Analysis
- user interaction
yes - max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 12:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
system.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
system.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
system.exe
Resource
ubuntu2204-amd64-20260513-en
ubuntu-22.04-amd64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
system.exe
Resource
debian9-armhf-20260513-en
debian-9-armhf
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
system.exe
Resource
debian9-mipsbe-20260513-en
debian-9-mips
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
system.exe
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
0 signatures
150 seconds
General
- Target system.exe
- Size 3.3MB
- Sample260930-ppkrwsvt5q
- SHA256 3649e357459afbd23f75b7ea79ebf53760f9b6fa33f264fdbade1642dd481fcc
- MD5 25fe792d7bf780f575d7f50c35e56b30
- SHA1 0f675f2f64cdea892d9bf757fabc2cbac48fe473
- SHA512 a33f926723f9e4fda962a7857679c087b3fe01bbbb9e072dcdbb5eb418cf9e667a5fcb82b6b4a5d477f2ee8843ceb320cfdde986cf48dbbe05e94e4bd21b82c0
- SSDEEP 49152:GMGp6JQRSejpx4v9yCC3ivZ/ABnYcH0qNsgfdOXJ20iOA0hpCVjmVsr7+12:3GmFewv9yryynURgV1pOZjCVjsJ12
- TLSH T1AFF5E12D814A13D4EC21CC7EAC160D0B671F494AC0B58AE6CF7F9C94A9584FEDF5AB81
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
ioc Process \??\VBoxMiniRdrDN system.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS system.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer system.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName system.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1452 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeSystemEnvironmentPrivilege 4756 system.exe Token: SeDebugPrivilege 1452 taskmgr.exe Token: SeSystemProfilePrivilege 1452 taskmgr.exe Token: SeCreateGlobalPrivilege 1452 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe 1452 taskmgr.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1452 taskmgr.exe 1452 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\system.exe"C:\Users\Admin\AppData\Local\Temp\system.exe"1⤵
- Checks for VirtualBox DLLs, possible anti-VM trick
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:4756
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1452
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:4688