Overview
overview
3Static
static
3skeet.zip
windows10-2004-x64
1skeet.zip
windows11-ltsc_2024-x64
1cfg + skeet/skeet.exe
windows10-2004-x64
1cfg + skeet/skeet.exe
windows11-ltsc_2024-x64
1cfg + skee... 1.cfg
windows10-2004-x64
3cfg + skee... 1.cfg
windows11-ltsc_2024-x64
3cfg + skee... 2.cfg
windows10-2004-x64
3cfg + skee... 2.cfg
windows11-ltsc_2024-x64
3cfg + skee... 3.cfg
windows10-2004-x64
3cfg + skee... 3.cfg
windows11-ltsc_2024-x64
3cfg + skee... 4.cfg
windows10-2004-x64
3cfg + skee... 4.cfg
windows11-ltsc_2024-x64
3cfg + skee... 5.cfg
windows10-2004-x64
3cfg + skee... 5.cfg
windows11-ltsc_2024-x64
3cfg + skee... 6.cfg
windows10-2004-x64
3cfg + skee... 6.cfg
windows11-ltsc_2024-x64
3cfg + skee...я.txt
windows10-2004-x64
1cfg + skee...я.txt
windows11-ltsc_2024-x64
1Analysis
- user interaction
yes - max time kernel
148s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
26/09/2026, 16:37
Static task
static1
Behavioral task
behavioral1
Sample
skeet.zip
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
skeet.zip
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
cfg + skeet/skeet.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
cfg + skeet/skeet.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
cfg + skeet/skeet/SLOT 1.cfg
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
cfg + skeet/skeet/SLOT 1.cfg
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
cfg + skeet/skeet/SLOT 2.cfg
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
cfg + skeet/skeet/SLOT 2.cfg
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
cfg + skeet/skeet/SLOT 3.cfg
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
cfg + skeet/skeet/SLOT 3.cfg
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
cfg + skeet/skeet/SLOT 4.cfg
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
cfg + skeet/skeet/SLOT 4.cfg
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
cfg + skeet/skeet/SLOT 5.cfg
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
cfg + skeet/skeet/SLOT 5.cfg
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
cfg + skeet/skeet/SLOT 6.cfg
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
cfg + skeet/skeet/SLOT 6.cfg
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral17
Sample
cfg + skeet/Инструкция.txt
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
cfg + skeet/Инструкция.txt
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
General
- Target cfg + skeet/skeet.exe
- Size 6.0MB
- Sample260926-t4wvxsysbv
- SHA256 5325b18de24aee0a93da14f4033a6f65ffb6ba4d9ed98d5e6e25f5b0afad78d9
- MD5 531eae6efe99e7a256dd1244f36e321a
- SHA1 716f8f034d0bf684fe663993ac613b23c5753e18
- SHA512 9f608a2a796f208bacbc4462184d0616d8b294b85572504447849eb6cb4a3d222bbf7f778a52dcdb6da0f7d191587e33eb94eb9659d0a7565995af86f3fc6bb9
- SSDEEP 98304:CeAKYiOp9nvIT85zNcxnu4H8uBXwLi83j/78:RAKbOA8HehTwLJz/g
- TLSH T15156AE07F78151EDD02BD57886A7632BE231B4460B3157DB13846A396EA37E01F3AB93
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings skeet.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 236 skeet.exe 236 skeet.exe 236 skeet.exe 236 skeet.exe 236 skeet.exe 236 skeet.exe 236 skeet.exe 236 skeet.exe 236 skeet.exe 236 skeet.exe 236 skeet.exe 236 skeet.exe 236 skeet.exe 236 skeet.exe 236 skeet.exe 236 skeet.exe 236 skeet.exe 236 skeet.exe 236 skeet.exe 236 skeet.exe 236 skeet.exe 236 skeet.exe 236 skeet.exe 236 skeet.exe 236 skeet.exe 236 skeet.exe 236 skeet.exe 236 skeet.exe 236 skeet.exe 236 skeet.exe 236 skeet.exe 236 skeet.exe 236 skeet.exe 236 skeet.exe 236 skeet.exe 236 skeet.exe 236 skeet.exe 236 skeet.exe 236 skeet.exe 236 skeet.exe 236 skeet.exe 236 skeet.exe 236 skeet.exe 236 skeet.exe 236 skeet.exe 236 skeet.exe 236 skeet.exe 236 skeet.exe 236 skeet.exe 236 skeet.exe 236 skeet.exe 236 skeet.exe 236 skeet.exe 236 skeet.exe 236 skeet.exe 236 skeet.exe 236 skeet.exe 236 skeet.exe 236 skeet.exe 236 skeet.exe 236 skeet.exe 236 skeet.exe 236 skeet.exe 236 skeet.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 236 skeet.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4888 taskmgr.exe Token: SeSystemProfilePrivilege 4888 taskmgr.exe Token: SeCreateGlobalPrivilege 4888 taskmgr.exe Token: 33 4888 taskmgr.exe Token: SeIncBasePriorityPrivilege 4888 taskmgr.exe - Suspicious use of FindShellTrayWindow 38 IoCs
pid Process 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe - Suspicious use of SendNotifyMessage 38 IoCs
pid Process 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe 4888 taskmgr.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3800 OpenWith.exe 4888 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cfg + skeet\skeet.exe"C:\Users\Admin\AppData\Local\Temp\cfg + skeet\skeet.exe"1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:236
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:3800
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4888
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:3036