Analysis
- user interaction
yes - max time kernel
150s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
13/11/2026, 00:29
Behavioral task
behavioral1
Sample
9ce4dd3d7b4edeef5922197213eef35761e770c2cff042a4a7dc20b22302830e.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 9ce4dd3d7b4edeef5922197213eef35761e770c2cff042a4a7dc20b22302830e.exe
- Size 2.3MB
- Sample261113-as8kssys8p
- SHA256 9ce4dd3d7b4edeef5922197213eef35761e770c2cff042a4a7dc20b22302830e
- MD5 2087e5f4f9dfd23ec71bf437f68e6f88
- SHA1 2a966452f463c5cd0ee85804a94052de4b9f4a0a
- SHA512 81f01afb8950a88d73cb3af83e8d1b5cb2faf291be3f189d696109264ec9ab7e6730677adb94c5cbb894c81242ee142d7d2e2c3addca9902a48e9efb1b4f824f
- SSDEEP 49152:R7VFaFgvLTNmL1UJkF/f+Tx+BCDH6Nt+U6lYkC8Xm4OYD1:VV6kNmxUJk41+KaNt+U62kj3O
- TLSH T1AAB533C6B8C73605EB7746780BDF80143260E0CC636FA21A8E936E2E54A941DD719D7F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/5016-0-0x00007FF7457A0000-0x00007FF745DDF000-memory.dmp upx behavioral1/memory/5016-1-0x00007FF7457A0000-0x00007FF745DDF000-memory.dmp upx behavioral1/memory/5016-2-0x00007FF7457A0000-0x00007FF745DDF000-memory.dmp upx behavioral1/memory/5016-16-0x00007FF7457A0000-0x00007FF745DDF000-memory.dmp upx behavioral1/memory/5016-17-0x00007FF7457A0000-0x00007FF745DDF000-memory.dmp upx behavioral1/memory/5016-18-0x00007FF7457A0000-0x00007FF745DDF000-memory.dmp upx behavioral1/memory/5016-19-0x00007FF7457A0000-0x00007FF745DDF000-memory.dmp upx - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 9ce4dd3d7b4edeef5922197213eef35761e770c2cff042a4a7dc20b22302830e.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 9ce4dd3d7b4edeef5922197213eef35761e770c2cff042a4a7dc20b22302830e.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5016 9ce4dd3d7b4edeef5922197213eef35761e770c2cff042a4a7dc20b22302830e.exe 5016 9ce4dd3d7b4edeef5922197213eef35761e770c2cff042a4a7dc20b22302830e.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2932 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTcbPrivilege 5016 9ce4dd3d7b4edeef5922197213eef35761e770c2cff042a4a7dc20b22302830e.exe Token: SeDebugPrivilege 2932 taskmgr.exe Token: SeSystemProfilePrivilege 2932 taskmgr.exe Token: SeCreateGlobalPrivilege 2932 taskmgr.exe Token: SeSecurityPrivilege 2932 taskmgr.exe Token: SeTakeOwnershipPrivilege 2932 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe 2932 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9ce4dd3d7b4edeef5922197213eef35761e770c2cff042a4a7dc20b22302830e.exe"C:\Users\Admin\AppData\Local\Temp\9ce4dd3d7b4edeef5922197213eef35761e770c2cff042a4a7dc20b22302830e.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5016
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2932