Token: SeBackupPrivilege 4620 vex - cracked.exe Token: SeRestorePrivilege 4620 vex - cracked.exe Token: SeShutdownPrivilege 4620 vex - cracked.exe Token: SeDebugPrivilege 4620 vex - cracked.exe Token: SeSystemEnvironmentPrivilege 4620 vex - cracked.exe Token: SeChangeNotifyPrivilege 4620 vex - cracked.exe Token: SeRemoteShutdownPrivilege 4620 vex - cracked.exe Token: SeUndockPrivilege 4620 vex - cracked.exe Token: SeManageVolumePrivilege 4620 vex - cracked.exe Token: SeImpersonatePrivilege 4620 vex - cracked.exe Token: SeCreateGlobalPrivilege 4620 vex - cracked.exe Token: 33 4620 vex - cracked.exe Token: 34 4620 vex - cracked.exe Token: 35 4620 vex - cracked.exe Token: 36 4620 vex - cracked.exe Token: SeDebugPrivilege 2560 taskmgr.exe Token: SeSystemProfilePrivilege 2560 taskmgr.exe Token: SeCreateGlobalPrivilege 2560 taskmgr.exe Token: 33 2560 taskmgr.exe Token: SeIncBasePriorityPrivilege 2560 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe 2560 taskmgr.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4620 vex - cracked.exe 4620 vex - cracked.exe 2560 taskmgr.exe 2560 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\vex - cracked.exe"C:\Users\Admin\AppData\Local\Temp\vex - cracked.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4620
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2560
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:648
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:5500