Analysis
- user interaction
yes - max time kernel
148s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 11:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
mksquircles.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
mksquircles.pck
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target mksquircles.exe
- Size 98.6MB
- Sample260809-nw49faek6x
- SHA256 fd4f694be7a03283930b0967f4ddc02bce35afbf8a0809ed6b0eb435c8d021a1
- MD5 6311eb6b315e6cf150f26d0c10cf17ba
- SHA1 00438ad9eaf4306be3ed857af4d7b1ea2c581609
- SHA512 7acfc3e437815a208d0a1591610f068816b5539ed52d5ffbdc66a43fa9264deda0b312c3135f83755f9827cd6bf76968a0e4c3e4a52f132aceae028b3f7e5eb0
- SSDEEP 1572864:3UDbETnRB9wNCyBFsouq4TK3QxvnknWpkjMYMAM:CbGDlmqkofH
- TLSH T154383B43F2B370ECC56BC23492D76633FA33B85951386E6AD6A4CB742F21E505729E24
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Kills process with taskkill 2 IoCs
pid Process 2868 taskkill.exe 4060 taskkill.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings mksquircles.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4944 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 4944 taskmgr.exe Token: SeSystemProfilePrivilege 4944 taskmgr.exe Token: SeCreateGlobalPrivilege 4944 taskmgr.exe Token: SeDebugPrivilege 2868 taskkill.exe Token: SeDebugPrivilege 4060 taskkill.exe Token: SeDebugPrivilege 2516 powershell.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2508 mksquircles.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe - Suspicious use of SetWindowsHookEx 9 IoCs
pid Process 2508 mksquircles.exe 2508 mksquircles.exe 2508 mksquircles.exe 2508 mksquircles.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe 4944 taskmgr.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3928 wrote to memory of 2868 3928 cmd.exe 95 PID 3928 wrote to memory of 4060 3928 cmd.exe 97 PID 3928 wrote to memory of 2516 3928 cmd.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\mksquircles.exe"C:\Users\Admin\AppData\Local\Temp\mksquircles.exe"1⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2508
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4944
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Windows\system32\taskkill.exetaskkill /f /im csrss.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2868
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im wininit.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4060
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2516
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"1⤵PID:2020