Analysis
- user interaction
yes - max time kernel
40s - max time network
23s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/10/2026, 18:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f0rex_rater.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
f0rex_rater.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target f0rex_rater.exe
- Size 42.0MB
- Sample261003-wt7wjsvw3m
- SHA256 362a0f91be5df893d16bac5dcf970b0418e9d3de15f20b32f9047300255553e3
- MD5 260327d590893150e35546ba98e3e9c7
- SHA1 d20d79d01921f9b3448c8cb9cb42c196d68b20ff
- SHA512 14024c61a9945fe3bdcf9caecce84e227c0f114177dfc855cf65f67334fb3acc766758e67a91490c8008ee5582cbb75470e77477611b8aee099f3127224f2547
- SSDEEP 786432:/9HQZDFWdJR6dJpjWdJYdmHJPqLvFGdJKdmN8Zu6S3S+RpkZVyVXmSCX:/YFWdJMdJxWdJYdmHJiMdJKdmN8ZJSiT
- TLSH T190A77C0AF4934F3EC1BA157184A79F16D539E0C1AB314AB7632863293DD23792AD339D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2736 taskmgr.exe Token: SeSystemProfilePrivilege 2736 taskmgr.exe Token: SeCreateGlobalPrivilege 2736 taskmgr.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe - Suspicious use of SendNotifyMessage 25 IoCs
pid Process 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe 2736 taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2736 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f0rex_rater.exe"C:\Users\Admin\AppData\Local\Temp\f0rex_rater.exe"1⤵PID:3180
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2736
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:2876