Analysis
- user interaction
yes - max time kernel
98s - max time network
93s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/11/2026, 15:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bs_ext.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
bs_ext.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target bs_ext.exe
- Size 615KB
- Sample261102-srfshaaz8v
- SHA256 6e0c65e7b393d0aa05c83a109d498f29d3de320cc75cfaf2212caac77c77fa4e
- MD5 97dd3bb96ad5b2c40aa67f8f7b3bd50f
- SHA1 d1122170248da601d1443a372e504a5e867050b3
- SHA512 09d93f33bde07aef51b169f473cc2805ad6cd26c48a63cbcde66e25c3137e501611c8be183af83764db504521f6d487d1a66a9d905fcac5cd60a60204d2343b1
- SSDEEP 12288:KZvvPjyUeJ5eF2qkQudAKcJgw/DM8YGftGeW7XiS33WLnD6Jvqn:K9s5eLnudhcuwDdtlWjirLnDx
- TLSH T1FED4AF87E2F40469C46BD134C6BBCE15ED7E3840A7B44EDB239869A527232E4773E721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3804 bs_ext.exe 3804 bs_ext.exe 3804 bs_ext.exe 3804 bs_ext.exe 3804 bs_ext.exe 3804 bs_ext.exe 3804 bs_ext.exe 3804 bs_ext.exe 3804 bs_ext.exe 3804 bs_ext.exe 3804 bs_ext.exe 3804 bs_ext.exe 3804 bs_ext.exe 3804 bs_ext.exe 3804 bs_ext.exe 3804 bs_ext.exe 3804 bs_ext.exe 3804 bs_ext.exe 3804 bs_ext.exe 3804 bs_ext.exe 3804 bs_ext.exe 3804 bs_ext.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 3804 bs_ext.exe 3804 bs_ext.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 3804 bs_ext.exe 3804 bs_ext.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 3804 bs_ext.exe 3804 bs_ext.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 3804 bs_ext.exe 3804 bs_ext.exe 1996 taskmgr.exe 1996 taskmgr.exe 3804 bs_ext.exe 3804 bs_ext.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 3804 bs_ext.exe 3804 bs_ext.exe 1996 taskmgr.exe 1996 taskmgr.exe 3804 bs_ext.exe 3804 bs_ext.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 3804 bs_ext.exe 3804 bs_ext.exe 1996 taskmgr.exe 1996 taskmgr.exe 3804 bs_ext.exe 3804 bs_ext.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1996 taskmgr.exe Token: SeSystemProfilePrivilege 1996 taskmgr.exe Token: SeCreateGlobalPrivilege 1996 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe 1996 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bs_ext.exe"C:\Users\Admin\AppData\Local\Temp\bs_ext.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3804
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1996