Analysis
- user interaction
yes - max time kernel
149s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/11/2026, 00:29
Behavioral task
behavioral1
Sample
9ce4dd3d7b4edeef5922197213eef35761e770c2cff042a4a7dc20b22302830e.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 9ce4dd3d7b4edeef5922197213eef35761e770c2cff042a4a7dc20b22302830e.exe
- Size 2.3MB
- Sample261113-as8kssys8p
- SHA256 9ce4dd3d7b4edeef5922197213eef35761e770c2cff042a4a7dc20b22302830e
- MD5 2087e5f4f9dfd23ec71bf437f68e6f88
- SHA1 2a966452f463c5cd0ee85804a94052de4b9f4a0a
- SHA512 81f01afb8950a88d73cb3af83e8d1b5cb2faf291be3f189d696109264ec9ab7e6730677adb94c5cbb894c81242ee142d7d2e2c3addca9902a48e9efb1b4f824f
- SSDEEP 49152:R7VFaFgvLTNmL1UJkF/f+Tx+BCDH6Nt+U6lYkC8Xm4OYD1:VV6kNmxUJk41+KaNt+U62kj3O
- TLSH T1AAB533C6B8C73605EB7746780BDF80143260E0CC636FA21A8E936E2E54A941DD719D7F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/1492-0-0x00007FF775210000-0x00007FF77584F000-memory.dmp upx behavioral2/memory/1492-1-0x00007FF775210000-0x00007FF77584F000-memory.dmp upx behavioral2/memory/1492-2-0x00007FF775210000-0x00007FF77584F000-memory.dmp upx behavioral2/memory/1492-3-0x00007FF775210000-0x00007FF77584F000-memory.dmp upx behavioral2/memory/1492-4-0x00007FF775210000-0x00007FF77584F000-memory.dmp upx behavioral2/memory/1492-5-0x00007FF775210000-0x00007FF77584F000-memory.dmp upx behavioral2/memory/4528-32-0x00007FF775210000-0x00007FF77584F000-memory.dmp upx behavioral2/memory/4528-33-0x00007FF775210000-0x00007FF77584F000-memory.dmp upx behavioral2/memory/4528-34-0x00007FF775210000-0x00007FF77584F000-memory.dmp upx behavioral2/memory/4528-35-0x00007FF775210000-0x00007FF77584F000-memory.dmp upx - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 9ce4dd3d7b4edeef5922197213eef35761e770c2cff042a4a7dc20b22302830e.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 9ce4dd3d7b4edeef5922197213eef35761e770c2cff042a4a7dc20b22302830e.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1492 9ce4dd3d7b4edeef5922197213eef35761e770c2cff042a4a7dc20b22302830e.exe 1492 9ce4dd3d7b4edeef5922197213eef35761e770c2cff042a4a7dc20b22302830e.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4544 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeTcbPrivilege 1492 9ce4dd3d7b4edeef5922197213eef35761e770c2cff042a4a7dc20b22302830e.exe Token: SeDebugPrivilege 4544 taskmgr.exe Token: SeSystemProfilePrivilege 4544 taskmgr.exe Token: SeCreateGlobalPrivilege 4544 taskmgr.exe Token: SeTcbPrivilege 4528 9ce4dd3d7b4edeef5922197213eef35761e770c2cff042a4a7dc20b22302830e.exe Token: 33 4544 taskmgr.exe Token: SeIncBasePriorityPrivilege 4544 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4544 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9ce4dd3d7b4edeef5922197213eef35761e770c2cff042a4a7dc20b22302830e.exe"C:\Users\Admin\AppData\Local\Temp\9ce4dd3d7b4edeef5922197213eef35761e770c2cff042a4a7dc20b22302830e.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1492
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4544
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\9ce4dd3d7b4edeef5922197213eef35761e770c2cff042a4a7dc20b22302830e.exe"C:\Users\Admin\AppData\Local\Temp\9ce4dd3d7b4edeef5922197213eef35761e770c2cff042a4a7dc20b22302830e.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4528