Analysis
- user interaction
yes - max time kernel
96s - max time network
112s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/08/2026, 19:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
yr9bkiskp3bgpy0s.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
yr9bkiskp3bgpy0s.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target yr9bkiskp3bgpy0s.exe
- Size 391KB
- Sample260825-ym79vaycng
- SHA256 8f5f5f442f3a6025210b614f39bcb04a9a14e9cb76f3d1c0d80570f714f30a72
- MD5 2fbb69a212c9b31bebfd2089e821023b
- SHA1 410fedc3e2b6c2947cbc8f1af5a5c93526b52746
- SHA512 6179badf0c7bbf810c778e9df4d20eafa9d2bab271f27fb86c039beca884208b30ba4748e00c9209262da4e7826d3c5793b82c47849caf5667d5d822ec34afa1
- SSDEEP 6144:dIs6ne7X4kYE1Tv6Bnk/9141vD6sobQemyabSNDHS:ayRyBWT41v44bl
- TLSH T152846D253FB8AD42F6991A7DC5BF2601C721A0E22623B3077747B6A24D01ADDDD2C3D6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe - Suspicious behavior: EnumeratesProcesses 59 IoCs
pid Process 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 3428 yr9bkiskp3bgpy0s.exe Token: SeIncBasePriorityPrivilege 3428 yr9bkiskp3bgpy0s.exe Token: SeDebugPrivilege 876 taskmgr.exe Token: SeSystemProfilePrivilege 876 taskmgr.exe Token: SeCreateGlobalPrivilege 876 taskmgr.exe - Suspicious use of FindShellTrayWindow 31 IoCs
pid Process 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe - Suspicious use of SendNotifyMessage 31 IoCs
pid Process 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe 876 taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 876 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\yr9bkiskp3bgpy0s.exe"C:\Users\Admin\AppData\Local\Temp\yr9bkiskp3bgpy0s.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3428
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:876
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:5744
-
C:\Users\Admin\AppData\Local\Temp\yr9bkiskp3bgpy0s.exe"C:\Users\Admin\AppData\Local\Temp\yr9bkiskp3bgpy0s.exe"1⤵PID:5488