Analysis
- user interaction
yes - max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/08/2026, 03:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Beg.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
Beg.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
General
- Target Beg.exe
- Size 63.7MB
- Sample260803-d2qccsbp2x
- SHA256 b6e4bb62094652d1226d00dabc8abfe38e41c2a92b3cc80c34959607c6dd5923
- MD5 657a5cb300e274e2e477f5a33c783522
- SHA1 7775f7b04fc73e62b4cf1f60bf685901661c55b3
- SHA512 835c1af74ceb3899f9c66ca77629a2b49cfca91315c073eea412d384fc267454b8bf8f348036d86d91508d6f82f8db28ef1a54cae342de13fb9788aaa6866a59
- SSDEEP 786432:IpxXiUidVwFej7zBIsQmhiJe+bjVkacXrAB:IpxXiUi/wFevz6sQmhiJe+bhkm
- TLSH T124E7724C24500AE5915BE815EAABCF1B5FE9D6EB4BE8244DBCA88E344CD3CB71D1074B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1420 beg_temp.exe - Stops running service(s) 4 TTPs
- Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1164 sc.exe - Executes a command shell one-liner 1 TTPs 3 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3004 cmd.exe 2524 cmd.exe 572 cmd.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2728 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2728 taskmgr.exe Token: SeSystemProfilePrivilege 2728 taskmgr.exe Token: SeCreateGlobalPrivilege 2728 taskmgr.exe Token: 33 2728 taskmgr.exe Token: SeIncBasePriorityPrivilege 2728 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe 2728 taskmgr.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 5648 wrote to memory of 1420 5648 Beg.exe 91 PID 1420 wrote to memory of 3004 1420 beg_temp.exe 93 PID 1420 wrote to memory of 2524 1420 beg_temp.exe 94 PID 2524 wrote to memory of 5588 2524 cmd.exe 97 PID 1420 wrote to memory of 572 1420 beg_temp.exe 100 PID 572 wrote to memory of 1164 572 cmd.exe 101 - Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 5588 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Beg.exe"C:\Users\Admin\AppData\Local\Temp\Beg.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5648 -
C:\Users\Admin\AppData\Local\Temp\beg_temp.exe"C:\Users\Admin\AppData\Local\Temp\beg_temp.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c title 56697374613⤵
- Executes a command shell one-liner
PID:3004
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c attrib -h -s "C:\Users\Admin\AppData\Local\Temp\server.pfx"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\system32\attrib.exeattrib -h -s "C:\Users\Admin\AppData\Local\Temp\server.pfx"4⤵
- Views/modifies file attributes
PID:5588
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop vgc >nul 2>&13⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Windows\system32\sc.exesc stop vgc4⤵
- Launches sc.exe
PID:1164
-
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2728
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:2900
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1980
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1System Services
1Service Execution
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
1