Analysis
- user interaction
yes - max time kernel
56s - max time network
22s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
14/07/2026, 11:08
General
- Target tf6i95rf.exe
- Size 213KB
- Sample260714-m8zztabs8m
- SHA256 d39f072dbc9cce3bac5aa3f7e9ed4e07e9ba589e18afc47e4f5de2c39e4e23dc
Malware Config
Signatures
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tf6i95rf.exe"C:\Users\Admin\AppData\Local\Temp\tf6i95rf.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ByDRX1.py
memory/4132-0-0x00007FFB7947F000-0x00007FFB79480000-memory.dmp
memory/4132-1-0x0000000000820000-0x0000000000860000-memory.dmp
memory/4132-2-0x0000000000FC0000-0x0000000000FCA000-memory.dmp
memory/4132-3-0x00007FFB792F0000-0x00007FFB79C94000-memory.dmp
memory/4132-4-0x00007FFB792F0000-0x00007FFB79C94000-memory.dmp
memory/4132-5-0x00007FFB792F0000-0x00007FFB79C94000-memory.dmp
memory/4132-11-0x00007FFB792F0000-0x00007FFB79C94000-memory.dmp
memory/4132-12-0x00007FFB792F0000-0x00007FFB79C94000-memory.dmp
memory/4132-13-0x00007FFB792F0000-0x00007FFB79C94000-memory.dmp
memory/4132-14-0x00007FFB792F0000-0x00007FFB79C94000-memory.dmp