Analysis
- user interaction
yes - max time kernel
112s - max time network
85s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/10/2026, 08:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
testapp.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
testapp.exe
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
testapp.exe
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
150 seconds
General
- Target testapp.exe
- Size 627KB
- Sample261024-kph6vaef33
- SHA256 552736119ad58df3324202e65fbce961357d263606e1dd37ad5130befc686457
- MD5 1e522732eb3e1cd76e964222c41e7e7d
- SHA1 0e5f45b398302cd56fa0be0632062c290efd467b
- SHA512 bcf065f88eb4b03c1e3ec42966af9fd61826102ca590d05619d385b45fc1a7ec043fd00d485cbeb964ecb734a13973acce9888ec5dbdcfc3600f827dd0cca906
- SSDEEP 6144:OZIakvj73ORchAJSBuOAItKDfAd2oEJhwefq3abLYeyNEWGNSK/B99fSdj6Ahx5I:DazSBuOASUJ3fqKP5y8pBOxVEmuJLVF
- TLSH T193D49D18F6A401EDE27AC274CE579613F7B2B849137499EF03E089721F276A14B3E761
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe - Suspicious behavior: EnumeratesProcesses 31 IoCs
pid Process 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4052 taskmgr.exe Token: SeSystemProfilePrivilege 4052 taskmgr.exe Token: SeCreateGlobalPrivilege 4052 taskmgr.exe Token: 33 4052 taskmgr.exe Token: SeIncBasePriorityPrivilege 4052 taskmgr.exe - Suspicious use of FindShellTrayWindow 56 IoCs
pid Process 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe - Suspicious use of SendNotifyMessage 56 IoCs
pid Process 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe 4052 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\testapp.exe"C:\Users\Admin\AppData\Local\Temp\testapp.exe"1⤵PID:5016
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4052
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\dc_inj.log
- Size 662B
- SHA256 9d61fc7a3fee97b5ef3de268a417243f702613c1ab027f2e8be3e6ecc5781bba
- MD5 aa0faf1105b97db170091f7048db6919
- SHA1 633447f158391fc5df9647d2a917ee1c8f8e7fb7
- SHA512 2ef324ced24187aae62e0f1ca7115f9a9bca442def46deb6795f981de86e9f351a6349826672db57864199c798aade7545e1d46eda35b98ccdc31cadca126484
- TLSH T14F01822B802C492DF5F8D50E7225BD63F182B1035DD39C6731CD8140EF3B99CBA598A9
- MD5 SHA1 SHA512 TLSH