Analysis
- user interaction
yes - max time kernel
76s - max time network
74s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/07/2026, 22:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
AisakaLauncher.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
AisakaLauncher.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target AisakaLauncher.exe
- Size 5.6MB
- Sample260724-2kbpmsvcmd
- SHA256 617d9914666c2d73bd62ccb4755a7a953241fea44366f5fc3103f2a341458112
- MD5 39be1ecc3ad934725810bf219035eec1
- SHA1 68c3462a4708e83397bff0116a2cc8a58fe0355c
- SHA512 7795bd935bccced09f0bc17449884da2b84201d448057d1dc8138a1bebf57fa96b99cdb5dc0301feaf9da85e1873ff1ee80775e1cbf48e1e6a9abb8dc00fb152
- SSDEEP 98304:tL4gcqcv26HZbe/d1qgBTzT0OOP6J/ymWQ+m:14gcqcv26HZbe/d1qgBTzT0OOP6J/BDx
- TLSH T1D8469D69A6BC00D5E46A81BDC2825227DB72BC1417B117CF5A64BAF51F33AE01FBB740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4316 AisakaLauncher.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4608 taskmgr.exe Token: SeSystemProfilePrivilege 4608 taskmgr.exe Token: SeCreateGlobalPrivilege 4608 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4608 taskmgr.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1348 wrote to memory of 4316 1348 AisakaLauncher.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\AisakaLauncher.exe"C:\Users\Admin\AppData\Local\Temp\AisakaLauncher.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Users\Admin\AppData\Local\Aisaka\AisakaLauncher.exe"C:\Users\Admin\AppData\Local\Aisaka\AisakaLauncher.exe"2⤵
- Executes dropped EXE
PID:4316
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4608
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:1148
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4132
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Aisaka\AisakaLauncher.exe
- Size 5.6MB
- SHA256 617d9914666c2d73bd62ccb4755a7a953241fea44366f5fc3103f2a341458112
- MD5 39be1ecc3ad934725810bf219035eec1
- SHA1 68c3462a4708e83397bff0116a2cc8a58fe0355c
- SHA512 7795bd935bccced09f0bc17449884da2b84201d448057d1dc8138a1bebf57fa96b99cdb5dc0301feaf9da85e1873ff1ee80775e1cbf48e1e6a9abb8dc00fb152
- SSDEEP 98304:tL4gcqcv26HZbe/d1qgBTzT0OOP6J/ymWQ+m:14gcqcv26HZbe/d1qgBTzT0OOP6J/BDx
- TLSH T1D8469D69A6BC00D5E46A81BDC2825227DB72BC1417B117CF5A64BAF51F33AE01FBB740
- MD5 SHA1 SHA512 SSDEEP TLSH