Analysis
- user interaction
yes - max time kernel
899s - max time network
463s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 17:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
BstkDeltaRooter.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
900 seconds
General
- Target BstkDeltaRooter.exe
- Size 9.1MB
- Sample260730-wjbqcsxtb1
- SHA256 4521484cae70e971be04305141581cf316170cae4308518e3c27a38d187259b2
- MD5 242ddc93d295129fb2b042ea6091ee05
- SHA1 4c756e2848dd4370f4e0a18b447703087633aea3
- SHA512 add5a44c909591a1bee299828c1e53a7c6dff5f790ec42e76902540d8fcdcdc679f42c66f3514ee1f749815966299e92ce6316074396d79861700dd11d662166
- SSDEEP 98304:GHb63iSEgdEpRVd5wndjNOb0lyaps36czQQdGg+VTPUzDmg0uAhyi5orTLNdR8i2:GHxQAd5LgNmL8TsqYFTXR
- TLSH T191A6AF07FAE208B9C865CD34C65E9227E63478855312A5FF6BC85B503F9BB90AF2D710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Suspicious behavior: EnumeratesProcesses 45 IoCs
pid Process 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2448 taskmgr.exe Token: SeSystemProfilePrivilege 2448 taskmgr.exe Token: SeCreateGlobalPrivilege 2448 taskmgr.exe Token: 33 2448 taskmgr.exe Token: SeIncBasePriorityPrivilege 2448 taskmgr.exe - Suspicious use of FindShellTrayWindow 44 IoCs
pid Process 5252 BstkDeltaRooter.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe - Suspicious use of SendNotifyMessage 44 IoCs
pid Process 5252 BstkDeltaRooter.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe 2448 taskmgr.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5252 BstkDeltaRooter.exe 2448 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\BstkDeltaRooter.exe"C:\Users\Admin\AppData\Local\Temp\BstkDeltaRooter.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5252
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2448
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:4396
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵PID:5864