450461e6a85fa293753e11b7fd6ca462543a11fbaff7b6953aee48f0458bdf82

Analysis

max time kernel
0s
max time network
30s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/05/2026, 21:35

Target
AntiAnalysis.exe
Size 42KB
Sample260527-1frdvsct9t
SHA256 450461e6a85fa293753e11b7fd6ca462543a11fbaff7b6953aee48f0458bdf82
MD5 e1d6e74ec781e020e73b105a0fe567d9
SHA1 19e541b4908786d8a8b29c7caec2c044e653fa7a
SHA512 bc7007aa01fea619407efa67fab0c858ec4a5e53e1431871e34eda0743c30369477887e0911c32eb1fa4c94b72052e4ba8e54761ed7683a3d9f723c6c9cefbeb
SSDEEP 768:AmW1WCZT9WrQSUPZ9jfRhd3HXwZcfNo5F2mzDvBm2lQZnGcrWmdH:AmkWCWE9PZ9jfRhd3HXlkh3v5iZfdH
TLSH
T1AD133144B3FA4504F1BFEB75ADF142898D7AB89E6A32C42E1C82516E0972B90CD50F37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__	AntiAnalysis.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	AntiAnalysis.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	AntiAnalysis.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	AntiAnalysis.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions	AntiAnalysis.exe

Looks for VMWare Tools registry key 2 TTPs 2 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	AntiAnalysis.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	AntiAnalysis.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

Disable or Modify System Firewall

pid	Process
956	netsh.exe
1632	netsh.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4508	AntiAnalysis.exe

C:\Users\Admin\AppData\Local\Temp\AntiAnalysis.exe
"C:\Users\Admin\AppData\Local\Temp\AntiAnalysis.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4508
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" advfirewall set allprofiles state on
  2⤵
  - Modifies Windows Firewall
  PID:956
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" advfirewall set allprofiles firewallpolicy blockinbound,blockoutbound
  2⤵
  - Modifies Windows Firewall
  PID:1632