Analysis
- user interaction
yes - max time kernel
150s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/08/2026, 14:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Among Us.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target Among Us.exe
- Size 651KB
- Sample260819-rm3wsswcph
- SHA256 209d0cda85a2f86a46b6f3f97843dfee86d18259c987708376f6e1bf87d208e3
- MD5 b90b3d839872ae022e37a87b9636081c
- SHA1 d3ee59ea8493a4f36a5acffafd42ea85a1928a9c
- SHA512 6af2adb57de70224bbec93d8ea76112edba5f192bfd56af610afe3607a179c6c3d0a468e6959c8a71bf8f27b4a341f6a1ebefe631fb18451c244c5264a1ecb65
- SSDEEP 3072:SQJ/VdFgIW9mYucJ/OD8JlsI9TTItTukyyj0+5snQw:7/7FG9mpcJ/OD8WYkV5sn9
- TLSH T166E412EB3E68098FD251147FCC718A63895B6C696B058D4D75B33BAE4C204357EB2A0F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe - Suspicious behavior: EnumeratesProcesses 61 IoCs
pid Process 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4780 taskmgr.exe Token: SeSystemProfilePrivilege 4780 taskmgr.exe Token: SeCreateGlobalPrivilege 4780 taskmgr.exe Token: 33 4780 taskmgr.exe Token: SeIncBasePriorityPrivilege 4780 taskmgr.exe - Suspicious use of FindShellTrayWindow 47 IoCs
pid Process 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe - Suspicious use of SendNotifyMessage 47 IoCs
pid Process 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe 4780 taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4780 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Among Us.exe"C:\Users\Admin\AppData\Local\Temp\Among Us.exe"1⤵PID:3276
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4780
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:2264