Analysis
- user interaction
yes - max time kernel
38s - max time network
39s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
20/06/2026, 16:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ram_ui.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
ram_ui.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
6 signatures
150 seconds
General
- Target ram_ui.exe
- Size 13.1MB
- Sample260620-twp3eahs31
- SHA256 119236bbf20a77c26ddb4b3e3b721ceb64644ae0ffce68a6b71ab73f04f2186a
- MD5 73256a61010bbd125aae9e8ce36569a7
- SHA1 ad3d8332dba71ed712f73eafa27420acf3d70974
- SHA512 df6545364c403d3a6a33c61a45b10d7cbb10f7dbea3b5576409dd17c4f5d7ef7d20d38af696ac355d53323beb1d36a052521799dea32974a2f7d6f619c64363f
- SSDEEP 98304:wn3I4WMF7U5GJqK8i9/q6z3kcDLa/HU+U9uEbrxWwI41sp:ynZLf/V3kcR/uVwI41s
- TLSH T18DD64A12BB8A99ACD05AC47083468A735A3170CB0B35B9FF45D856793F6AAF05F3C358
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe - Suspicious behavior: EnumeratesProcesses 59 IoCs
pid Process 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4956 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4956 taskmgr.exe Token: SeSystemProfilePrivilege 4956 taskmgr.exe Token: SeCreateGlobalPrivilege 4956 taskmgr.exe Token: 33 4956 taskmgr.exe Token: SeIncBasePriorityPrivilege 4956 taskmgr.exe - Suspicious use of FindShellTrayWindow 55 IoCs
pid Process 6072 ram_ui.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe - Suspicious use of SendNotifyMessage 54 IoCs
pid Process 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ram_ui.exe"C:\Users\Admin\AppData\Local\Temp\ram_ui.exe"1⤵
- Suspicious use of FindShellTrayWindow
PID:6072
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4956