Analysis
- user interaction
yes - max time kernel
149s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/10/2026, 18:22
Behavioral task
behavioral1
Sample
NULLX MENU.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target NULLX MENU.exe
- Size 54KB
- Sample261003-w1bfxsef92
- SHA256 49d1632ce25fb1ea00aa551babb6dab92a756e43dc743938329a6b11d664c55d
- MD5 6a621a705df92efc14754673e8c7cbb3
- SHA1 da60ec126c52d85178cb55ec694d90867a1a7843
- SHA512 f388e06a41df9b4b906ad7c4bab0cc51de63f7ddeb4afd2f8de28f54a9950d798105a368dec61bb92c1736e66626af8bfe41c1f9afdb5524b49a351a8195dd53
- SSDEEP 1536:VBAA8DnYNe0J5T6DewsNMD2XExI3pmLm:z8DnZux6DewsNMD2XExI3pm
- TLSH T17A431744BFEA4A01D2BD8F7468F555150A34AA23F532EB1E8CD668DB17327C58C40FE6
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname NULLX MENU.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain NULLX MENU.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NULLX MENU.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe - Suspicious behavior: EnumeratesProcesses 44 IoCs
pid Process 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeDebugPrivilege 3260 NULLX MENU.exe Token: 33 3260 NULLX MENU.exe Token: SeIncBasePriorityPrivilege 3260 NULLX MENU.exe Token: SeDebugPrivilege 2500 taskmgr.exe Token: SeSystemProfilePrivilege 2500 taskmgr.exe Token: SeCreateGlobalPrivilege 2500 taskmgr.exe Token: 33 3260 NULLX MENU.exe Token: SeIncBasePriorityPrivilege 3260 NULLX MENU.exe Token: 33 2500 taskmgr.exe Token: SeIncBasePriorityPrivilege 2500 taskmgr.exe Token: 33 3260 NULLX MENU.exe Token: SeIncBasePriorityPrivilege 3260 NULLX MENU.exe Token: 33 3260 NULLX MENU.exe Token: SeIncBasePriorityPrivilege 3260 NULLX MENU.exe Token: 33 3260 NULLX MENU.exe Token: SeIncBasePriorityPrivilege 3260 NULLX MENU.exe Token: 33 3260 NULLX MENU.exe Token: SeIncBasePriorityPrivilege 3260 NULLX MENU.exe Token: 33 3260 NULLX MENU.exe Token: SeIncBasePriorityPrivilege 3260 NULLX MENU.exe Token: 33 3260 NULLX MENU.exe Token: SeIncBasePriorityPrivilege 3260 NULLX MENU.exe Token: 33 3260 NULLX MENU.exe Token: SeIncBasePriorityPrivilege 3260 NULLX MENU.exe Token: 33 3260 NULLX MENU.exe Token: SeIncBasePriorityPrivilege 3260 NULLX MENU.exe Token: 33 3260 NULLX MENU.exe Token: SeIncBasePriorityPrivilege 3260 NULLX MENU.exe Token: 33 3260 NULLX MENU.exe Token: SeIncBasePriorityPrivilege 3260 NULLX MENU.exe Token: 33 3260 NULLX MENU.exe Token: SeIncBasePriorityPrivilege 3260 NULLX MENU.exe Token: 33 3260 NULLX MENU.exe Token: SeIncBasePriorityPrivilege 3260 NULLX MENU.exe Token: 33 3260 NULLX MENU.exe Token: SeIncBasePriorityPrivilege 3260 NULLX MENU.exe Token: 33 3260 NULLX MENU.exe Token: SeIncBasePriorityPrivilege 3260 NULLX MENU.exe Token: 33 3260 NULLX MENU.exe Token: SeIncBasePriorityPrivilege 3260 NULLX MENU.exe Token: 33 3260 NULLX MENU.exe Token: SeIncBasePriorityPrivilege 3260 NULLX MENU.exe - Suspicious use of FindShellTrayWindow 41 IoCs
pid Process 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe - Suspicious use of SendNotifyMessage 41 IoCs
pid Process 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe 2500 taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2500 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NULLX MENU.exe"C:\Users\Admin\AppData\Local\Temp\NULLX MENU.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3260
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2500
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:3996