450461e6a85fa293753e11b7fd6ca462543a11fbaff7b6953aee48f0458bdf82

Analysis

max time kernel
2s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/05/2026, 21:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AntiAnalysis.exe
Size 42KB
Sample260527-1frdvsct9t
SHA256 450461e6a85fa293753e11b7fd6ca462543a11fbaff7b6953aee48f0458bdf82
MD5 e1d6e74ec781e020e73b105a0fe567d9
SHA1 19e541b4908786d8a8b29c7caec2c044e653fa7a
SHA512 bc7007aa01fea619407efa67fab0c858ec4a5e53e1431871e34eda0743c30369477887e0911c32eb1fa4c94b72052e4ba8e54761ed7683a3d9f723c6c9cefbeb
SSDEEP 768:AmW1WCZT9WrQSUPZ9jfRhd3HXwZcfNo5F2mzDvBm2lQZnGcrWmdH:AmkWCWE9PZ9jfRhd3HXlkh3v5iZfdH
TLSH
T1AD133144B3FA4504F1BFEB75ADF142898D7AB89E6A32C42E1C82516E0972B90CD50F37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion persistence privilege_escalation

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	AntiAnalysis.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	AntiAnalysis.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__	AntiAnalysis.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	AntiAnalysis.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions	AntiAnalysis.exe

Looks for VMWare Tools registry key 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	AntiAnalysis.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	AntiAnalysis.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3364	netsh.exe
1832	netsh.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4456	AntiAnalysis.exe
4456	AntiAnalysis.exe
4456	AntiAnalysis.exe
4456	AntiAnalysis.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4456	AntiAnalysis.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4456 wrote to memory of 3364	4456	AntiAnalysis.exe	82
PID 4456 wrote to memory of 1832	4456	AntiAnalysis.exe	84

C:\Users\Admin\AppData\Local\Temp\AntiAnalysis.exe
"C:\Users\Admin\AppData\Local\Temp\AntiAnalysis.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" advfirewall set allprofiles state on
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:3364
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" advfirewall set allprofiles firewallpolicy blockinbound,blockoutbound
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:1832