Analysis
- user interaction
yes - max time kernel
68s - max time network
118s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 22:00
Static task
static1
Behavioral task
behavioral1
Sample
NancyDrew4Pack-StayTunedForDanger.iso
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
300 seconds
General
- Target NancyDrew4Pack-StayTunedForDanger.iso
- Size 679.4MB
- Sample260804-1wn9fa1ene
- SHA256 0d8c91da458f96e9232fde83c72a1710818686ae1282e58b005ea7efa2716d8c
- MD5 d581d17c3387b81a11b738d854d8b4bb
- SHA1 6b89ded5b2b1193b61746f10b0882c402ea67a5a
- SHA512 1ee59b8d25ac358ec4050fd1eef17c632e2eed8c6ad118c131d514f97a2bf6503938f196aa6aaea3b2ead79092f5135b9d879ec5417cbf9bc932feb17fb81912
- SSDEEP 12582912:hSdfIOpgQvAQIs7rquOgLZogrifyxemg5ZJalc/9O+PszFG2ZkVat4HaCl93T:hSdj/APs73LGgzxslcc/9O+PMFd+1l9j
- TLSH T1B379F1DE70A17406DD0A4275EE7DD7ACB7896C808F6C979B1124FF6900762E8C5B2B83
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5800 cmd.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4164 taskmgr.exe Token: SeSystemProfilePrivilege 4164 taskmgr.exe Token: SeCreateGlobalPrivilege 4164 taskmgr.exe - Suspicious use of FindShellTrayWindow 54 IoCs
pid Process 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe - Suspicious use of SendNotifyMessage 54 IoCs
pid Process 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4164 taskmgr.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\NancyDrew4Pack-StayTunedForDanger.iso1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:5800
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4164
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:4844