Analysis
- max time kernel
149s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/11/2026, 19:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
puw_notch.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
puw_notch.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target puw_notch.exe
- Size 901KB
- Sample261110-ynbx2aaf53
- SHA256 f4c28e49060f95b892c357c471b8213a4ba24f8966d8d0fbd1c31dc57e9cd30d
- MD5 6eb09a2a7c659b46229144c73e733f0e
- SHA1 d6163744bb3109411ec69086058eb9dbec5b170c
- SHA512 4e0d10d379b7396595b2d09e0a2ce7433dd1614e5c24b58cf1bf0b99ee8d1cf0a5a40d59fed3cb138b7b72ed85b83fd5d674878085a1277c7b79c0e7dcd81b9c
- SSDEEP 12288:If9RkNAL2oTk/ocHVrPDkhkpDEV778KW0+o/soKKQxGlcc7MhRjg:In2oTkocHVvkeDEV779Wo0oKIllY
- TLSH T13D156C03E3A480E8D499C078A75AE537E632F8CD4A3575EB1BE41B112FA5F909F2D718
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 8 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009 svchost.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4936 puw_notch.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 4936 puw_notch.exe Token: SeIncBasePriorityPrivilege 4936 puw_notch.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe 4936 puw_notch.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4936 puw_notch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\puw_notch.exe"C:\Users\Admin\AppData\Local\Temp\puw_notch.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4936
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵PID:1504
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵
- Checks SCSI registry key(s)
PID:2396