Analysis
- user interaction
yes - max time kernel
32s - max time network
24s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/11/2026, 17:50
Static task
static1
Behavioral task
behavioral1
Sample
file.ps1
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.ps1
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target file.ps1
- Size 178B
- Sample261113-wezxdset7v
- SHA256 bf20c522c4198a029932eaae63455c3585b42644336e780d67a1bf36574e01e4
- MD5 2e5b4a69626edd683ba410c518fbd134
- SHA1 f288cbb16e14ebcefaf3a0ffc1d16d08d75d1a82
- SHA512 8d4c0a3de8a5f0400cc0ca2af844fc94a10664cdb3e48974c636ffd4ef1d12e039188c039327f18355ef61dcaefbed4936139d06c8e323a37926c8dda237a859
- TLSH T1BDC012BC011A10AB84A94863FD1096AE27EB845F8880429320028EC5594C6BA0FA2782
- MD5 SHA1 SHA512 TLSH
Score
3/10
Malware Config
Signatures
-
pid Process 3196 PowerShell.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Suspicious behavior: EnumeratesProcesses 34 IoCs
pid Process 3196 PowerShell.exe 3196 PowerShell.exe 3196 PowerShell.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 3196 PowerShell.exe Token: SeDebugPrivilege 3540 taskmgr.exe Token: SeSystemProfilePrivilege 3540 taskmgr.exe Token: SeCreateGlobalPrivilege 3540 taskmgr.exe Token: 33 3540 taskmgr.exe Token: SeIncBasePriorityPrivilege 3540 taskmgr.exe - Suspicious use of FindShellTrayWindow 38 IoCs
pid Process 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe - Suspicious use of SendNotifyMessage 38 IoCs
pid Process 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe 3540 taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3540 taskmgr.exe
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\file.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3196
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3540