Analysis
- user interaction
yes - max time kernel
42s - max time network
39s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
03/07/2026, 01:19
Static task
static1
Behavioral task
behavioral1
Sample
mesa.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
mesa.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target mesa.exe
- Size 170KB
- Sample260703-bph2eahw7w
- SHA256 1536a031601814633d7b3ff9ec7fcc2be613d5de6380fc7cc3cfb5392f6d9ab4
- MD5 b32e580185a128f9e8c65ce3e27a0692
- SHA1 336a5c6cda64d882e980e18f5c48a3d2dfa4f8a4
- SHA512 73ddb84c7d0f3496c775b432dfd24dff4b5ddf5730402067286e5d522a0f1a590eebad75d556c6435c3a26e2ad34212f6763decc423c027075e319556be1ea19
- SSDEEP 3072:Q5vnr5Tbx829UOeKnn2LFzZBp13u36wKp4zULCQodn0b6ipfS0:QBKjK2LFzZNfIUL9k02yF
- TLSH T1DA04080662AB31A8D1B7B23889BF8512F7763C15473186DF13904A7B2FE66D0AE77311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe - Suspicious behavior: EnumeratesProcesses 25 IoCs
pid Process 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 3500 taskmgr.exe Token: SeSystemProfilePrivilege 3500 taskmgr.exe Token: SeCreateGlobalPrivilege 3500 taskmgr.exe Token: 33 3500 taskmgr.exe Token: SeIncBasePriorityPrivilege 3500 taskmgr.exe - Suspicious use of FindShellTrayWindow 51 IoCs
pid Process 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe - Suspicious use of SendNotifyMessage 51 IoCs
pid Process 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe 3500 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\mesa.exe"C:\Users\Admin\AppData\Local\Temp\mesa.exe"1⤵PID:2212
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3500