Analysis
- user interaction
yes - max time kernel
20s - max time network
22s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
28/08/2026, 21:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
MrAhmedSamir.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
MrAhmedSamir.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target MrAhmedSamir.exe
- Size 1.1MB
- Sample260828-1cln7stdmc
- SHA256 c0fdba1d1a5ad092df8e04b24dfcbae68015d992f047a68955b4f927c7dc5ddc
- MD5 2acff37d94c2ad6c7a6c4e18e25cdb10
- SHA1 03aa71538b403a2d9c46ac23743c0c1dbf941787
- SHA512 66d2f596639f9bdaee2b5d5fe81f4cdfeb5a3d093250a42951f67aef568f094ed28828417268e4a16791853289a1ae7c6b4a0921e23e5f41b490bdad0b85d391
- SSDEEP 12288:MYXjNdssYAZzx8VURmaXZycrpZRakBq+NC9uDAZJKJ9XXp7uTYv+3bcxbZr/kBC9:MmNdsPRazCiqGC9hUvwg
- TLSH T197356D5D6A0241B2E1BD35B041A66B7505FE5D396B20B9C3AACF3E2B473F1E02D3522D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MrAhmedSamir.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1012 taskmgr.exe Token: SeSystemProfilePrivilege 1012 taskmgr.exe Token: SeCreateGlobalPrivilege 1012 taskmgr.exe Token: 33 1012 taskmgr.exe Token: SeIncBasePriorityPrivilege 1012 taskmgr.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe - Suspicious use of SendNotifyMessage 34 IoCs
pid Process 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe 1012 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\MrAhmedSamir.exe"C:\Users\Admin\AppData\Local\Temp\MrAhmedSamir.exe"1⤵
- System Location Discovery: System Language Discovery
PID:3308
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1012