Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
09/05/2026, 11:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fa2f4d9745fb1c725f1b4fdf34b25f0561e4412511413077bba6dcdc53d9c264.exe
Resource
win10v2004-20260130-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
fa2f4d9745fb1c725f1b4fdf34b25f0561e4412511413077bba6dcdc53d9c264.exe
Resource
win11-20260130-en
3 signatures
150 seconds
General
- Target fa2f4d9745fb1c725f1b4fdf34b25f0561e4412511413077bba6dcdc53d9c264.exe
- Size 20KB
- Sample260509-nyefssf18x
- SHA256 fa2f4d9745fb1c725f1b4fdf34b25f0561e4412511413077bba6dcdc53d9c264
- MD5 e7c0ccc633c23a0798e7a783fab5fa85
- SHA1 a87346425292aec7ab1059cc37a47d960ff6f945
- SHA512 c8507a0e38244790cccfface5b081402f3b3d5ed0c22559ecece8452ff609b71cb57c98ec1be9efff6db4b2e27bebc75774ce1797ab6ce95871f16cd42e4afd3
- SSDEEP 384:cI3aHL/QgYorYmvNTDSDiWKzXcXxUu0MeAw:cI3ar/j3rYPFMcGu0R
- TLSH T12F921A06EB4385F6E42955F41CF787FA4AB6BF328CBE87B5CFA4E21038206604A11757
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest fa2f4d9745fb1c725f1b4fdf34b25f0561e4412511413077bba6dcdc53d9c264.exe - Looks for VMWare services registry key. 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci fa2f4d9745fb1c725f1b4fdf34b25f0561e4412511413077bba6dcdc53d9c264.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fa2f4d9745fb1c725f1b4fdf34b25f0561e4412511413077bba6dcdc53d9c264.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fa2f4d9745fb1c725f1b4fdf34b25f0561e4412511413077bba6dcdc53d9c264.exe"C:\Users\Admin\AppData\Local\Temp\fa2f4d9745fb1c725f1b4fdf34b25f0561e4412511413077bba6dcdc53d9c264.exe"1⤵
- Enumerates VirtualBox registry keys
- Looks for VMWare services registry key.
- System Location Discovery: System Language Discovery
PID:3828