Analysis
- user interaction
yes - max time kernel
148s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/09/2026, 15:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dropper.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
dropper.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target dropper.exe
- Size 37KB
- Sample260912-srbtjszbkd
- SHA256 bccf02f685fc753a8c29be00ae2daea0f1f672af04a4ef393b72a4b06dd8ba26
- MD5 c5ba98f1e5b7f779a51fe74a19177c3c
- SHA1 6e8243c347c220565ac31db0ce57b8001ca7c981
- SHA512 f54f7fe2799a9fff237dca756be945481ffbd0db1316ebe1f81183c4bc45da77f41c2ace8e39678a79cd211d29af1e66f4078a35f933862408a0c4b2de9ce4c4
- SSDEEP 768:bUKP18ZvOLc0xeRF9KlxxxRaJ763x02Ij:J2F9Klxxx06
- TLSH T14003E75BFBB3C5ECC582E6B8B2E5E772D860FC2A4830562C435053243F966989E7D742
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4688 taskmgr.exe Token: SeSystemProfilePrivilege 4688 taskmgr.exe Token: SeCreateGlobalPrivilege 4688 taskmgr.exe Token: 33 4688 taskmgr.exe Token: SeIncBasePriorityPrivilege 4688 taskmgr.exe - Suspicious use of FindShellTrayWindow 58 IoCs
pid Process 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe - Suspicious use of SendNotifyMessage 58 IoCs
pid Process 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe 4688 taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4688 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dropper.exe"C:\Users\Admin\AppData\Local\Temp\dropper.exe"1⤵PID:2700
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4688