Analysis
- user interaction
yes - max time kernel
68s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/10/2026, 00:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ziory.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target ziory.exe
- Size 2.8MB
- Sample261024-abhcaadh47
- SHA256 6352649033a9295e8624d87073059fdbe5701ed29d6dcf6769b80075cfd8b1d7
- MD5 53f10b15b7f89f4d5409070aa0bf8bef
- SHA1 e0e07a9bf82c33bd44db8cb0c132cefec37d96f1
- SHA512 a67cb838dd15ec5056e9e2a2aba70aa0c67c6eda1b7e9b3b07ea71743c93ea4118db66c82bf1a67006bb5b3d6eae2a4381f3ab453b445125417f607eab8468ac
- SSDEEP 49152:RmLwK9ovju+hm0ersBs15+apLd6Zsy2hHzSzoIaJ15am0:RoBkizoBsfd6Z1aHzM7W1
- TLSH T19CD58E82F38182E8C41BE530A477ABF75B317C255E346A6721D0F6372FB36D00A59B69
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2300 ziory.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4136 taskmgr.exe Token: SeSystemProfilePrivilege 4136 taskmgr.exe Token: SeCreateGlobalPrivilege 4136 taskmgr.exe Token: 33 4136 taskmgr.exe Token: SeIncBasePriorityPrivilege 4136 taskmgr.exe - Suspicious use of FindShellTrayWindow 50 IoCs
pid Process 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe - Suspicious use of SendNotifyMessage 50 IoCs
pid Process 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe 4136 taskmgr.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2300 ziory.exe 2300 ziory.exe 4136 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ziory.exe"C:\Users\Admin\AppData\Local\Temp\ziory.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2300
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4136
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:3784