Analysis
- user interaction
yes - max time kernel
160s - max time network
159s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/07/2026, 02:27
Behavioral task
behavioral1
Sample
WMIsave.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
WMIsave.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target WMIsave.exe
- Size 789.6MB
- Sample260724-cxtzbaeb85
- SHA256 d3fc5ed15a97063e804664d5f379bb7454d103b4defa9ac9e788f1eaa922a675
- MD5 ee3c7e18ad5d6da18d038f8320067785
- SHA1 43daf7a2821eaa313938ee4e5dc3aa18836d6a61
- SHA512 a749151a83a8f756e5b9142b55a4b3f5a03f0bef017936068d0036bdd25f85d9db9a33e09cb02b5ebce9dab2357f3190dd1061dfa36d811537bd880ba05e854d
- SSDEEP 196608:c6zHrw2lEIhB36XSqhVtEtSAyyyf7X2jKOaYCXht:c6zHMyX336XSqG87X2jKOaZt
- TLSH T16089335D961B8C13E666973EF7C43849A225106EC9CB1883710EFDC716B69B0317ABCB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/5928-0-0x00007FF6A0A30000-0x00007FF6A22E7000-memory.dmp upx behavioral2/memory/5928-2-0x00007FF6A0A30000-0x00007FF6A22E7000-memory.dmp upx behavioral2/memory/5928-4-0x00007FF6A0A30000-0x00007FF6A22E7000-memory.dmp upx behavioral2/memory/5928-5-0x00007FF6A0A30000-0x00007FF6A22E7000-memory.dmp upx behavioral2/memory/5928-6-0x00007FF6A0A30000-0x00007FF6A22E7000-memory.dmp upx behavioral2/memory/5928-32-0x00007FF6A0A30000-0x00007FF6A22E7000-memory.dmp upx behavioral2/memory/5928-39-0x00007FF6A0A30000-0x00007FF6A22E7000-memory.dmp upx behavioral2/memory/5928-42-0x00007FF6A0A30000-0x00007FF6A22E7000-memory.dmp upx - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings taskmgr.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 5928 WMIsave.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5672 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 5672 taskmgr.exe Token: SeSystemProfilePrivilege 5672 taskmgr.exe Token: SeCreateGlobalPrivilege 5672 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe - Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe 5672 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\WMIsave.exe"C:\Users\Admin\AppData\Local\Temp\WMIsave.exe"1⤵
- Suspicious behavior: AddClipboardFormatListener
PID:5928
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5672
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:5868
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3508