Analysis
- user interaction
yes - max time kernel
150s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/10/2026, 17:04
Behavioral task
behavioral1
Sample
verity.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
verity.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target verity.exe
- Size 31.7MB
- Sample261029-vlkwdaew2j
- SHA256 49475cd5849e1e8fc9295f704a547841fe49cc773b0cd301ef28674a5138a5cd
- MD5 c94796cdf3dd73ca2989f92079d5ee10
- SHA1 477c831a4cb11dfc86ad32b933112881c4c056f5
- SHA512 ebdb0a893e733be7745e1dc60f28971f8bb41dab2412677c402bdd1b875c55e11c2f3913f02475867972ae6a0f1ec5fc40316e2c43c658b7a8d576bd283c6001
- SSDEEP 786432:4BedveMvuq+S9+OWrhsqP6bxW2S3BKKoECziHVB/WjfQT:481hvuScOWrfP6iBKhEmM/
- TLSH T165773390FBC550FBD5FB803E9467C531FBB2B92413D0899F1A9817926E237C29334A66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 10 IoCs
pid Process 1284 verity.exe 1284 verity.exe 1284 verity.exe 1284 verity.exe 1284 verity.exe 1284 verity.exe 1284 verity.exe 1284 verity.exe 1284 verity.exe 1284 verity.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Suspicious behavior: EnumeratesProcesses 34 IoCs
pid Process 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2848 taskmgr.exe Token: SeSystemProfilePrivilege 2848 taskmgr.exe Token: SeCreateGlobalPrivilege 2848 taskmgr.exe Token: 33 2848 taskmgr.exe Token: SeIncBasePriorityPrivilege 2848 taskmgr.exe - Suspicious use of FindShellTrayWindow 38 IoCs
pid Process 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe - Suspicious use of SendNotifyMessage 38 IoCs
pid Process 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe 2848 taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2848 taskmgr.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1808 wrote to memory of 1284 1808 verity.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\verity.exe"C:\Users\Admin\AppData\Local\Temp\verity.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\verity.exe"C:\Users\Admin\AppData\Local\Temp\verity.exe"2⤵
- Loads dropped DLL
PID:1284
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2848
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:1160
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000007102\VCRUNTIME140.dll
- Size 174KB
- SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
- MD5 07bc2f9c4c1b07e1cc013ca0079b31ac
- SHA1 1098f2a834146995df7a91c78f72f210d8d2d12d
- SHA512 8fd063d61d1c57bfae5ef105b1796c141ef2752dbad17ae79f974c417542c075bc8b4ac12163629a74e43004fd9cf170a76de9d11841b6e5c236f5b47fbbb09b
- SSDEEP 3072:aoq3aLPst/GrhA4gBSnSQ37QwZyeBB0ecbavp7D:aofLPsmBnSQ3VyeBB0ecbaV
- TLSH T1C6048D51B2CC00B2E92B9674CCD69553D6B1B0057B30AADF47A846782F33FF2A63DA15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000007102\_bz2.pyd
- Size 84KB
- SHA256 37cbaeff9be4494f682eafe4adb642178f9c7277d4cda9ec343cfc06849a263b
- MD5 e3035138d1373e96e169e4c446b18e76
- SHA1 101cd23556bc0a8c4728460c4bf0bd15fa0f3d7e
- SHA512 935bafffde5f9e90f866533c863087fdca6df0e176906aad2c7fef4325df2eeb4ae2bc4eaa24096425679c2196feef48c0061392fd5b7a13d5957d37f93f4c47
- SSDEEP 1536:8ssutY90GtePwhFjKjBSnLYK9EJG8jKMi+gIP3VQyjKdLi92t+fIzoG4Zbu:btw0GtePwbuByY2SxuMi+gIP3V2t/EC
- TLSH T109835C52AB7416BAF22B917816B043A3F730BB65172057EFB2C485552F13FD1AE303A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000007102\_ctypes.pyd
- Size 139KB
- SHA256 746cf693e04ceb5f5468cbd7d1cbd535403693e421dad0d34ff77a25b171bc20
- MD5 d9613a6cc7eeab428957c666ecdcb8b3
- SHA1 ed9ac7f748a1000ba886490f3477d97602f4f4d2
- SHA512 c70af6817bd4053a251364d436470e4f18d6637fd8684a3a9ab0e8da060f7f5aad06b1ab90d35ed7f8ccb4cbc4b755361d7b8e56357dc8e2e7c7bb688be643a4
- SSDEEP 3072:a+oHacqjRXPAuvs2FisZiY70m6FrpOEOq57ze3zxOE8pN3z3xYZjEcIPGP+JE:5nY6i6QreM7zOgT3kjEk
- TLSH T141E35B4B739800A6DB638178C5B39A47EBB1F4516B2053CF0164C99A2F637E2AE3F715
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000007102\_lzma.pyd
- Size 167KB
- SHA256 cfe42690aac2065f94d9e7df8cf53c523fdce787b9cb1593abe0190ae1d5891b
- MD5 008e6abc565ed25cfadbdf61cf81dc3e
- SHA1 6288e84fa1436348cf615550283ccedc5ef0dd25
- SHA512 401f346436ef67a980e8e8dcd8e4d303374129000a174fe027d535775ba45cc0fba7f4ef1fc24b1d7a82fa7076d7bf91e4f6a0753c04e466d7e64910818e1ad3
- SSDEEP 3072:3sRr+8GAgJ6wLtOGq8YQpsrL0znf19mNoDx5PExmP+gIPI1Ug:3sRr+MgJ6wB67Q0qtYODvE4Wk
- TLSH T12BF32991B258F0D6F3328C34CA964F63E6F97805432092DB018D977D6A2FBE59A76313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000007102\_socket.pyd
- Size 86KB
- SHA256 a8a469df1c4fadfad6a72d379e1af7591e552c9c24aba0ca3dfd8e2ba8bfdb91
- MD5 2466924026b846b9dd3049a55405972f
- SHA1 e5144b9c4e33355b36b80c010c877aa3f4fb66f5
- SHA512 a23ae0c389785b480c02fa91c71743a7f4f267c8740b3edbd5a7fd628ee558460cf47067df4cd755fe294e85e0a8bb32483cad9c3101cd6cc0e6b330b09e33eb
- SSDEEP 1536:ZTFMxL96MDsyiuK7Oc4M0ypYHiXA+6Xwwzckrf4PcktcIPGwfHyjKdLi9kfIE14:TelsGK6c4HypYHiXAzXwwz1D4EktcIPo
- TLSH T1ED835901A6A041F6EB729175C2638E63FF74B4C11394A7DF1466C65A1F333C2BE3AA85
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000007102\_zstd.pyd
- Size 494KB
- SHA256 229e2029d167490a4fc95def7ca1670aee358a732cae13285478e74b8ce2f1d1
- MD5 4823a9040f63d6cc4cc158d01001f590
- SHA1 c88639308123386222924839700f5221a07f351b
- SHA512 c4235f15f7d2a060f016a734e32a6e71995618e60fabf689538995028e9d45e026b70b62427d61914c458b7d24c1927d38115ae87d5f3b2f6605ed54b3aba882
- SSDEEP 12288:j8c6M6EDdQw0MiO+sDwUZRkB22RvWYHDEg5BCl9VEHS:j8DMn0tWRkBFuYHDtS
- TLSH T1E2B49E43F25943ECD437C4B4CA5A9613FBB6B84A2214525793A5DFA83F03B31DB2A319
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000007102\base_library.zip
- Size 1.4MB
- SHA256 390f0113ec897083f66dd9f13cce1b1ad4807d9328d267655f899c7725d10027
- MD5 ddb5ddc096d40dc68370ff216ecded0b
- SHA1 a2b2d0225fe9535c7c1ba8721a5f7ea581c86fdb
- SHA512 5e45a2dc5a2618d2599c3474256996dfd59db9fd4f1ffb989279c52c64c204960c63a4ccff6375bd210ad80add69da2d4d109b0d9ae4bef7bd56eee372f0f0f6
- SSDEEP 24576:Je9zUVr7AcoBFw5t7Q92ZosCxeGXP2m25af/IY:Je9zUVPEFh9xsCceJ
- TLSH T101653AE6749239D7FF48F37F4037AE0C2BA95111EE04E6477C9949B82FAE6901F58188
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000007102\libffi-8.dll
- Size 38KB
- SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
- MD5 0f8e4992ca92baaf54cc0b43aaccce21
- SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
- SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
- SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
- TLSH T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000007102\python3.dll
- Size 74KB
- SHA256 67af820b620d119f85cbc3f7d494166b443d87b7a04e047dee0bc92502161bc9
- MD5 15398f8bb032f7661cd9cc3cf59f1a73
- SHA1 8de06bc6dd7d822e793bbb078374b01ec0b0041c
- SHA512 f94133e7202075c9bd25a2216ca5d85a4e97f5f259a906f6cb4c7e64129d445dfc84ac20e52f3367b9194f37784986cae14edfb3478041d9992ec3e54d4b6346
- SSDEEP 1536:+2+7QHQnnBjKALOhtuPucLCFha0Zk30Hxs42yp4K2EIlMVOVhki3/oFVYe3/89Pf:yQGcIPG0XjP
- TLSH T1B3731C525B54F8E2DAB627FC7893998D1F2B12CC83298C9C647D93D20DDA313A62734D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI000007102\python315.dll
- Size 7.5MB
- SHA256 ca4f7b4823ca187f4a6483fba9f21804390a183b783ee2bf9b5ab75d98f62c3b
- MD5 3a9d7ffd3b407879f13fee566e523e62
- SHA1 8e4b7dd597608f8e421995fd980452eb199731be
- SHA512 de27b06ca9ad246bd10f9d6921f7bd4ea53558fc889f59111ad9a7072302f055ca8f9ed55b7dba5b850d3e5fe47de8c35d9eadb422a29c8590966511d4bd1444
- SSDEEP 98304:3RFyy6m+gxchUIywFr8dyGL2MOa5FuEhv5HDMiEp0+J:3RFr6thUIyw18dyNMOOyiF+J
- TLSH T1D5867B3A73A511A4D87BC036C5434647EBB1BC10AB20D2CB52547A9A2F337E35BFA725
- MD5 SHA1 SHA512 SSDEEP TLSH