fab2606daa20873dcf164322cc44d0edfa154fc273cadb091cca61bcb2cbe060

Analysis

max time kernel
150s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 02:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d2qfddfg.exe
Size 9.0MB
Sample260712-dbe4pset8z
SHA256 fab2606daa20873dcf164322cc44d0edfa154fc273cadb091cca61bcb2cbe060
MD5 cc1f35c230c3431d0a92a283fa689829
SHA1 28728008c380a2ea88cdecb202caec9969a0f673
SHA512 ce93d19ffe5ce3c35c9732845e91ec71da63a0f3140522ca9f8b4bf00ebf50d33f71c15531ab37aa4791bd3745c7e82741c3fa0228be1a74f318ab333d7c4cf4
SSDEEP 98304:MDDi9G38/377hmP3DjikaXCHJVO4yQNgCHTn+kq54IQVX:VQ3+vk8ypYTQNdT101QVX
TLSH
T107969C43F29680E8C49EC5B4C35AA637FB32B8890935B2DB5BD45B112F76B909F4D348
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 5 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	d2qfddfg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	d2qfddfg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService	d2qfddfg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	d2qfddfg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo	d2qfddfg.exe

Looks for VMWare services registry key. 1 TTPs 4 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	d2qfddfg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmmemctl	d2qfddfg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmmouse	d2qfddfg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmtools	d2qfddfg.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3416	d2qfddfg.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3416	d2qfddfg.exe

C:\Users\Admin\AppData\Local\Temp\d2qfddfg.exe
"C:\Users\Admin\AppData\Local\Temp\d2qfddfg.exe"
1⤵
- Enumerates VirtualBox registry keys
- Looks for VMWare services registry key.
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of FindShellTrayWindow
PID:3416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads