Analysis
- user interaction
yes - max time kernel
141s - max time network
142s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
31/08/2026, 23:19
Behavioral task
behavioral1
Sample
.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
10 signatures
300 seconds
General
- Target AIDA64 Extreme 8 35 8400 Incl Keygen - KhanPC zip.exe
- Size 2.0MB
- Sample260831-3awshaaf39
- SHA256 bcc027a8ca29ad77a9045d357d66160bea1d4457c1719999b273c917b7e72d1e
- MD5 0fb71fe29b03d20fac085c91d48dd22b
- SHA1 f202a3050fc844080c24bdd04a38a3b38cf511fd
- SHA512 25c6571b5e461f4b06a97c8c4553cd391bd48fe67304d27503e3dcad6761991ce4e8a10015d922ed436393cd9d307e3c0ac56f9eda3a924a24cd1fc9b7529e51
- SSDEEP 24576:iXfPki0RBC19GXIVdIZGgJXpJehyxwKlvdXgKfpXrbEL10B+kM/PfcXmH1bmBXjC:wob9B2+TwKfpbR+/T1bmBXfqf
- TLSH T1BBA5C03BF28BA13EE06E1A367A72A210553BBA1165164C1696FCF84CCF355701E3F687
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4252 AIDA64 Extreme 8 35 8400 Incl Keygen - KhanPC zip.tmp - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\Setup\unins000.dat AIDA64 Extreme 8 35 8400 Incl Keygen - KhanPC zip.tmp File created C:\Program Files (x86)\Setup\is-I8BWAU8H42.tmp AIDA64 Extreme 8 35 8400 Incl Keygen - KhanPC zip.tmp File opened for modification C:\Program Files (x86)\Setup\unins000.dat AIDA64 Extreme 8 35 8400 Incl Keygen - KhanPC zip.tmp - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AIDA64 Extreme 8 35 8400 Incl Keygen - KhanPC zip.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AIDA64 Extreme 8 35 8400 Incl Keygen - KhanPC zip.tmp - Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
resource yara_rule behavioral2/memory/4348-0-0x0000000000CB0000-0x0000000000D99000-memory.dmp innosetup behavioral2/memory/4348-6-0x0000000000CB0000-0x0000000000D99000-memory.dmp innosetup behavioral2/memory/4348-29-0x0000000000CB0000-0x0000000000D99000-memory.dmp innosetup - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe - Suspicious behavior: EnumeratesProcesses 35 IoCs
pid Process 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 216 taskmgr.exe Token: SeSystemProfilePrivilege 216 taskmgr.exe Token: SeCreateGlobalPrivilege 216 taskmgr.exe - Suspicious use of FindShellTrayWindow 48 IoCs
pid Process 4252 AIDA64 Extreme 8 35 8400 Incl Keygen - KhanPC zip.tmp 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe - Suspicious use of SendNotifyMessage 47 IoCs
pid Process 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe 216 taskmgr.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4348 wrote to memory of 4252 4348 AIDA64 Extreme 8 35 8400 Incl Keygen - KhanPC zip.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\AIDA64 Extreme 8 35 8400 Incl Keygen - KhanPC zip.exe"C:\Users\Admin\AppData\Local\Temp\AIDA64 Extreme 8 35 8400 Incl Keygen - KhanPC zip.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\is-XS16H2RAC2.tmp\AIDA64 Extreme 8 35 8400 Incl Keygen - KhanPC zip.tmp"C:\Users\Admin\AppData\Local\Temp\is-XS16H2RAC2.tmp\AIDA64 Extreme 8 35 8400 Incl Keygen - KhanPC zip.tmp" /SL5="$40224,890880,890880,C:\Users\Admin\AppData\Local\Temp\AIDA64 Extreme 8 35 8400 Incl Keygen - KhanPC zip.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:4252
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:216
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\is-XS16H2RAC2.tmp\AIDA64 Extreme 8 35 8400 Incl Keygen - KhanPC zip.tmp
- Size 4.2MB
- SHA256 4c2829df99f4e6cb4d9e06fe43bc1717b68750ad789857ecc378aa0dbb98361b
- MD5 e43269e09f3c14da95b7d62114a64750
- SHA1 f712bd5bec6fc10bead93cda5cc9d4f735595ce9
- SHA512 7d5873a27050dca3f6fb80a81faf4e67151a7a8c4491eedc7118241f5a92c567b0cd130dc639212cd9b5c73f9a80155ea911742a4966238b20ce00a286f98724
- SSDEEP 98304:KiDj+6GqBH6KwsvcHJ4c91usxgkod1sc+333PD:XjpG5ucZus5Qn8D
- TLSH T1BC267D13F784653EE46B1A3A4837A254993B7E303A16CC477BFC298C4F396406D2A797
- MD5 SHA1 SHA512 SSDEEP TLSH