Analysis
- user interaction
yes - max time kernel
150s - max time network
148s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
08/08/2026, 00:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
axyet.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
axyet.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
10 signatures
150 seconds
General
- Target axyet.exe
- Size 7.0MB
- Sample260808-alqreawcqa
- SHA256 923f6459be83f607669ac613ce5229e505187842ef77d86b98008f8be5e135c1
- MD5 c82e733f4056dab3418a1bc42d5c42a4
- SHA1 78ce894db9ab0246935af749bbcf8cceedcfa1b8
- SHA512 c05ae54caf337f017a367893196503f7e9547542dada7fd223c3a76978fa7ddde06345aad62a74858f8cd216acfeb538f73339165244d7a80c4c9e7f96675827
- SSDEEP 98304:KktiYkwt4pdBWYfk3CeaFOumvBh8huTAE:Kbdwt4pjnM3CFE
- TLSH T131763907ECA554E9C0AEC13189639562BF717C485B3123D32B50F6386F76BE0AEBA750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 1248 axyet.exe 3900 axyet.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4456 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3960 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3960 taskmgr.exe Token: SeSystemProfilePrivilege 3960 taskmgr.exe Token: SeCreateGlobalPrivilege 3960 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe 3960 taskmgr.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3828 wrote to memory of 4456 3828 axyet.exe 83 PID 3828 wrote to memory of 1248 3828 axyet.exe 86 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\axyet.exe"C:\Users\Admin\AppData\Local\Temp\axyet.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Windows\system32\schtasks.exeschtasks /Create /XML C:\Users\Admin\AppData\Local\Temp\axyet_task.xml /TN axyet /F2⤵
- Scheduled Task/Job: Scheduled Task
PID:4456
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\axyet.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\axyet.exe2⤵
- Executes dropped EXE
PID:1248
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\axyet.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\axyet.exe"1⤵
- Executes dropped EXE
PID:3900
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3960
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\axyet_task.xml
- Size 1KB
- SHA256 8705a4dee48c429f5e4062092fb4c722bfdde079c8833164b24311d0e7834032
- MD5 682a76f177fbf8fab953cfab5db30eeb
- SHA1 d6a291da66bdd64f6f0178013c67b0ec3f1d0c3f
- SHA512 b0899dbd9b599244e43e1532d1a6519057ec46e1045d4864e8fbfef18152713f228165c6765e45b49bda05c03c423a55c0ba367b20cbda18dbf933b411156e12
- TLSH T1EA2135905C14F21FB556563ACB921783373E5B654AB14039D8CC4DBC748A1CA711397B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\axyet.exe
- Size 7.0MB
- SHA256 923f6459be83f607669ac613ce5229e505187842ef77d86b98008f8be5e135c1
- MD5 c82e733f4056dab3418a1bc42d5c42a4
- SHA1 78ce894db9ab0246935af749bbcf8cceedcfa1b8
- SHA512 c05ae54caf337f017a367893196503f7e9547542dada7fd223c3a76978fa7ddde06345aad62a74858f8cd216acfeb538f73339165244d7a80c4c9e7f96675827
- SSDEEP 98304:KktiYkwt4pdBWYfk3CeaFOumvBh8huTAE:Kbdwt4pjnM3CFE
- TLSH T131763907ECA554E9C0AEC13189639562BF717C485B3123D32B50F6386F76BE0AEBA750
- MD5 SHA1 SHA512 SSDEEP TLSH