Analysis
- user interaction
yes - max time kernel
29s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260630-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/07/2026, 12:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
explorer.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
17 signatures
30 seconds
Behavioral task
behavioral2
Sample
explorer.exe
Resource
win11ltsc2024-20260630-en
windows11-ltsc_2024-x64
14 signatures
30 seconds
General
- Target explorer.exe
- Size 106KB
- Sample260701-p2zftaev8p
- SHA256 8badf4da3abaa696c0df3dc8e95b014fa6e487b9b00d31e41bef43a754c3725d
- MD5 d5e85159ca85d3901e297908a4b554ae
- SHA1 baf636f49b3e52bf4a19de0b73b382f3a6a1df29
- SHA512 e8e31f18eb027cfcc6dad1829b5000b08621926b22599c4c20b861fa8989c75bd7c27fd036abf31c32951a45f5c985ed61b63b09c5260093f8c38fefcfa541b6
- SSDEEP 1536:FVsIjZBqQ7RyjRwLPGCJcFJ9ijgbPanWoVUKfUwTIpMlw94sFw3h6c9wvVkCWSYb:FZgPwCxJ9QWoJrIKAw3hHavVk/SY9uE
- TLSH T102B3F1199FDD6135F9BD4B369AF92362C2B5E6834465CE5E088B038C0D32B845B42F2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions explorer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions explorer.exe - Looks for VMWare Tools registry key 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools explorer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools explorer.exe - Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorer.exe - Drops startup file 3 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.lnk explorer.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.lnk explorer.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.lnk explorer.exe - Executes dropped EXE 1 IoCs
pid Process 5652 explorer.exe - Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 explorer.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 2 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S explorer.exe - Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation explorer.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1900 schtasks.exe - Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 2628 wmic.exe 2628 wmic.exe 2628 wmic.exe 2628 wmic.exe 4232 explorer.exe 4232 explorer.exe 5580 wmic.exe 5580 wmic.exe 5580 wmic.exe 5580 wmic.exe 5652 explorer.exe 5652 explorer.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2628 wmic.exe Token: SeSecurityPrivilege 2628 wmic.exe Token: SeTakeOwnershipPrivilege 2628 wmic.exe Token: SeLoadDriverPrivilege 2628 wmic.exe Token: SeSystemProfilePrivilege 2628 wmic.exe Token: SeSystemtimePrivilege 2628 wmic.exe Token: SeProfSingleProcessPrivilege 2628 wmic.exe Token: SeIncBasePriorityPrivilege 2628 wmic.exe Token: SeCreatePagefilePrivilege 2628 wmic.exe Token: SeBackupPrivilege 2628 wmic.exe Token: SeRestorePrivilege 2628 wmic.exe Token: SeShutdownPrivilege 2628 wmic.exe Token: SeDebugPrivilege 2628 wmic.exe Token: SeSystemEnvironmentPrivilege 2628 wmic.exe Token: SeRemoteShutdownPrivilege 2628 wmic.exe Token: SeUndockPrivilege 2628 wmic.exe Token: SeManageVolumePrivilege 2628 wmic.exe Token: 33 2628 wmic.exe Token: 34 2628 wmic.exe Token: 35 2628 wmic.exe Token: 36 2628 wmic.exe Token: SeIncreaseQuotaPrivilege 2628 wmic.exe Token: SeSecurityPrivilege 2628 wmic.exe Token: SeTakeOwnershipPrivilege 2628 wmic.exe Token: SeLoadDriverPrivilege 2628 wmic.exe Token: SeSystemProfilePrivilege 2628 wmic.exe Token: SeSystemtimePrivilege 2628 wmic.exe Token: SeProfSingleProcessPrivilege 2628 wmic.exe Token: SeIncBasePriorityPrivilege 2628 wmic.exe Token: SeCreatePagefilePrivilege 2628 wmic.exe Token: SeBackupPrivilege 2628 wmic.exe Token: SeRestorePrivilege 2628 wmic.exe Token: SeShutdownPrivilege 2628 wmic.exe Token: SeDebugPrivilege 2628 wmic.exe Token: SeSystemEnvironmentPrivilege 2628 wmic.exe Token: SeRemoteShutdownPrivilege 2628 wmic.exe Token: SeUndockPrivilege 2628 wmic.exe Token: SeManageVolumePrivilege 2628 wmic.exe Token: 33 2628 wmic.exe Token: 34 2628 wmic.exe Token: 35 2628 wmic.exe Token: 36 2628 wmic.exe Token: SeDebugPrivilege 4232 explorer.exe Token: SeIncreaseQuotaPrivilege 5580 wmic.exe Token: SeSecurityPrivilege 5580 wmic.exe Token: SeTakeOwnershipPrivilege 5580 wmic.exe Token: SeLoadDriverPrivilege 5580 wmic.exe Token: SeSystemProfilePrivilege 5580 wmic.exe Token: SeSystemtimePrivilege 5580 wmic.exe Token: SeProfSingleProcessPrivilege 5580 wmic.exe Token: SeIncBasePriorityPrivilege 5580 wmic.exe Token: SeCreatePagefilePrivilege 5580 wmic.exe Token: SeBackupPrivilege 5580 wmic.exe Token: SeRestorePrivilege 5580 wmic.exe Token: SeShutdownPrivilege 5580 wmic.exe Token: SeDebugPrivilege 5580 wmic.exe Token: SeSystemEnvironmentPrivilege 5580 wmic.exe Token: SeRemoteShutdownPrivilege 5580 wmic.exe Token: SeUndockPrivilege 5580 wmic.exe Token: SeManageVolumePrivilege 5580 wmic.exe Token: 33 5580 wmic.exe Token: 34 5580 wmic.exe Token: 35 5580 wmic.exe Token: 36 5580 wmic.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4232 wrote to memory of 2628 4232 explorer.exe 88 PID 4232 wrote to memory of 5428 4232 explorer.exe 91 PID 4232 wrote to memory of 1900 4232 explorer.exe 93 PID 5652 wrote to memory of 5580 5652 explorer.exe 97 PID 5652 wrote to memory of 5124 5652 explorer.exe 99 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\explorer.exe"C:\Users\Admin\AppData\Local\Temp\explorer.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Drops startup file
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2628
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /Query /TN "explorer"2⤵PID:5428
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /f /tn "explorer" /tr "C:\Users\Public\explorer.exe" /sc onlogon /rl highest2⤵
- Scheduled Task/Job: Scheduled Task
PID:1900
-
-
C:\Users\Public\explorer.exeC:\Users\Public\explorer.exe1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Drops startup file
- Executes dropped EXE
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5652 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5580
-
-
C:\Windows\System32\schtasks.exe"schtasks" /Query /TN "explorer"2⤵PID:5124
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.lnk
- Size 1KB
- SHA256 bb76255480e48704fdaf6ce91c0273b086bac575c19cbe05c4c4e3f01bb5eee6
- MD5 ace5a19cd85cbaacfded92179b06c086
- SHA1 7467980b2f2ffbbbde04318da6a6a1796bf1c261
- SHA512 f5c5d3be7fceb210755273c1cd805eb06465b9f10427ef8b8b51a96b234d489192e44f21fff315d22e1af7049ac49d27aace5e670f18acf5bce635d78478ea10
- TLSH T153114C1C07C32F12C350D177B8B613A6EA3B7942FFD91F1E5AD54748486A285AC15D3B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Public\explorer.exe
- Size 106KB
- SHA256 8badf4da3abaa696c0df3dc8e95b014fa6e487b9b00d31e41bef43a754c3725d
- MD5 d5e85159ca85d3901e297908a4b554ae
- SHA1 baf636f49b3e52bf4a19de0b73b382f3a6a1df29
- SHA512 e8e31f18eb027cfcc6dad1829b5000b08621926b22599c4c20b861fa8989c75bd7c27fd036abf31c32951a45f5c985ed61b63b09c5260093f8c38fefcfa541b6
- SSDEEP 1536:FVsIjZBqQ7RyjRwLPGCJcFJ9ijgbPanWoVUKfUwTIpMlw94sFw3h6c9wvVkCWSYb:FZgPwCxJ9QWoJrIKAw3hHavVk/SY9uE
- TLSH T102B3F1199FDD6135F9BD4B369AF92362C2B5E6834465CE5E088B038C0D32B845B42F2B
- MD5 SHA1 SHA512 SSDEEP TLSH