Analysis
- user interaction
yes - max time kernel
28s - max time network
32s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
28/07/2026, 03:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
luau-lsp.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
luau-lsp.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target luau-lsp.exe
- Size 16.3MB
- Sample260728-eeattsxene
- SHA256 0da4f09d474e41074f4ec52bfef01eb90c014928358eda88f6a5afad5319b537
- MD5 be087717213e34f06e6198159d9c73dc
- SHA1 60e2ca8a33531199a644061238b1605f78b8ae66
- SHA512 fdc7b914eb7425bc17c23a7e52c7256f0263448ef4e0469302386a17b6ed3d5241bdc4cc2c43092c521368b9c09540ade980deffa16c201455b5a9a8650104b6
- SSDEEP 393216:XdTfwgggjgzggsgTguwttbgNlggigggXsgJgUQLCgggggCNc/gggga4ggggcgggg:NRggjgzggsgTgugtbgNlggigggXsgJgB
- TLSH T132075B3A21AC01DCF1BBD0BD8BDB9E47D6B2340903319ADF0591569A1E1BDED4A7E720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Suspicious behavior: EnumeratesProcesses 17 IoCs
pid Process 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1124 taskmgr.exe Token: SeSystemProfilePrivilege 1124 taskmgr.exe Token: SeCreateGlobalPrivilege 1124 taskmgr.exe Token: 33 1124 taskmgr.exe Token: SeIncBasePriorityPrivilege 1124 taskmgr.exe - Suspicious use of FindShellTrayWindow 43 IoCs
pid Process 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe - Suspicious use of SendNotifyMessage 43 IoCs
pid Process 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe 1124 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\luau-lsp.exe"C:\Users\Admin\AppData\Local\Temp\luau-lsp.exe"1⤵PID:3376
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1124