Analysis
- user interaction
yes - max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/09/2026, 11:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
riftcrack-launcher.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
riftcrack-launcher.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target riftcrack-launcher.exe
- Size 1.7MB
- Sample260908-ne16fsfa99
- SHA256 116b101761867e0f7467cd3bbcb4a97f4abcbff9ccb35be060f0a9cab4b12a97
- MD5 9e4f1c23261a5b9246ecc303b67ee5ff
- SHA1 08d55f5c977e0d6902bb166b295ce0a65937f689
- SHA512 770a75832ce89e43d9e4bb298f9115fb4c720a659758198e8379670e2298c8498adbc0ec19aefe5d8919efe98589b34491798821a0277d0c84720e85fc69f97d
- SSDEEP 24576:yAubLCX7rYi4JEQcxKbYbGL/yuDFyN8UgL5gvOTvLtXfOBfFbqc0QdCjXELOh0l4:yKXgbEGbr+MFWBfFbuQR99LO
- TLSH T1A285AF03F18550FDC45AC178875B6722B976B48D1B20ADEF1294CB743EA2AF46B3DB60
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4520 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4520 taskmgr.exe Token: SeSystemProfilePrivilege 4520 taskmgr.exe Token: SeCreateGlobalPrivilege 4520 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe 4520 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\riftcrack-launcher.exe"C:\Users\Admin\AppData\Local\Temp\riftcrack-launcher.exe"1⤵PID:3040
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4520
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4352