Analysis
- user interaction
yes - max time kernel
150s - max time network
150s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
31/08/2026, 04:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
SU.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
7 signatures
150 seconds
General
- Target SU.exe
- Size 1.5MB
- Sample260831-e9nn6svdja
- SHA256 db1e5b4acd912fd1d999b4b42090faccb90b71d74022ec8d75bbd7512427afb5
- MD5 e46dd2a3617edc79af7f07eee8dca09b
- SHA1 3bf40c603c9e59dc970f115031284d059e0e41a5
- SHA512 85eec16e3aa27f5879c9580c9366ff624ec5fa35057e031afc3a18fddb8f080c715be976dae595d27fae783fb6e2685cd67d5084795b8749e1b7b61166a267f7
- SSDEEP 24576:gjTCY7H4ef1UU7JWhlqZV6vT89c2hYTx1:OlH4efF7pGA9c2hy
- TLSH T16C755B103FB8C91AD1AEA6F8A031355083F7BF9132F5E79EC99038A91DB9B109D95347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 8 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 dwm.exe - Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS dwm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dwm.exe - Modifies data under HKEY_USERS 18 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing dwm.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4812 SU.exe 4812 SU.exe 4812 SU.exe 4812 SU.exe 4812 SU.exe 4812 SU.exe 4812 SU.exe 4812 SU.exe 4812 SU.exe 4812 SU.exe 4812 SU.exe 4812 SU.exe 4812 SU.exe 4812 SU.exe 4812 SU.exe 4812 SU.exe 4812 SU.exe 4812 SU.exe 4812 SU.exe 4812 SU.exe 4812 SU.exe 4812 SU.exe 4812 SU.exe 4812 SU.exe 4812 SU.exe 4812 SU.exe 4812 SU.exe 4812 SU.exe 4812 SU.exe 4812 SU.exe 4812 SU.exe 4812 SU.exe 4812 SU.exe 4812 SU.exe 4812 SU.exe 4812 SU.exe 4812 SU.exe 4812 SU.exe 4812 SU.exe 4812 SU.exe 4812 SU.exe 4812 SU.exe 4812 SU.exe 4812 SU.exe 4812 SU.exe 4812 SU.exe 4812 SU.exe 4812 SU.exe 4812 SU.exe 4812 SU.exe 4812 SU.exe 4812 SU.exe 4812 SU.exe 4812 SU.exe 4812 SU.exe 4812 SU.exe 4812 SU.exe 4812 SU.exe 4812 SU.exe 4812 SU.exe 4812 SU.exe 4812 SU.exe 4812 SU.exe 4812 SU.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4812 SU.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 4812 SU.exe Token: SeDebugPrivilege 4812 SU.exe Token: SeCreateGlobalPrivilege 4832 dwm.exe Token: SeChangeNotifyPrivilege 4832 dwm.exe Token: 33 4832 dwm.exe Token: SeIncBasePriorityPrivilege 4832 dwm.exe - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\SU.exe"C:\Users\Admin\AppData\Local\Temp\SU.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4812
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:6004
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4832