Analysis
- user interaction
yes - max time kernel
899s - max time network
644s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/07/2026, 15:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
client.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
900 seconds
General
- Target client.exe
- Size 263KB
- Sample260727-sd5jpswsbw
- SHA256 f1496f7791fe74fa7c606dbe858a31c444ea1f39b4480d6ee6421afd665e4fe6
- MD5 306d2fbfcb9e2c9ad7846958710d8076
- SHA1 259301a42ec0ab34560c8f083c10ff4b24fbfcff
- SHA512 dbf98ca01e79f8895fd4fe2e1a045c9186a49ada904a401efe2bc841c47cf4d6ce9659101ee7e58e75e28b829684c35811a544c44189268ecd1f705c01b3571c
- SSDEEP 6144:3qHw8z1kxb+1jVaX959l9hbCrKhE+MFUD9jGK:aQa1Mzw8
- TLSH T1A144191BE3A254FDC517D17982AB92B2E532F8140330AA6F1B84DF333F66D604A5DB54
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Creates a file in the Startup directory 1 TTPs 2 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe client.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe client.exe - Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 26 pastebin.com 1 pastebin.com 11 pastebin.com - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Opens file in notepad (likely ransom note) 1 IoCs
pid Process 2512 NOTEPAD.EXE - Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 5708 taskmgr.exe Token: SeSystemProfilePrivilege 5708 taskmgr.exe Token: SeCreateGlobalPrivilege 5708 taskmgr.exe Token: 33 5708 taskmgr.exe Token: SeIncBasePriorityPrivilege 5708 taskmgr.exe - Suspicious use of FindShellTrayWindow 36 IoCs
pid Process 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe - Suspicious use of SendNotifyMessage 36 IoCs
pid Process 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe 5708 taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5708 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\client.exe"C:\Users\Admin\AppData\Local\Temp\client.exe"1⤵
- Creates a file in the Startup directory
PID:5856
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5708
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4512
-
C:\Users\Admin\Desktop\client.exe"C:\Users\Admin\Desktop\client.exe"1⤵
- Creates a file in the Startup directory
PID:4748
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Windows\Temp\log.txt1⤵
- Opens file in notepad (likely ransom note)
PID:2512
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:3592
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵PID:1172
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\4693a935-4f5d-4672-9858-88be2db7b5ac.tmp
- Size 10KB
- SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
- MD5 78e47dda17341bed7be45dccfd89ac87
- SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
- SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
- SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
- TLSH T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\9192b61c-ae14-40ce-8864-200c82499534.tmp
- Size 152KB
- SHA256 f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
- MD5 d2e80cd29c43ea745d16284dc1f58ea6
- SHA1 53fe0165f9f303b333be9284865c8a74f3553c0b
- SHA512 375fd3e65b12f80b92a63c1cf6f0ace9fe878c1a0cb5179d869c99aad0cfde14715fd1499eab22a04f353e5f292c19d6a5aeccb43ec2ff5cd6878a5226b005ca
- SSDEEP 3072:bHVqfst2F+fBXzSKmg3n0OIH1iCylcLMLgaK9enj59Ah8MuBX8Yk17CF:b1qkfBXG801idlcLMLgaOeV9A2XdBkda
- TLSH T1DBE3E13C3EDACD26C21B20F97F287587C54D8F17A10BA50BE14A84015A76B5E17E2DEE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\AdobeSFX.log
- Size 1KB
- SHA256 cfa606dc54f83a856fda1057b06d5c0900308b52821285b82528c9e95eaa5e87
- MD5 5b5bc8e545968b5a251a062bcfc7a8e4
- SHA1 826ba3742cc78733b0d19714c5a74c0860cee543
- SHA512 9b057ed6a3ff0a470793626d2d41061f95bd0093337662c3210dbcd5532d4ab2956e51e56fe73ea938e9832cbd868b399186ff42f3cf05606dc814ca49444292
- TLSH T1E74177458B9F41F52601C089B27E7DFEC9E0F91B3F55DA70674542093344AABDE8B542
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~DF1946B9A43C850B94.TMP
- Size 16KB
- SHA256 205d000aa762f3a96ac3ad4b25d791b5f7fc8efb9056b78f299f671a02b9fd21
- MD5 679672a5004e0af50529f33db5469699
- SHA1 427a4ec3281c9c4faeb47a22ffbe7ca3e928afb0
- SHA512 f8615c5e5cf768a94e06961c7c8bef99beb43e004a882a4e384f5dd56e047ca59b963a59971f78dcf4c35d1bb92d3a9bc7055bfa3a0d597635de1a9ce06a3476
- SSDEEP 3:YmsalTlLPltl2N81HRQjlORGt7RQ//W1XR9//3R9//3R9//:rl912N0xs+CFQXCB9Xh9Xh9X
- TLSH T19B7202427234D665D54809368D41D5CC9776BD00DE14D14375DA775F0A314E04454652
- MD5 SHA1 SHA512 SSDEEP TLSH