Analysis
- user interaction
yes - max time kernel
124s - max time network
117s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
10/08/2026, 21:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
SacredStep_BETA_v2.exe
Resource
win11-20260513-en
windows11-21h2-x64
8 signatures
150 seconds
General
- Target SacredStep_BETA_v2.exe
- Size 444KB
- Sample260810-z84dfstwex
- SHA256 526b85947cf0fba1df3e14ce8a3a7b5195174c291bf4402832066d770d786481
- MD5 06616776fb47f741e48fc0b492e1a2d3
- SHA1 9df433a7c21ef802b2ee4d0548ee57075a370475
- SHA512 7499f9ad8435102a743f45871ca3daff30eb33d48e142f92dc996ba2549a6b9e2866e4258ec585455f558197178169a7e126009ee5de380c7a94c4bf3e7855ef
- SSDEEP 12288:jJaJMaDvNtKqeVB3Iu5PulGYFBLqvqtNxWNjh45:jJaiQNo3IuYlzrqCtyNdY
- TLSH T1CEA4E16BB6E839F6E4B7527DC0631807A7267C760B549BCB42D013942E637E08D3BB52
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5736 run_19dc17c9.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.WindowsTerminal_8wekyb3d8bbwe\StartTerminalOnLoginTask taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5736 run_19dc17c9.exe 5736 run_19dc17c9.exe 5736 run_19dc17c9.exe 5736 run_19dc17c9.exe 5736 run_19dc17c9.exe 5736 run_19dc17c9.exe 5736 run_19dc17c9.exe 5736 run_19dc17c9.exe 5736 run_19dc17c9.exe 5736 run_19dc17c9.exe 5736 run_19dc17c9.exe 5736 run_19dc17c9.exe 5736 run_19dc17c9.exe 5736 run_19dc17c9.exe 5736 run_19dc17c9.exe 5736 run_19dc17c9.exe 5736 run_19dc17c9.exe 5736 run_19dc17c9.exe 5736 run_19dc17c9.exe 5736 run_19dc17c9.exe 5736 run_19dc17c9.exe 5736 run_19dc17c9.exe 5736 run_19dc17c9.exe 5736 run_19dc17c9.exe 5736 run_19dc17c9.exe 5736 run_19dc17c9.exe 5736 run_19dc17c9.exe 5736 run_19dc17c9.exe 5736 run_19dc17c9.exe 5736 run_19dc17c9.exe 5736 run_19dc17c9.exe 5736 run_19dc17c9.exe 5736 run_19dc17c9.exe 5736 run_19dc17c9.exe 5736 run_19dc17c9.exe 5736 run_19dc17c9.exe 5736 run_19dc17c9.exe 5736 run_19dc17c9.exe 5736 run_19dc17c9.exe 5736 run_19dc17c9.exe 5736 run_19dc17c9.exe 5736 run_19dc17c9.exe 5736 run_19dc17c9.exe 5736 run_19dc17c9.exe 5736 run_19dc17c9.exe 5736 run_19dc17c9.exe 5736 run_19dc17c9.exe 5736 run_19dc17c9.exe 5736 run_19dc17c9.exe 5736 run_19dc17c9.exe 5736 run_19dc17c9.exe 5736 run_19dc17c9.exe 5736 run_19dc17c9.exe 5736 run_19dc17c9.exe 5736 run_19dc17c9.exe 5736 run_19dc17c9.exe 5736 run_19dc17c9.exe 5736 run_19dc17c9.exe 5736 run_19dc17c9.exe 5736 run_19dc17c9.exe 5736 run_19dc17c9.exe 5736 run_19dc17c9.exe 5736 run_19dc17c9.exe 5736 run_19dc17c9.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1016 taskmgr.exe Token: SeSystemProfilePrivilege 1016 taskmgr.exe Token: SeCreateGlobalPrivilege 1016 taskmgr.exe Token: 33 1016 taskmgr.exe Token: SeIncBasePriorityPrivilege 1016 taskmgr.exe - Suspicious use of FindShellTrayWindow 57 IoCs
pid Process 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe - Suspicious use of SendNotifyMessage 57 IoCs
pid Process 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 6020 wrote to memory of 5736 6020 SacredStep_BETA_v2.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\SacredStep_BETA_v2.exe"C:\Users\Admin\AppData\Local\Temp\SacredStep_BETA_v2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:6020 -
C:\Users\Admin\AppData\Local\SacredStep\run_19dc17c9.exe"C:\Users\Admin\AppData\Local\SacredStep\run_19dc17c9.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5736
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1016
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1036
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\SacredStep\run_19dc17c9.exe
- Size 307KB
- SHA256 953caa3748bd07123f77a55a4525b49a33068523efe81476db5bbd93d8ce430c
- MD5 d049a79c374efeef6f8848ed148fc0b1
- SHA1 68175964c6386259209e0e71f0e04aac2b3f6c67
- SHA512 4dd7fe15f1fc69bf39e9623c862a8f9c4dd41fe19c9bb68f7ea53db7f7e943bef304ee9ea17cff66f83bb1f5aabe80c9f1972c76579288b530adddc2e42c2f4f
- SSDEEP 6144:o4/AWw/BqFcuJZ0tNRpQsDxIAyS4ld74d4HI3iAZg7GKMQ:F//O8JZTmd4onZcGM
- TLSH T112648D11E7A521FDE967C67CCA53A807EB3278410764DADB43608A972F37AD04E3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\SacredStep\config.ini
- Size 225B
- SHA256 b844cd9935b61d821e9718d726404f78f9dc741b74c21da5a739f477873b9907
- MD5 490e6941e6937a419683653cffde444d
- SHA1 ceb36748c2ead82f9943cd36e8ca873acb4553f8
- SHA512 c2b02162b36c8c6c62bcbcdac13119584f5af6e1125f389366ef9e9401b04501352f90e569b40bfb2211408adf6c0309493bc182da1e2ea17318282d4d13a690
- TLSH T1F4D022133AC044BA053A343585F008E078FD36312C0E66B5CACCA886DFA60E6C8FC70B
- MD5 SHA1 SHA512 TLSH