Analysis
- user interaction
yes - max time kernel
34s - max time network
32s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/10/2026, 23:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Sakuraa.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target Sakuraa.exe
- Size 8.9MB
- Sample261007-3kr73afy4s
- SHA256 c4d3c8a8b3a0f69a86dfbd2c3ba8c8f431c3b5ec823bd35a1221766e6b2b7b1f
- MD5 5520d461b4f4b2e8916d0e48ff447995
- SHA1 0e55d1dba655759806a14cdf2fa9487ee4e60a60
- SHA512 400b403d251ae4efdbbad936c226a42e69c3590d164c580f583a5a18c47f6587a492db1fabfa6b22f7c7b616982a4f46693604f5c84ad71dcd059c9fd11061fe
- SSDEEP 98304:oaGn4WyCO3HmWOjEUBj+Sddm/B7SHrzwpOulfCfYVC:ogNROwUJm/dGryl6f
- TLSH T18C966B07EDA619E5C5AED2318AB291537F717C891B2023D71B50F6382F7ABD0ADB9310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3584 My Agent.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4532 taskmgr.exe Token: SeSystemProfilePrivilege 4532 taskmgr.exe Token: SeCreateGlobalPrivilege 4532 taskmgr.exe Token: 33 4532 taskmgr.exe Token: SeIncBasePriorityPrivilege 4532 taskmgr.exe - Suspicious use of FindShellTrayWindow 35 IoCs
pid Process 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe - Suspicious use of SendNotifyMessage 35 IoCs
pid Process 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4532 taskmgr.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5612 wrote to memory of 3584 5612 Sakuraa.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\Sakuraa.exe"C:\Users\Admin\AppData\Local\Temp\Sakuraa.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5612 -
C:\Users\Admin\AppData\Roaming\WindowsUpdate\My Agent.exe"C:\Users\Admin\AppData\Roaming\WindowsUpdate\My Agent.exe"2⤵
- Executes dropped EXE
PID:3584
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4532
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\WindowsUpdate\My Agent.exe
- Size 8.9MB
- SHA256 c4d3c8a8b3a0f69a86dfbd2c3ba8c8f431c3b5ec823bd35a1221766e6b2b7b1f
- MD5 5520d461b4f4b2e8916d0e48ff447995
- SHA1 0e55d1dba655759806a14cdf2fa9487ee4e60a60
- SHA512 400b403d251ae4efdbbad936c226a42e69c3590d164c580f583a5a18c47f6587a492db1fabfa6b22f7c7b616982a4f46693604f5c84ad71dcd059c9fd11061fe
- SSDEEP 98304:oaGn4WyCO3HmWOjEUBj+Sddm/B7SHrzwpOulfCfYVC:ogNROwUJm/dGryl6f
- TLSH T18C966B07EDA619E5C5AED2318AB291537F717C891B2023D71B50F6382F7ABD0ADB9310
- MD5 SHA1 SHA512 SSDEEP TLSH