Analysis
- user interaction
yes - max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
13/07/2026, 15:23
Static task
static1
Behavioral task
behavioral1
Sample
LunaExecutor.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
LunaExecutor.zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target LunaExecutor.zip
- Size 74.0MB
- Sample260713-ssrldsbs8q
- SHA256 b93d76f2b87b9139d44e0dbca09c3a9d49c0d184c018fbb7ffd250099188ce56
- MD5 3731dfa7b860027bd2a32b66275aeb78
- SHA1 50d616255a2048975f2928c8cdb2c7a413525413
- SHA512 2055f449f03f1886476e6ea2fad77360dded72cf403545533f17acb117a644fb3c59ca7ca73452e180f1ab264839658bff5545c6f7646696581385a79e2eeab9
- SSDEEP 1572864:2QW/+1ViV9sDoRXYZc7Gcj3/duZb87v1nKxH8NaHk5ZAHG/DlTaJ5/4jRb0+9MKR:JAfV9s09/SoVBv1QH8Q5SDxanONKKF7
- TLSH T1C50833DADA0E3494C805FBB2F5F30602C6B45EBE80658778D1DD2DD1E2A61E81B785F8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 764 taskmgr.exe Token: SeSystemProfilePrivilege 764 taskmgr.exe Token: SeCreateGlobalPrivilege 764 taskmgr.exe Token: 33 764 taskmgr.exe Token: SeIncBasePriorityPrivilege 764 taskmgr.exe - Suspicious use of FindShellTrayWindow 39 IoCs
pid Process 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe - Suspicious use of SendNotifyMessage 39 IoCs
pid Process 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe 764 taskmgr.exe
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\LunaExecutor.zip1⤵PID:464
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4464
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:764