Analysis
- user interaction
yes - max time kernel
150s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 01:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
trump perm patched(1).exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
trump perm patched(1).exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target trump perm patched(1).exe
- Size 2.3MB
- Sample260930-ccry8aybqc
- SHA256 73b89f28762897579a7dfdfe1d4e4a57bc81db3cbc3d1a3506cc1d5201139860
- MD5 e098b6fa30cb0411a7b14b5b5702f208
- SHA1 337d66d4b06a4b7a6853a5a0b29bc212969f9782
- SHA512 5ca69f3a50f0496d4cb1d605292550505c2e50d18c377dc13a4206f9976ccdb480776d666cc35a1421023d9b173e9cd7bf9819969c550a7e5e3a67dc6f75799c
- SSDEEP 49152:1VIW6IVx6niLH0v4UIm/aSJi1byw+NXqBVeP:NFI/aKwK8e
- TLSH T150B5BF03B7ED8268D17369388AB7C362B333BC415B21924B77A40564AE931E45F7B7D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4640 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4640 taskmgr.exe Token: SeSystemProfilePrivilege 4640 taskmgr.exe Token: SeCreateGlobalPrivilege 4640 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe 4640 taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4640 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\trump perm patched(1).exe"C:\Users\Admin\AppData\Local\Temp\trump perm patched(1).exe"1⤵PID:2808
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4640
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:5836
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:432