Analysis
- user interaction
yes - max time kernel
39s - max time network
35s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
25/10/2026, 17:29
General
- Target x.exe
- Size 208KB
- Sample261025-v2pt9sxt2p
- SHA256 b27b11ec5e92931c0cb8dfdd5dc63df28a73e2363e640acc1a59607152e1cf11
- MD5 843d752505a8937f02c4ac8bf22f82a7
- SHA1 84c53947c4b83ef157db0ca8d70741edce24b7c3
- SHA512 2e0e10be0da65d62deba3e42260c70cb8751dc241f13999fd6529e17a3206b24549b677ceeae6015b42a085e413f5723063e9277631e2d27857859848b51a9a7
- SSDEEP 3072:XHhZVC3kWJbgdS9F5xXYexmKt0dNyAtoi7xWz9yJMOaI5qFY+XJO58qnEZZEY3:3hbCVKdSpxXlxmKWHz9x9b75qFYefZ1
- TLSH T1F624D04333E48D22C5BE06F548A293A043B4A25B4466E7DF5DF698CBF5DA7D40E00AE7
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Program crash 1 IoCs
pid pid_target Process procid_target 2304 3924 WerFault.exe 84 - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language x.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings taskmgr.exe - Suspicious behavior: EnumeratesProcesses 38 IoCs
pid Process 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1504 taskmgr.exe Token: SeSystemProfilePrivilege 1504 taskmgr.exe Token: SeCreateGlobalPrivilege 1504 taskmgr.exe - Suspicious use of FindShellTrayWindow 48 IoCs
pid Process 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe - Suspicious use of SendNotifyMessage 48 IoCs
pid Process 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe 1504 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\x.exe"C:\Users\Admin\AppData\Local\Temp\x.exe"1⤵
- System Location Discovery: System Language Discovery
PID:3924 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3924 -s 8722⤵
- Program crash
PID:2304
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3924 -ip 39241⤵PID:3392
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1504
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1180
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\System32\q_a57s.exe
- Size 7.2MB
- SHA256 8de080f3e99dc52ebcd862d643724eb29788d1cd8ea8ec0741f32b6c069780b8
- MD5 f93821f2444d218d60ccc8e8236ce34a
- SHA1 822fd9d95ae5fab684598c82c803e6a2abec2e5b
- SHA512 a81daef755144e2a485d78b0c00e69eb1f3668661b008456715e2cbb7e90887764cf0c93bea89f35c95b7f6891972808e996a62ecec2b11ff667b8c4bc91439b
- SSDEEP 98304:uoJhEPO306zsuYE+8ptinHgyACLuTVnLfM4Ec5Ilfmg:vK/6zz9aAy/C1Loc5Ilfmg
- TLSH T1DF767C43F85569E8C6EDD23086358252BA707C890B3077D32B61F3B92B73BD89A79354
- MD5 SHA1 SHA512 SSDEEP TLSH