Analysis
- max time kernel
149s - max time network
104s - platform
windows11-21h2_x64 - resource
win11-20251015-en - resource tags
arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system - submitted
08/11/2025, 20:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
file.exe
Resource
win10v2004-20250619-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win11-20251015-en
windows11-21h2-x64
8 signatures
150 seconds
General
- Target file.exe
- Size 2.3MB
- Sample251108-yv3dkavnhp
- SHA256 fec7c49137a5bc09195c3fc3a4dd79a9d6d97a401df8c32f34b335b3fe89a18b
- MD5 16ad43dbe6e7cad2d658b72ad1eb6fde
- SHA1 2cc71e8c0daa155e72c2e650a2c1b2890e67d152
- SHA512 cc76508a80819ae26f19153ff0a8123a102c27ae48b76aa564cac06aff09488c84796e4629ef89103ddcad6324c3d9cbf53d6465e14f6e4121e12b099f96e311
- SSDEEP 49152:/ZwMeGl+VAoVNdoFmLPkJcssvfSVPko1007hrjkhl1Ymu11:/ZfZlJCNd2mCsCVPSs/dmu
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Enumerates VirtualBox registry keys 2 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo file.exe - Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions file.exe - Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools file.exe - Looks for VMWare services registry key. 1 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmware file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci file.exe - Looks for Xen service registry key. 1 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\xensvc file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\xenevtchn file.exe - Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate file.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion file.exe - Checks system information in the registry 2 TTPs 2 IoCs
System information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer file.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName file.exe - Suspicious behavior: EnumeratesProcesses 32 IoCs
pid Process 4500 file.exe 4500 file.exe 4500 file.exe 4500 file.exe 4500 file.exe 4500 file.exe 4500 file.exe 4500 file.exe 4500 file.exe 4500 file.exe 4500 file.exe 4500 file.exe 4500 file.exe 4500 file.exe 4500 file.exe 4500 file.exe 4500 file.exe 4500 file.exe 4500 file.exe 4500 file.exe 4500 file.exe 4500 file.exe 4500 file.exe 4500 file.exe 4500 file.exe 4500 file.exe 4500 file.exe 4500 file.exe 4500 file.exe 4500 file.exe 4500 file.exe 4500 file.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Looks for Xen service registry key.
- Checks BIOS information in registry
- Checks system information in the registry
- Suspicious behavior: EnumeratesProcesses
PID:4500