7091809fc5783b4344e1dea5f8d7564579de10cc8ac9defc4dd322460d03fac9

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 09:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7091809fc5783b4344e1dea5f8d7564579de10cc8ac9defc4dd322460d03fac9.exe
Size 346KB
Sample260804-lprzesha25
SHA256 7091809fc5783b4344e1dea5f8d7564579de10cc8ac9defc4dd322460d03fac9
MD5 3c845ccb1775cec28d913bfde5df6260
SHA1 585ced72c344b06ddcb296ac71257452831d24c4
SHA512 6d638c0d88a6647df56279d707471b28e950ae3e226230e234c830e1152343dd33335815f2395c25f77666fe0626cb26a3588e5cf6d246478f494a4ec82211ca
SSDEEP 6144:YWYQ/tE6JVC1NCnN9tYz1lgdZ4plrcu2d/S/LfdkVD/2tvNJYPT2Y:YWX5GplgdZ4jrpy0LfdkFutv3
TLSH
T144743C15E7DA0559E027E67E8267D237F6337AC9635062DF82B4CA6C2B03D62327DE40
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion

Malware Config

Signatures

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	7091809fc5783b4344e1dea5f8d7564579de10cc8ac9defc4dd322460d03fac9.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	7091809fc5783b4344e1dea5f8d7564579de10cc8ac9defc4dd322460d03fac9.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4808	7091809fc5783b4344e1dea5f8d7564579de10cc8ac9defc4dd322460d03fac9.exe
4808	7091809fc5783b4344e1dea5f8d7564579de10cc8ac9defc4dd322460d03fac9.exe

C:\Users\Admin\AppData\Local\Temp\7091809fc5783b4344e1dea5f8d7564579de10cc8ac9defc4dd322460d03fac9.exe
"C:\Users\Admin\AppData\Local\Temp\7091809fc5783b4344e1dea5f8d7564579de10cc8ac9defc4dd322460d03fac9.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Suspicious behavior: EnumeratesProcesses
PID:4808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads