Analysis
- geolocation tags
- max time kernel
61s - max time network
63s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
04/07/2026, 08:40
General
- Target New Patch 2.exe
- Size 75.5MB
- Sample260704-kkyezadt21
- SHA256 7365b4a24edff1e1d3f78243615d3c2b8592343134a9126c307d11a9e9e1582f
Malware Config
Signatures
- Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 38 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\New Patch 2.exe"C:\Users\Admin\AppData\Local\Temp\New Patch 2.exe"1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3672-7-0x0000022A01490000-0x0000022A02120000-memory.dmp
memory/3672-23-0x0000022A000F0000-0x0000022A00110000-memory.dmp
memory/3672-19-0x0000022A00090000-0x0000022A000B0000-memory.dmp
memory/3672-27-0x0000022A00140000-0x0000022A00160000-memory.dmp
memory/3672-15-0x0000022A04190000-0x0000022A04470000-memory.dmp
memory/3672-31-0x0000022A02120000-0x0000022A022A0000-memory.dmp
memory/3672-11-0x0000022A034A0000-0x0000022A04190000-memory.dmp
memory/3672-39-0x0000022A022A0000-0x0000022A022F0000-memory.dmp
memory/3672-35-0x0000022A04960000-0x0000022A04B60000-memory.dmp
memory/3672-43-0x0000022A02770000-0x0000022A02790000-memory.dmp
memory/3672-59-0x0000022A04FB0000-0x0000022A04FF0000-memory.dmp
memory/3672-67-0x0000022A04E50000-0x0000022A04E70000-memory.dmp
memory/3672-63-0x0000022A04E30000-0x0000022A04E50000-memory.dmp
memory/3672-55-0x0000022A046C0000-0x0000022A046F0000-memory.dmp
memory/3672-51-0x0000022A04CD0000-0x0000022A04D60000-memory.dmp
memory/3672-47-0x0000022A04C80000-0x0000022A04CD0000-memory.dmp
memory/3672-73-0x0000022A071A0000-0x0000022A071D0000-memory.dmp
memory/3672-77-0x0000022A04F10000-0x0000022A04F20000-memory.dmp
memory/3672-81-0x0000022A072A0000-0x0000022A072C0000-memory.dmp
memory/3672-85-0x0000022A09560000-0x0000022A09620000-memory.dmp
memory/3672-89-0x0000022A07270000-0x0000022A07280000-memory.dmp
memory/3672-93-0x0000022A0C370000-0x0000022A0C3C0000-memory.dmp
memory/3672-97-0x0000022A0C2F0000-0x0000022A0C310000-memory.dmp
memory/3672-110-0x0000022A0D880000-0x0000022A0D980000-memory.dmp
memory/3672-101-0x0000022A0CD90000-0x0000022A0CF00000-memory.dmp
memory/3672-106-0x0000022A0C5B0000-0x0000022A0C5E0000-memory.dmp
memory/3672-113-0x0000022A17380000-0x0000022A173C0000-memory.dmp
memory/3672-121-0x0000022A17410000-0x0000022A17430000-memory.dmp
memory/3672-117-0x0000022A0D750000-0x0000022A0D780000-memory.dmp