Analysis
- user interaction
yes - max time kernel
900s - max time network
619s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/08/2026, 03:07
Behavioral task
behavioral1
Sample
Cypter Server v2.0.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
900 seconds
Behavioral task
behavioral2
Sample
Cypter Server v2.0/CrackedBySamuriCypter Server v2.0.1/CrackedBySamuriCypter.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
900 seconds
Behavioral task
behavioral3
Sample
Cypter Server v2.0/CrackedBySamuriCypter Server v2.0.1/Ktama Crypter Server v2.0.1.exe.xml
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
900 seconds
Behavioral task
behavioral4
Sample
Cypter Server v2.0/CrackedBySamuriCypter Server v2.0.1/Ktama Crypter Server v2.0.1.png
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
900 seconds
Behavioral task
behavioral5
Sample
Cypter Server v2.0/CrackedBySamuriCypter Server v2.0.1/RuntimeBroker.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
900 seconds
Behavioral task
behavioral6
Sample
Cypter Server v2.0/CrackedBySamuriCypter Server v2.0.1/Stub.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
General
- Target Cypter Server v2.0.zip
- Size 17.1MB
- Sample260804-dmstyafk2s
- SHA256 93ff00efa98418d5fac3064a6df9535b2f55d3236b827ab50957044532c90aa3
- MD5 a1b7964306b99968c33ab6a7ded2bb4d
- SHA1 1ff758e1e1bca338e96151b426e10f7e24320906
- SHA512 deb9a8001a0d972881ceb6d9c22adb1927ae04751c54ef65df52ae0bbd28d94e0fc312ff239ec078061f5aa543678a6b442b295bad9cae63e45325570e6b7c62
- SSDEEP 393216:kJL9QlqkYEl5YjWuSLUxJEI0DQOnJ0z0vyoSQfTqKTh9E2uC:k5ZkX5NuSgxI3nU0dSUW6h
- TLSH T15E07334545C38A23C854F233DB755B692226BF3878E4EBF0EB289C1942E54E8D67C6F4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4812 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4812 taskmgr.exe Token: SeSystemProfilePrivilege 4812 taskmgr.exe Token: SeCreateGlobalPrivilege 4812 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\Cypter Server v2.0.zip"1⤵PID:3760
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4812