Analysis
- user interaction
yes - max time kernel
900s - max time network
577s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
21/04/2026, 04:22
General
- Target rzjz2z7.exe
- Size 853KB
- Sample260421-ey8j7sbw21
- SHA256 e88dc150d4e79efd2186355036b9548ac29a8063d04c7a83457e1b0a9c398d29
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Loads dropped DLL 1 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\rzjz2z7.exe"C:\Users\Admin\AppData\Local\Temp\rzjz2z7.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
d24d2a6a-5bae-49f2-b80e-f11e0c95d676.tmp
memory/1548-4-0x0000000180000000-0x0000000181230000-memory.dmp
memory/1548-7-0x0000000180000000-0x0000000181230000-memory.dmp
memory/1548-8-0x0000000180000000-0x0000000181230000-memory.dmp
memory/1548-6-0x0000000180000000-0x0000000181230000-memory.dmp
memory/1548-9-0x0000000180000000-0x0000000181230000-memory.dmp
memory/1548-10-0x0000000180000000-0x0000000181230000-memory.dmp
memory/1548-11-0x0000000180000000-0x0000000181230000-memory.dmp
memory/1548-12-0x0000000180000000-0x0000000181230000-memory.dmp
memory/1548-13-0x0000000180000000-0x0000000181230000-memory.dmp
memory/1548-14-0x0000000180000000-0x0000000181230000-memory.dmp
memory/1548-15-0x0000000180000000-0x0000000181230000-memory.dmp
memory/1548-16-0x0000000180000000-0x0000000181230000-memory.dmp
memory/1548-17-0x0000000180000000-0x0000000181230000-memory.dmp
memory/1548-18-0x0000000180000000-0x0000000181230000-memory.dmp
memory/1548-19-0x0000000180000000-0x0000000181230000-memory.dmp
memory/1548-20-0x0000000180000000-0x0000000181230000-memory.dmp
memory/1548-21-0x0000000180000000-0x0000000181230000-memory.dmp
memory/1548-22-0x0000000180000000-0x0000000181230000-memory.dmp
memory/1548-23-0x0000000180000000-0x0000000181230000-memory.dmp
memory/1548-24-0x0000000180000000-0x0000000181230000-memory.dmp
memory/1548-25-0x0000000180000000-0x0000000181230000-memory.dmp
memory/1548-26-0x0000000180000000-0x0000000181230000-memory.dmp
memory/1548-27-0x0000000180000000-0x0000000181230000-memory.dmp
memory/1548-28-0x0000000180000000-0x0000000181230000-memory.dmp
memory/1548-29-0x0000000180000000-0x0000000181230000-memory.dmp
memory/1548-30-0x0000000180000000-0x0000000181230000-memory.dmp
memory/1548-31-0x0000000180000000-0x0000000181230000-memory.dmp
memory/1548-32-0x0000000180000000-0x0000000181230000-memory.dmp
memory/1548-33-0x0000000180000000-0x0000000181230000-memory.dmp
memory/1548-34-0x0000000180000000-0x0000000181230000-memory.dmp
memory/1548-35-0x0000000180000000-0x0000000181230000-memory.dmp
memory/1548-36-0x0000000180000000-0x0000000181230000-memory.dmp
memory/1548-37-0x0000000180000000-0x0000000181230000-memory.dmp
memory/1548-38-0x0000000180000000-0x0000000181230000-memory.dmp
memory/1548-39-0x0000000180000000-0x0000000181230000-memory.dmp
memory/1548-40-0x0000000180000000-0x0000000181230000-memory.dmp
memory/1548-41-0x0000000180000000-0x0000000181230000-memory.dmp
memory/1548-42-0x0000000180000000-0x0000000181230000-memory.dmp
memory/1548-43-0x0000000180000000-0x0000000181230000-memory.dmp
memory/1548-44-0x0000000180000000-0x0000000181230000-memory.dmp
memory/1548-45-0x0000000180000000-0x0000000181230000-memory.dmp
memory/1548-46-0x0000000180000000-0x0000000181230000-memory.dmp
memory/1548-47-0x0000000180000000-0x0000000181230000-memory.dmp
memory/1548-48-0x0000000180000000-0x0000000181230000-memory.dmp
memory/1548-49-0x0000000180000000-0x0000000181230000-memory.dmp
memory/1548-50-0x0000000180000000-0x0000000181230000-memory.dmp
memory/1548-51-0x0000000180000000-0x0000000181230000-memory.dmp
memory/1548-52-0x0000000180000000-0x0000000181230000-memory.dmp
memory/1548-53-0x0000000180000000-0x0000000181230000-memory.dmp
memory/1548-54-0x0000000180000000-0x0000000181230000-memory.dmp
memory/1548-55-0x0000000180000000-0x0000000181230000-memory.dmp
memory/1548-56-0x0000000180000000-0x0000000181230000-memory.dmp
memory/1548-57-0x0000000180000000-0x0000000181230000-memory.dmp
memory/1548-58-0x0000000180000000-0x0000000181230000-memory.dmp
memory/1548-59-0x0000000180000000-0x0000000181230000-memory.dmp
memory/1548-60-0x0000000180000000-0x0000000181230000-memory.dmp
memory/1548-61-0x0000000180000000-0x0000000181230000-memory.dmp
memory/1548-62-0x0000000180000000-0x0000000181230000-memory.dmp
memory/1548-63-0x0000000180000000-0x0000000181230000-memory.dmp
memory/1548-64-0x0000000180000000-0x0000000181230000-memory.dmp
memory/1548-65-0x0000000180000000-0x0000000181230000-memory.dmp
memory/1548-66-0x0000000180000000-0x0000000181230000-memory.dmp
memory/1548-67-0x0000000180000000-0x0000000181230000-memory.dmp
memory/1548-68-0x0000000180000000-0x0000000181230000-memory.dmp
memory/1548-69-0x0000000180000000-0x0000000181230000-memory.dmp
memory/1548-70-0x0000000180000000-0x0000000181230000-memory.dmp