Analysis
- user interaction
yes - max time kernel
148s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 01:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
trump perm patched(1).exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
trump perm patched(1).exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target trump perm patched(1).exe
- Size 2.3MB
- Sample260930-ca533as1es
- SHA256 73b89f28762897579a7dfdfe1d4e4a57bc81db3cbc3d1a3506cc1d5201139860
- MD5 e098b6fa30cb0411a7b14b5b5702f208
- SHA1 337d66d4b06a4b7a6853a5a0b29bc212969f9782
- SHA512 5ca69f3a50f0496d4cb1d605292550505c2e50d18c377dc13a4206f9976ccdb480776d666cc35a1421023d9b173e9cd7bf9819969c550a7e5e3a67dc6f75799c
- SSDEEP 49152:1VIW6IVx6niLH0v4UIm/aSJi1byw+NXqBVeP:NFI/aKwK8e
- TLSH T150B5BF03B7ED8268D17369388AB7C362B333BC415B21924B77A40564AE931E45F7B7D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 9 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 15 IoCs
description pid Process Token: SeDebugPrivilege 5772 taskmgr.exe Token: SeSystemProfilePrivilege 5772 taskmgr.exe Token: SeCreateGlobalPrivilege 5772 taskmgr.exe Token: 33 5772 taskmgr.exe Token: SeIncBasePriorityPrivilege 5772 taskmgr.exe Token: SeDebugPrivilege 5924 taskmgr.exe Token: SeSystemProfilePrivilege 5924 taskmgr.exe Token: SeCreateGlobalPrivilege 5924 taskmgr.exe Token: 33 5924 taskmgr.exe Token: SeIncBasePriorityPrivilege 5924 taskmgr.exe Token: SeDebugPrivilege 4580 taskmgr.exe Token: SeSystemProfilePrivilege 4580 taskmgr.exe Token: SeCreateGlobalPrivilege 4580 taskmgr.exe Token: 33 4580 taskmgr.exe Token: SeIncBasePriorityPrivilege 4580 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5924 taskmgr.exe 5924 taskmgr.exe 5924 taskmgr.exe 5924 taskmgr.exe 5924 taskmgr.exe 5924 taskmgr.exe 5924 taskmgr.exe 5924 taskmgr.exe 5924 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5772 taskmgr.exe 5924 taskmgr.exe 5924 taskmgr.exe 5924 taskmgr.exe 5924 taskmgr.exe 5924 taskmgr.exe 5924 taskmgr.exe 5924 taskmgr.exe 5924 taskmgr.exe 5924 taskmgr.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 5772 taskmgr.exe 5924 taskmgr.exe 4580 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\trump perm patched(1).exe"C:\Users\Admin\AppData\Local\Temp\trump perm patched(1).exe"1⤵PID:4712
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5772
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:5124
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5924
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4580
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\D3DSCache\b7c78e20530d35f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
- Size 64KB
- SHA256 42c4fcd383e47854e66057644f88979287b077564fa0e83dd5097623e224804c
- MD5 d5b8e33845632b223ead9f7767ee1379
- SHA1 5c1b01562bc2bd424d2d703de91e00b40379f3c8
- SHA512 5ca20e1fadc3d123a174427c582e6822453d233accd614ae0e0d77978b631e9c0b355a0090f2602cfb451f5aec4021898e6a294597d7787424e761071834e2a8
- SSDEEP 3:t89llGlll/l/lXp9ZjrPBY06llqlHeU/ZP:sl0dPBY0OcPJ
- TLSH T12053244151C30317C443033004CF07443F75130C4343043143105370C45CF0040F11C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\D3DSCache\b7c78e20530d35f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
- Size 4B
- SHA256 7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
- MD5 f49655f856acb8884cc0ace29216f511
- SHA1 cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
- SHA512 599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\D3DSCache\b7c78e20530d35f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
- Size 960B
- SHA256 565de87de825884dfdd98f37a1b05d5293eb72bb28ba1950f879e0082b0344c8
- MD5 41771ed4b8806ab6a027db8f95942da4
- SHA1 7fa42f8cc0b391d46d29dd25c08ca7483646c430
- SHA512 5b6e35b911a88c142ea61a14ebe98987da3f5e1b1d6898b28558a1f80f45ca27fc1518c21464bdb9ac86e2f1b7cbeaab02cedb2b89ba34ea96e46b4f6116b44a
- TLSH T1EB118C483BCB2CB0E33A7830002992201203B12208D2D20C8AC084668A31104D032FA8
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\TaskManager\settings.json
- Size 14KB
- SHA256 caa26f8e5366153668e8d9770844ed3c91febae8fab42da8e22801e03ec97ae0
- MD5 4aa93708fc547fc834d191673c43bdfd
- SHA1 1682a60bbba28b562cf34342967b59e87bc2a7cc
- SHA512 4293dde7805b88e55b854e19003498760ccbad474409a642c5c5628287c68b55dd85a3d804c611431e5036c7a317e9baf0c2c976e155c94a0110da1479001d78
- SSDEEP 384:X8riol3FwaVp8lzrZZrzDqT5fERZW7j5U/qdc741ybaE:XWiol3FwaVp8lzrZlCT5fERZW7j5UaE
- TLSH T174627A29A465DE2C87A01ED03C3F294F5E963310BFE696F4E1FF4E0476818AD2326765
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\TaskManager\settings.json
- Size 14KB
- SHA256 79a3775616134b41d9d113e47b0548fe330f604f0b117c63a04fd430de53f612
- MD5 19409a22f7adae0bc19393ed42c7c55a
- SHA1 917945e410b9ecae71cf139caec419cbb7999b53
- SHA512 d0c2cee7af2398962f3f55fa7e4762a4ab6ba91722cd7a6286cd03339456ce4943f7a81de5dbb524bc7ee1bcc6242208b16d3f1392094a66623c6b95167b42de
- SSDEEP 384:X8Iiol3FwYVp8lzrZZrzDqT5fERZW7j5U/qdc741ybaP:X7iol3FwYVp8lzrZlCT5fERZW7j5UaP
- TLSH T197626A29A465DE2C87A01ED03C3F294F5E963310BFE596F8E1FF4E0476818AD2326765
- MD5 SHA1 SHA512 SSDEEP TLSH