Analysis
- max time kernel
149s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
- submitted
24/06/2026, 12:35
General
- Target kgT8Dky0mPkNVekVZD0V6o7Rw0HZF2c.exe
- Size 3.7MB
- Sample260624-pscwfsb161
- SHA256 722eb92ee0f6f341ea6d713c812f3a4c4986314d111533c8d1419a9807854062
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
- Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE 2 IoCs
- Themida packer 11 IoCs
Detects Themida, an advanced Windows software protection system.
- Checks whether UAC is enabled 1 TTPs 3 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of WriteProcessMemory 1 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\kgT8Dky0mPkNVekVZD0V6o7Rw0HZF2c.exe"C:\Users\Admin\AppData\Local\Temp\kgT8Dky0mPkNVekVZD0V6o7Rw0HZF2c.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "Microsoftregid.1991-06.com.microsoft.exe" /tr "C:\ProgramData\OneDriveregid.1991-06.com.microsoft\Microsoftregid.1991-06.com.microsoft.exe" /sc MINUTE2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\ProgramData\OneDriveregid.1991-06.com.microsoft\Microsoftregid.1991-06.com.microsoft.exeC:\ProgramData\OneDriveregid.1991-06.com.microsoft\Microsoftregid.1991-06.com.microsoft.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\ProgramData\OneDriveregid.1991-06.com.microsoft\Microsoftregid.1991-06.com.microsoft.exe"C:\ProgramData\OneDriveregid.1991-06.com.microsoft\Microsoftregid.1991-06.com.microsoft.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Microsoftregid.1991-06.com.microsoft.exe
memory/1052-15-0x0000000140000000-0x00000001409B3000-memory.dmp
memory/1052-16-0x0000000140000000-0x00000001409B3000-memory.dmp
memory/1052-18-0x0000000140000000-0x00000001409B3000-memory.dmp
memory/1312-0-0x0000000140000000-0x00000001409B3000-memory.dmp
memory/1312-1-0x0000000140000000-0x00000001409B3000-memory.dmp
memory/1312-2-0x0000000140000000-0x00000001409B3000-memory.dmp
memory/1312-5-0x0000000140000000-0x00000001409B3000-memory.dmp
memory/5804-9-0x0000000140000000-0x00000001409B3000-memory.dmp
memory/5804-8-0x0000000140000000-0x00000001409B3000-memory.dmp
memory/5804-10-0x0000000140000000-0x00000001409B3000-memory.dmp