Analysis
- user interaction
yes - max time kernel
91s - max time network
23s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/09/2026, 14:25
Behavioral task
behavioral1
Sample
Axion.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target Axion.exe
- Size 11.3MB
- Sample260913-rrpjzagq21
- SHA256 119efc7832c58f709be618349f608bf5154f105e0fd9bd7ce0660737d6f5a270
- MD5 36a5a6f8628377913f329dbc4f3ba85f
- SHA1 3f168cb709c8f4f62829b8220ed9461ab410bdd3
- SHA512 864bf0371a69604d22b9be0f23d2aa800cc48fddeac4d93ad892c7c6eca0f1303b436deba82991364815382e8f1820cfccf8473ed1208b9c9c02d94443ac860b
- SSDEEP 196608:0CYSktXHsF5PpNaiMkGrbONaQ2Rq+zFkZyfcf8HgxJlxXLAniQDpS4/yPpW:0EsHsF5Pai3GuNGXkYfq8A1xaNS4aPpW
- TLSH T1F2C633204DC34467F9D3A83B2879C5A2F262BAD51B70D6EF0B5442A52E37BE1943B371
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ 7zFM.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4296 taskmgr.exe Token: SeSystemProfilePrivilege 4296 taskmgr.exe Token: SeCreateGlobalPrivilege 4296 taskmgr.exe Token: SeRestorePrivilege 4880 7zFM.exe Token: 35 4880 7zFM.exe - Suspicious use of FindShellTrayWindow 55 IoCs
pid Process 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4880 7zFM.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe - Suspicious use of SendNotifyMessage 54 IoCs
pid Process 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe 4296 taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4296 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Axion.exe"C:\Users\Admin\AppData\Local\Temp\Axion.exe"1⤵PID:2104
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4296
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:5772
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\Axion.exe"C:\Users\Admin\AppData\Local\Temp\Axion.exe"1⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\Axion.exe"C:\Users\Admin\AppData\Local\Temp\Axion.exe"1⤵PID:5452
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Axion.exe"1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4880