Analysis
- user interaction
yes - max time kernel
29s - max time network
50s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/08/2026, 13:03
Static task
static1
Behavioral task
behavioral1
Sample
Gameplay (1).zip
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
Gameplay (1).zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
Gameplay/Character/Cosmetics/Cosmetics.uasset
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
Gameplay/Character/Cosmetics/Cosmetics.uasset
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral5
Sample
Gameplay/Character/Cosmetics/Cosmetics.uexp
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral6
Sample
Gameplay/Character/Cosmetics/Cosmetics.uexp
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target Gameplay (1).zip
- Size 51KB
- Sample260805-qaspmaba59
- SHA256 663ab1c75980a260adaae6359289da27654a9116a307d483e0570263cb985fd8
- MD5 83d4416366538f479e03d6e5f886edae
- SHA1 9adc408b1999081a7556291011de46a8785f7d72
- SHA512 91f2b6a555d6c4d92ca6995d6392ef9689ee82b4cbf723329335d1ff621c887d099d4cf38258b78d07de5dc78bea5d67671bfaf71aa7efe9a91a436730333af0
- SSDEEP 768:yxJWgUtgbaMqTrrLr8cpsSZ+2/Svqpi7RC6kuiub+2zNEmu/UIrySb2cgmS:AJWZzb8cp+iSyQRDkuiAzN5uvKcC
- TLSH T1B633F1E4CF4FA53AE59EFC3B604FD25C45B2FAE87218645C20C1574235EEDE01527986
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Suspicious behavior: EnumeratesProcesses 44 IoCs
pid Process 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5904 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 5904 taskmgr.exe Token: SeSystemProfilePrivilege 5904 taskmgr.exe Token: SeCreateGlobalPrivilege 5904 taskmgr.exe - Suspicious use of FindShellTrayWindow 23 IoCs
pid Process 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe - Suspicious use of SendNotifyMessage 23 IoCs
pid Process 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 5904 taskmgr.exe 5904 taskmgr.exe 5904 taskmgr.exe
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\Gameplay (1).zip"1⤵PID:4344
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5904