Analysis
- user interaction
yes - max time kernel
22s - max time network
23s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
05/08/2026, 04:37
Static task
static1
Behavioral task
behavioral1
Sample
rapid.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
rapid.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target rapid.exe
- Size 170KB
- Sample260805-e81bksde58
- SHA256 1536a031601814633d7b3ff9ec7fcc2be613d5de6380fc7cc3cfb5392f6d9ab4
- MD5 b32e580185a128f9e8c65ce3e27a0692
- SHA1 336a5c6cda64d882e980e18f5c48a3d2dfa4f8a4
- SHA512 73ddb84c7d0f3496c775b432dfd24dff4b5ddf5730402067286e5d522a0f1a590eebad75d556c6435c3a26e2ad34212f6763decc423c027075e319556be1ea19
- SSDEEP 3072:Q5vnr5Tbx829UOeKnn2LFzZBp13u36wKp4zULCQodn0b6ipfS0:QBKjK2LFzZNfIUL9k02yF
- TLSH T1DA04080662AB31A8D1B7B23889BF8512F7763C15473186DF13904A7B2FE66D0AE77311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe - Suspicious behavior: EnumeratesProcesses 17 IoCs
pid Process 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2068 taskmgr.exe Token: SeSystemProfilePrivilege 2068 taskmgr.exe Token: SeCreateGlobalPrivilege 2068 taskmgr.exe Token: 33 2068 taskmgr.exe Token: SeIncBasePriorityPrivilege 2068 taskmgr.exe - Suspicious use of FindShellTrayWindow 40 IoCs
pid Process 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe - Suspicious use of SendNotifyMessage 40 IoCs
pid Process 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe 2068 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\rapid.exe"C:\Users\Admin\AppData\Local\Temp\rapid.exe"1⤵PID:3376
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2068