Analysis
- user interaction
yes - max time kernel
86s - max time network
86s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
- submitted
05/08/2026, 09:03
General
- Target Aкт cвepки взaимныx pacчeтoв за период три месяца.pdf.exe
- Size 1.6MB
- Sample260805-k1cs7stdmg
- SHA256 cdc371e508dbd43ef2fe37bcc84889c2e11b13a29623f656d8274ca81fae61fa
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Aкт cвepки взaимныx pacчeтoв за период три месяца.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Aкт cвepки взaимныx pacчeтoв за период три месяца.pdf.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1484-0-0x0000000000400000-0x000000000072F000-memory.dmp
memory/1484-4-0x0000000004880000-0x0000000004881000-memory.dmp
memory/1484-3-0x0000000004870000-0x0000000004871000-memory.dmp
memory/1484-2-0x0000000004860000-0x0000000004861000-memory.dmp
memory/1484-1-0x00000000048A0000-0x00000000048A2000-memory.dmp
memory/1484-6-0x0000000004890000-0x0000000004891000-memory.dmp
memory/1484-5-0x0000000004830000-0x0000000004831000-memory.dmp
memory/1484-8-0x0000000004840000-0x0000000004841000-memory.dmp
memory/1484-7-0x0000000004850000-0x0000000004851000-memory.dmp
memory/1484-9-0x0000000007020000-0x0000000007030000-memory.dmp
memory/1484-10-0x0000000006F10000-0x0000000006F84000-memory.dmp
memory/1484-11-0x0000000007020000-0x0000000007030000-memory.dmp
memory/1484-12-0x0000000007030000-0x00000000075D6000-memory.dmp
memory/1484-13-0x0000000006F80000-0x0000000006FF2000-memory.dmp
memory/1484-15-0x0000000006F80000-0x0000000006FED000-memory.dmp
memory/1484-25-0x0000000006F80000-0x0000000006FED000-memory.dmp
memory/1484-111-0x0000000006F80000-0x0000000006FED000-memory.dmp
memory/1484-115-0x0000000006F80000-0x0000000006FED000-memory.dmp
memory/1484-113-0x0000000006F80000-0x0000000006FED000-memory.dmp
memory/1484-109-0x0000000006F80000-0x0000000006FED000-memory.dmp
memory/1484-107-0x0000000006F80000-0x0000000006FED000-memory.dmp
memory/1484-105-0x0000000006F80000-0x0000000006FED000-memory.dmp
memory/1484-103-0x0000000006F80000-0x0000000006FED000-memory.dmp
memory/1484-101-0x0000000006F80000-0x0000000006FED000-memory.dmp
memory/1484-99-0x0000000006F80000-0x0000000006FED000-memory.dmp
memory/1484-97-0x0000000006F80000-0x0000000006FED000-memory.dmp
memory/1484-95-0x0000000006F80000-0x0000000006FED000-memory.dmp
memory/1484-93-0x0000000006F80000-0x0000000006FED000-memory.dmp
memory/1484-91-0x0000000006F80000-0x0000000006FED000-memory.dmp
memory/1484-89-0x0000000006F80000-0x0000000006FED000-memory.dmp
memory/1484-87-0x0000000006F80000-0x0000000006FED000-memory.dmp
memory/1484-85-0x0000000006F80000-0x0000000006FED000-memory.dmp
memory/1484-81-0x0000000006F80000-0x0000000006FED000-memory.dmp
memory/1484-80-0x0000000006F80000-0x0000000006FED000-memory.dmp
memory/1484-77-0x0000000006F80000-0x0000000006FED000-memory.dmp
memory/1484-123-0x0000000006F80000-0x0000000006FED000-memory.dmp
memory/1484-139-0x0000000006F80000-0x0000000006FED000-memory.dmp
memory/1484-137-0x0000000006F80000-0x0000000006FED000-memory.dmp
memory/1484-135-0x0000000006F80000-0x0000000006FED000-memory.dmp
memory/1484-133-0x0000000006F80000-0x0000000006FED000-memory.dmp
memory/1484-131-0x0000000006F80000-0x0000000006FED000-memory.dmp
memory/1484-127-0x0000000006F80000-0x0000000006FED000-memory.dmp
memory/1484-125-0x0000000006F80000-0x0000000006FED000-memory.dmp
memory/1484-121-0x0000000006F80000-0x0000000006FED000-memory.dmp
memory/1484-119-0x0000000006F80000-0x0000000006FED000-memory.dmp
memory/1484-117-0x0000000006F80000-0x0000000006FED000-memory.dmp
memory/1484-129-0x0000000006F80000-0x0000000006FED000-memory.dmp
memory/1484-75-0x0000000006F80000-0x0000000006FED000-memory.dmp
memory/1484-73-0x0000000006F80000-0x0000000006FED000-memory.dmp
memory/1484-71-0x0000000006F80000-0x0000000006FED000-memory.dmp
memory/1484-69-0x0000000006F80000-0x0000000006FED000-memory.dmp
memory/1484-67-0x0000000006F80000-0x0000000006FED000-memory.dmp
memory/1484-65-0x0000000006F80000-0x0000000006FED000-memory.dmp
memory/1484-63-0x0000000006F80000-0x0000000006FED000-memory.dmp
memory/1484-61-0x0000000006F80000-0x0000000006FED000-memory.dmp
memory/1484-59-0x0000000006F80000-0x0000000006FED000-memory.dmp
memory/1484-57-0x0000000006F80000-0x0000000006FED000-memory.dmp
memory/1484-55-0x0000000006F80000-0x0000000006FED000-memory.dmp
memory/1484-53-0x0000000006F80000-0x0000000006FED000-memory.dmp
memory/1484-49-0x0000000006F80000-0x0000000006FED000-memory.dmp
memory/1484-47-0x0000000006F80000-0x0000000006FED000-memory.dmp
memory/1484-46-0x0000000006F80000-0x0000000006FED000-memory.dmp
memory/1484-43-0x0000000006F80000-0x0000000006FED000-memory.dmp
memory/1484-41-0x0000000006F80000-0x0000000006FED000-memory.dmp
memory/1484-39-0x0000000006F80000-0x0000000006FED000-memory.dmp
memory/1484-37-0x0000000006F80000-0x0000000006FED000-memory.dmp
memory/1484-35-0x0000000006F80000-0x0000000006FED000-memory.dmp
memory/1484-33-0x0000000006F80000-0x0000000006FED000-memory.dmp
memory/1484-31-0x0000000006F80000-0x0000000006FED000-memory.dmp
memory/1484-29-0x0000000006F80000-0x0000000006FED000-memory.dmp
memory/1484-27-0x0000000006F80000-0x0000000006FED000-memory.dmp
memory/1484-23-0x0000000006F80000-0x0000000006FED000-memory.dmp
memory/1484-21-0x0000000006F80000-0x0000000006FED000-memory.dmp
memory/1484-19-0x0000000006F80000-0x0000000006FED000-memory.dmp
memory/1484-17-0x0000000006F80000-0x0000000006FED000-memory.dmp
memory/1484-83-0x0000000006F80000-0x0000000006FED000-memory.dmp
memory/1484-51-0x0000000006F80000-0x0000000006FED000-memory.dmp
memory/1484-14-0x0000000006F80000-0x0000000006FED000-memory.dmp
memory/1484-1594-0x0000000000400000-0x000000000072F000-memory.dmp
memory/1484-1841-0x00000000075E0000-0x000000000767C000-memory.dmp
memory/1484-1842-0x0000000007020000-0x0000000007030000-memory.dmp
memory/1484-1844-0x0000000007020000-0x0000000007030000-memory.dmp
memory/1484-1845-0x0000000007020000-0x0000000007030000-memory.dmp
memory/1484-1846-0x0000000007020000-0x0000000007030000-memory.dmp
memory/1484-1847-0x0000000007020000-0x0000000007030000-memory.dmp