03af32fecefd4d57086f68e0b55b8ef76ee6f9c5908ee603d1576a07bf3cbe8d

Analysis

user interaction
yes
max time kernel
4s
max time network
5s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 18:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
antivm_test.exe
Size 144KB
Sample260718-xewemsat4m
SHA256 03af32fecefd4d57086f68e0b55b8ef76ee6f9c5908ee603d1576a07bf3cbe8d
MD5 d9416bc6bffa954614a5c369ba952b52
SHA1 ad479f711f1ee18601914af0a5a8320bc4bcac06
SHA512 15524812a9ff79c2bed69ace05d5aaa05b414dc2306db8d7cae00f4de06f98999d04e232338b9fb026f594ae0549fea6a2192a655bec24733ca071912b1c093b
SSDEEP 3072:Cibz2XQMrPSPkoU0NGhS/068iOtP+dGpigh:LGXQMrzJOl/068iON4
TLSH
T1C1E34B17B3E530F9E1B7823989610616EB7378314B609BEF07A453766F236D09D3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	antivm_test.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	antivm_test.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__	antivm_test.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	antivm_test.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	antivm_test.exe

Checks SCSI registry key(s) 3 TTPs 2 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	antivm_test.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	antivm_test.exe

C:\Users\Admin\AppData\Local\Temp\antivm_test.exe
"C:\Users\Admin\AppData\Local\Temp\antivm_test.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks SCSI registry key(s)
PID:3204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads