Analysis
- user interaction
yes - max time kernel
150s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
13/11/2026, 07:37
Static task
static1
Behavioral task
behavioral1
Sample
target.ps1
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
target.ps1
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target target.ps1
- Size 1.2MB
- Sample261113-jf2fdshs21
- SHA256 3655d8eec0690fdf52ca8420dfa1d4deefdca054201d9597a973ba5c8ba78ea6
- MD5 b683d1a8010f5836254bf037d38e706d
- SHA1 50776677e53dc2d9dd8a4fd851ddd9d8691c0097
- SHA512 ade57e4b5a7a1efd0ecb2c190ea73e2bc748058ab1320012f95a6ac49be83d4487e222d5fb7b406e830ae6faeb7356e29a22d10ad7377f188780c033c8434b6e
- SSDEEP 12288:jWPZEWRdHr44TH7aVLU+/nj61xSEeP2GNE0T1dknCV:jWPZ5dknP8n0ZJ
- TLSH T196451FFBE1565357EFDC2BBECA011E325B0D5A45243A988DB9ECB60A771AC00D1BE1D0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
-
pid Process 380 powershell.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 380 powershell.exe 380 powershell.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1800 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 380 powershell.exe Token: SeDebugPrivilege 1800 taskmgr.exe Token: SeSystemProfilePrivilege 1800 taskmgr.exe Token: SeCreateGlobalPrivilege 1800 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe 1800 taskmgr.exe
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\target.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:380
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1800
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_whprx5j4.qbo.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH