9831d31c91d02b891968ae20e9d19cf2045609fbaa9c33046334f27d15b419d8

Analysis

max time kernel
148s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 21:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9831d31c91d02b891968ae20e9d19cf2045609fbaa9c33046334f27d15b419d8.exe
Size 109KB
Sample260804-1pasgaep7y
SHA256 9831d31c91d02b891968ae20e9d19cf2045609fbaa9c33046334f27d15b419d8
MD5 3a412bd0ca413552600be80ddba7a1b0
SHA1 2a16e17a4c51946a7657bec068137666612f001a
SHA512 435b70b904dc8a9c3e2e53edac5cafefb5ffa06b93312622fcbd0e9b7b632da48ee49b6c7ca5c12ad82d7366de4cb5ad3f6ec6051a27df34c7a291e5e38364f3
SSDEEP 3072:cAwUiGu19xUot+Cuvu1hFnmNMS4aJIIAfWclAwV:cAwr1/t+CuvuRme4qfWcWw
TLSH
T1DCB31A369A1510ADCAE6C5B8D9D7080EDB7ABC4647717BCF03825CB60E166D4BF3EA01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	9831d31c91d02b891968ae20e9d19cf2045609fbaa9c33046334f27d15b419d8.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__	9831d31c91d02b891968ae20e9d19cf2045609fbaa9c33046334f27d15b419d8.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	9831d31c91d02b891968ae20e9d19cf2045609fbaa9c33046334f27d15b419d8.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	9831d31c91d02b891968ae20e9d19cf2045609fbaa9c33046334f27d15b419d8.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	9831d31c91d02b891968ae20e9d19cf2045609fbaa9c33046334f27d15b419d8.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1188	9831d31c91d02b891968ae20e9d19cf2045609fbaa9c33046334f27d15b419d8.exe
1188	9831d31c91d02b891968ae20e9d19cf2045609fbaa9c33046334f27d15b419d8.exe

C:\Users\Admin\AppData\Local\Temp\9831d31c91d02b891968ae20e9d19cf2045609fbaa9c33046334f27d15b419d8.exe
"C:\Users\Admin\AppData\Local\Temp\9831d31c91d02b891968ae20e9d19cf2045609fbaa9c33046334f27d15b419d8.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Suspicious behavior: EnumeratesProcesses
PID:1188

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads