Analysis
- user interaction
yes - max time kernel
599s - max time network
553s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
24/07/2026, 16:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bQ5KWE.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
7 signatures
600 seconds
General
- Target bQ5KWE.exe
- Size 145KB
- Sample260724-tkcypsgn4z
- SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
- MD5 5251b98614acffe5c856f4039ca03da3
- SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
- SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
- SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
- TLSH T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bQ5KWE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bQ5KWE.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4636 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4636 taskmgr.exe Token: SeSystemProfilePrivilege 4636 taskmgr.exe Token: SeCreateGlobalPrivilege 4636 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bQ5KWE.exe"C:\Users\Admin\AppData\Local\Temp\bQ5KWE.exe"1⤵
- System Location Discovery: System Language Discovery
PID:3672
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4636
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:5864
-
C:\Users\Admin\AppData\Local\Temp\bQ5KWE.exe"C:\Users\Admin\AppData\Local\Temp\bQ5KWE.exe"1⤵
- System Location Discovery: System Language Discovery
PID:4480