Analysis
- user interaction
yes - max time kernel
77s - max time network
65s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/11/2026, 17:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Launcher.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
Launcher.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
27 signatures
150 seconds
General
- Target Launcher.exe
- Size 1.1MB
- Sample261102-vmfcaaff86
- SHA256 d1ab164eba28cb3040e67c0ed0ddce11d9a0b598b5c3bad5ab33eb40ee5097bf
- MD5 509550f7aab7320b054bbef3168084ec
- SHA1 5f9c0dea4d0ce78a27b252fcf01ad6234b9d7b71
- SHA512 21c3e23fb94a135ab0ad0cf9a11209968671bf72c5c926112dd54749a0b67790269622816c26c95d65ab269f1e6e218588dc60fafc368d08a62420a0bbd5ba4e
- SSDEEP 12288:Mbs/m0E54jwaFXGc8lEBBBHGBKq2IZwDfvfqItNqdg:MbOVE5ifGPRZwDvf3fd
- TLSH T1A0357B83E7A385D8C116D9B5534BF137F9627C8E4B153197ABC41E633A67BA4E22CB00
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Launcher.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Launcher.exe - Suspicious behavior: EnumeratesProcesses 36 IoCs
pid Process 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 5652 taskmgr.exe Token: SeSystemProfilePrivilege 5652 taskmgr.exe Token: SeCreateGlobalPrivilege 5652 taskmgr.exe - Suspicious use of FindShellTrayWindow 48 IoCs
pid Process 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe - Suspicious use of SendNotifyMessage 48 IoCs
pid Process 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe 5652 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"1⤵
- Checks processor information in registry
PID:3728
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4176
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5652