3449386d9faf8434b11c1feb8eab513fe55b9de51196d7fd01f9a9716650ea28

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 00:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PREMs_UHQ.exe
Size 7.2MB
Sample260708-a7mlwagy3v
SHA256 3449386d9faf8434b11c1feb8eab513fe55b9de51196d7fd01f9a9716650ea28
MD5 a385a0d2acd8b6523dade4d984a2043e
SHA1 d1f8acce19239f50a12a4791c260f949caf0f2db
SHA512 92663c3efe4129ef01cf58a73d74d663f536bd4a009112dcff52360bf055451b68393649f791268b45f635aedc6d70986586463eedcc099ff5d98f7b0ffe847f
SSDEEP 49152:qniXwA8sS36m0xErTn6WovUuwwh2lvDz62lOjbc5q1JNLR5EcboidBTwAsdUySKu:qnpFvHB0qs/xDDEri3ylbZFE
TLSH
T148763907FCA518E8C0ADD1358AA69213BB617C990B3123E72B90F6243F77BD06DB9754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 3 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	PREMs_UHQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	PREMs_UHQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	PREMs_UHQ.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	PREMs_UHQ.exe
Key opened	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\HARDWARE\ACPI\DSDT\VBOX__	PREMs_UHQ.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	PREMs_UHQ.exe
Key opened	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\HARDWARE\ACPI\FADT\VBOX__	PREMs_UHQ.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\SOFTWARE\Oracle\VirtualBox Guest Additions	PREMs_UHQ.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	PREMs_UHQ.exe

Looks for VMWare Tools registry key 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	PREMs_UHQ.exe
Key opened	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\SOFTWARE\VMware, Inc.\VMware Tools	PREMs_UHQ.exe

Looks for VMWare services registry key. 1 TTPs 3 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmmouse	PREMs_UHQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMTools	PREMs_UHQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	PREMs_UHQ.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	PREMs_UHQ.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemBiosVersion	PREMs_UHQ.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	PREMs_UHQ.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	PREMs_UHQ.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer	PREMs_UHQ.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	PREMs_UHQ.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName	PREMs_UHQ.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor	PREMs_UHQ.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOSVendor	PREMs_UHQ.exe

C:\Users\Admin\AppData\Local\Temp\PREMs_UHQ.exe
"C:\Users\Admin\AppData\Local\Temp\PREMs_UHQ.exe"
1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Checks BIOS information in registry
- Enumerates system info in registry
PID:2772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads