Analysis
- user interaction
yes - max time kernel
493s - max time network
430s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/10/2026, 14:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Crack/Scrivener.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
600 seconds
General
- Target Crack/Scrivener.exe
- Size 10.6MB
- Sample261006-rlg8psfc24
- SHA256 a20dda9a087f675267be6d5aaca382cfe6b9323a00e6dc95e1e0bea3b9796444
- MD5 492145d30149385208d649c88751919f
- SHA1 8afc6be4fa1ff774d7b8528f469991a483e288ce
- SHA512 ba4a7c1aae979066961e06e4a455f82d6d593a9a5ce6463f12ec8f13366f51e7bfbe02abb2a5974a40889d75a9740de004ec36ef2ce9149fbba549993e433f57
- SSDEEP 196608:3wY+HJzUTa9/n6MoL75bMI2CfyjmqeT1orILZ57YMf03F2N3z3baux7bl:F+pzUm1n6FL7R2x6qeZr5LM3izGol
- TLSH T186B623E522323288C0199B3488264551D7FB9C2A4AB3876563DBBF406F7F961EC0DB1F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 3556 taskmgr.exe Token: SeSystemProfilePrivilege 3556 taskmgr.exe Token: SeCreateGlobalPrivilege 3556 taskmgr.exe Token: 33 3556 taskmgr.exe Token: SeIncBasePriorityPrivilege 3556 taskmgr.exe Token: SeDebugPrivilege 4860 taskmgr.exe Token: SeSystemProfilePrivilege 4860 taskmgr.exe Token: SeCreateGlobalPrivilege 4860 taskmgr.exe Token: 33 4860 taskmgr.exe Token: SeIncBasePriorityPrivilege 4860 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 4860 taskmgr.exe 4860 taskmgr.exe 4860 taskmgr.exe 4860 taskmgr.exe 4860 taskmgr.exe 4860 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 3556 taskmgr.exe 4860 taskmgr.exe 4860 taskmgr.exe 4860 taskmgr.exe 4860 taskmgr.exe 4860 taskmgr.exe 4860 taskmgr.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3556 taskmgr.exe 4860 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Crack\Scrivener.exe"C:\Users\Admin\AppData\Local\Temp\Crack\Scrivener.exe"1⤵PID:4176
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1952
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:4664
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost1⤵PID:1168
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3556
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4860
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\D3DSCache\b7c78e20530d35f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
- Size 64KB
- SHA256 42c4fcd383e47854e66057644f88979287b077564fa0e83dd5097623e224804c
- MD5 d5b8e33845632b223ead9f7767ee1379
- SHA1 5c1b01562bc2bd424d2d703de91e00b40379f3c8
- SHA512 5ca20e1fadc3d123a174427c582e6822453d233accd614ae0e0d77978b631e9c0b355a0090f2602cfb451f5aec4021898e6a294597d7787424e761071834e2a8
- SSDEEP 3:t89llGlll/l/lXp9ZjrPBY06llqlHeU/ZP:sl0dPBY0OcPJ
- TLSH T12053244151C30317C443033004CF07443F75130C4343043143105370C45CF0040F11C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\D3DSCache\b7c78e20530d35f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
- Size 4B
- SHA256 7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
- MD5 f49655f856acb8884cc0ace29216f511
- SHA1 cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
- SHA512 599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\D3DSCache\b7c78e20530d35f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
- Size 960B
- SHA256 565de87de825884dfdd98f37a1b05d5293eb72bb28ba1950f879e0082b0344c8
- MD5 41771ed4b8806ab6a027db8f95942da4
- SHA1 7fa42f8cc0b391d46d29dd25c08ca7483646c430
- SHA512 5b6e35b911a88c142ea61a14ebe98987da3f5e1b1d6898b28558a1f80f45ca27fc1518c21464bdb9ac86e2f1b7cbeaab02cedb2b89ba34ea96e46b4f6116b44a
- TLSH T1EB118C483BCB2CB0E33A7830002992201203B12208D2D20C8AC084668A31104D032FA8
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\TaskManager\settings.json
- Size 14KB
- SHA256 99755a12cfa939ac9af43d7fd6bf2af988e6b8406d58c8b91c47efcca0eee8ab
- MD5 2c66c198f2dbcebb9e889f52ffeb7133
- SHA1 909c8d6eee60a18ca378eea360b230bbd64201b1
- SHA512 460b75ba698cb0ab64fd16cb9fc95ca8eb0ac02035d15e3c7229be22c9b4b2b1dd1a0d6e66e6302ebf44f3fa43253178562f43b061f3b7b7722407c0ec4a3139
- SSDEEP 384:Qriol3FwaVp8lzrZZrzDqT5fEs0dwkG9Sqdc741ybah:aiol3FwaVp8lzrZlCT5fEs0dwkG9Bh
- TLSH T1A2627A29A465DE2C87A01ED03D3F298F5E963310BFE596F4E0FF4E1066818AD2326765
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\TaskManager\settings.json
- Size 14KB
- SHA256 b282c1da549fc7c4857aa9d0032504a659e6e286a24c7838dc4fd69a2123dd97
- MD5 d6214d3790f25da1ac8c9bf1a26af30b
- SHA1 4c297f953ffc45164138791962a68072c356fb68
- SHA512 8ef6b088a7b83b12bb029ec74b376ee132fa6ca3289fc8f0b33124cced164e90b60f52e90968988af149c939f0c275672969d14e46a2173ebd46bd67a4e98646
- SSDEEP 384:Qriol3FwaVp8lzrZZrzDqT5fEs0dwkG9Sqdc741yba6:aiol3FwaVp8lzrZlCT5fEs0dwkG9B6
- TLSH T1B2627A29A465DE2C87A01ED03D3F298F5E963310BFE596F4E0FF4E0466818AD2326765
- MD5 SHA1 SHA512 SSDEEP TLSH