Analysis
- user interaction
yes - max time kernel
30s - max time network
26s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/11/2026, 17:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
900 seconds
General
- Target Setup.exe
- Size 4KB
- Sample261107-vy45saev7n
- SHA256 f6da793cc303997e3e07a4f2a664a78e6e8f041235ca9a2c273c49b1fa08c54b
- MD5 1e7c2b1e5465e48998293f2227ad5014
- SHA1 5b5941308a6d62a16c728a876c80fd5cad7eaed5
- SHA512 fc02093619786dd2892cf861d0b0e9506af5d7d1db0b33704bf3e971e55ce2b8776a5f5a14a0cf5430c966e0e2fcf9d6fdfb17da5d45114be6fb8d905b02d7a3
- TLSH T1FE813146DBE84227E0A643749AF7831177E5F9609A7B836C38C4132E7E627604D53BF1
- MD5 SHA1 SHA512 TLSH
Score
3/10
Malware Config
Signatures
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3204 cmd.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Suspicious behavior: EnumeratesProcesses 33 IoCs
pid Process 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1972 taskmgr.exe Token: SeSystemProfilePrivilege 1972 taskmgr.exe Token: SeCreateGlobalPrivilege 1972 taskmgr.exe Token: 33 1972 taskmgr.exe Token: SeIncBasePriorityPrivilege 1972 taskmgr.exe - Suspicious use of FindShellTrayWindow 38 IoCs
pid Process 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe - Suspicious use of SendNotifyMessage 38 IoCs
pid Process 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe 1972 taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1972 taskmgr.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4708 wrote to memory of 3204 4708 Setup.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c pc.bat.bat2⤵
- Executes a command shell one-liner
PID:3204
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1972