Analysis
- user interaction
yes - max time kernel
44s - max time network
44s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
18/07/2026, 22:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ODM5.exe
Resource
win11-20260513-en
windows11-21h2-x64
7 signatures
900 seconds
General
- Target ODM5.exe
- Size 852KB
- Sample260718-2c8dmset2j
- SHA256 d1557bc3f5d8542f9b7f8e80b02283397d2e437386a6662251c4fc7342167cda
- MD5 671797900c080bfe367fe7aadc47af16
- SHA1 34ff5741d5ab5bdef637a6c1429234cc9dd022cc
- SHA512 715cff6f6864de06c6f79a378da60f9d0a44ceb6f7059abb4450bd6f4184f00a442953b9c566477a6f527f724eebfe0fba30e80add66c62e9c6f31153a82208f
- SSDEEP 12288:s628L2HCSGt4FMz4+PUlv2kyK5yB1Tazo/UCjTMnvKdsoFwhiHBjBZo8:Z2HCSucMz4CYbV5yBtaziU0TcSNFPhL
- TLSH T1B0058E59A27401F6D9A78134C9569A4BD7B2781607205AEF03E06BB73F37BE11E3B321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.WindowsTerminal_8wekyb3d8bbwe\StartTerminalOnLoginTask taskmgr.exe - Suspicious behavior: EnumeratesProcesses 17 IoCs
pid Process 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1852 taskmgr.exe Token: SeSystemProfilePrivilege 1852 taskmgr.exe Token: SeCreateGlobalPrivilege 1852 taskmgr.exe Token: 33 1852 taskmgr.exe Token: SeIncBasePriorityPrivilege 1852 taskmgr.exe - Suspicious use of FindShellTrayWindow 43 IoCs
pid Process 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe - Suspicious use of SendNotifyMessage 43 IoCs
pid Process 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe 1852 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ODM5.exe"C:\Users\Admin\AppData\Local\Temp\ODM5.exe"1⤵PID:3960
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1852