Analysis
- user interaction
yes - max time kernel
46s - max time network
41s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
11/05/2026, 02:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Injector.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
Injector.exe
Resource
win11-20260130-en
windows11-21h2-x64
16 signatures
150 seconds
General
- Target Injector.exe
- Size 1.1MB
- Sample260511-cqs4faas7y
- SHA256 2fd06422db41c18bb45e8ee2d6db8c7ee2a0d07bcdbcca7a6f282a66c7f09836
- MD5 e68ccef5ec91e82e7a0c842d9cf99a6b
- SHA1 1a32ee8449fd1949c896ef070e4b09f42b96dc5b
- SHA512 66a82baaeab512c103e566a33e417bcf509a5cb266941143d65b13fee593ad38a193ad712711d424b4fa6ac737bb15ae139df19cf0dee009f673d942ec1179ef
- SSDEEP 24576:rZLfXtUIOGBNewbiRJH+39vkM1JvRlh0lhSMXl9WppbWIG:XWe39vj1c
- TLSH T1D635AD1552AC81A8D576C978C5628916E7B27C059368BECF17E0BC6B2F736E13A3E700
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Injector.exe - Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions Injector.exe - Modify Registry: Disable Windows Driver Blocklist 2 TTPs 1 IoCs
Disable Windows Driver Blocklist via Registry.
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\CI\Config\VulnerableDriverBlocklistEnable = "0" Injector.exe - Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Injector.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Injector.exe - Stops running service(s) 4 TTPs
- Suspicious use of NtSetInformationThreadHideFromDebugger 14 IoCs
pid Process 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe - Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN Injector.exe - Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 5004 sc.exe - Kills process with taskkill 5 IoCs
pid Process 3984 taskkill.exe 4828 taskkill.exe 5132 taskkill.exe 1048 taskkill.exe 2576 taskkill.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe 4872 Injector.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 3984 taskkill.exe Token: SeDebugPrivilege 4828 taskkill.exe Token: SeDebugPrivilege 5132 taskkill.exe Token: SeDebugPrivilege 1048 taskkill.exe Token: SeDebugPrivilege 2576 taskkill.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4872 wrote to memory of 1032 4872 Injector.exe 85 PID 1032 wrote to memory of 3984 1032 cmd.exe 86 PID 4872 wrote to memory of 5056 4872 Injector.exe 88 PID 5056 wrote to memory of 4828 5056 cmd.exe 89 PID 4872 wrote to memory of 4996 4872 Injector.exe 90 PID 4996 wrote to memory of 5004 4996 cmd.exe 91 PID 4872 wrote to memory of 3672 4872 Injector.exe 92 PID 3672 wrote to memory of 5132 3672 cmd.exe 93 PID 4872 wrote to memory of 2388 4872 Injector.exe 94 PID 2388 wrote to memory of 1048 2388 cmd.exe 95 PID 4872 wrote to memory of 2496 4872 Injector.exe 96 PID 2496 wrote to memory of 2576 2496 cmd.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\Injector.exe"C:\Users\Admin\AppData\Local\Temp\Injector.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Modify Registry: Disable Windows Driver Blocklist
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks for VirtualBox DLLs, possible anti-VM trick
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&12⤵
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Windows\system32\taskkill.exetaskkill /f /im HTTPDebuggerUI.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3984
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&12⤵
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Windows\system32\taskkill.exetaskkill /f /im HTTPDebuggerSvc.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4828
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&12⤵
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Windows\system32\sc.exesc stop HTTPDebuggerPro3⤵
- Launches sc.exe
PID:5004
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>&12⤵
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5132
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&12⤵
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1048
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>&12⤵
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2576
-
-