Analysis
- max time kernel
299s - max time network
299s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
07/08/2026, 16:03
General
- Target Aкт cвepки взaимныx pacчeтoв за период три месяца.pdf.exe
- Size 1.6MB
- Sample260807-thrdbagp4z
- SHA256 cdc371e508dbd43ef2fe37bcc84889c2e11b13a29623f656d8274ca81fae61fa
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
- Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE 1 IoCs
- Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Aкт cвepки взaимныx pacчeтoв за период три месяца.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Aкт cвepки взaимныx pacчeтoв за период три месяца.pdf.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\users.exeC:\Users\Admin\AppData\Roaming\users.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
users.exe
memory/3284-1872-0x0000000004970000-0x0000000004971000-memory.dmp
memory/3284-1871-0x00000000049B0000-0x00000000049B1000-memory.dmp
memory/3284-1870-0x00000000049A0000-0x00000000049A1000-memory.dmp
memory/3284-1869-0x00000000049D0000-0x00000000049D1000-memory.dmp
memory/3284-3709-0x0000000074AF0000-0x00000000752AC000-memory.dmp
memory/3284-3708-0x0000000000400000-0x000000000072F000-memory.dmp
memory/3284-3707-0x0000000074AF0000-0x00000000752AC000-memory.dmp
memory/3284-1923-0x0000000074AF0000-0x00000000752AC000-memory.dmp
memory/3284-1878-0x0000000074AF0000-0x00000000752AC000-memory.dmp
memory/3284-1877-0x0000000074AF0000-0x00000000752AC000-memory.dmp
memory/3284-1874-0x0000000004990000-0x0000000004991000-memory.dmp
memory/3284-1875-0x0000000004980000-0x0000000004981000-memory.dmp
memory/3284-1876-0x0000000074B02000-0x0000000074B03000-memory.dmp
memory/3284-1873-0x00000000049C0000-0x00000000049C1000-memory.dmp
memory/4248-56-0x00000000070D0000-0x000000000713D000-memory.dmp
memory/4248-32-0x00000000070D0000-0x000000000713D000-memory.dmp
memory/4248-12-0x00000000070D0000-0x0000000007142000-memory.dmp
memory/4248-14-0x0000000074AF0000-0x00000000752AC000-memory.dmp
memory/4248-36-0x00000000070D0000-0x000000000713D000-memory.dmp
memory/4248-38-0x00000000070D0000-0x000000000713D000-memory.dmp
memory/4248-140-0x00000000070D0000-0x000000000713D000-memory.dmp
memory/4248-138-0x00000000070D0000-0x000000000713D000-memory.dmp
memory/4248-136-0x00000000070D0000-0x000000000713D000-memory.dmp
memory/4248-132-0x00000000070D0000-0x000000000713D000-memory.dmp
memory/4248-130-0x00000000070D0000-0x000000000713D000-memory.dmp
memory/4248-126-0x00000000070D0000-0x000000000713D000-memory.dmp
memory/4248-122-0x00000000070D0000-0x000000000713D000-memory.dmp
memory/4248-118-0x00000000070D0000-0x000000000713D000-memory.dmp
memory/4248-116-0x00000000070D0000-0x000000000713D000-memory.dmp
memory/4248-112-0x00000000070D0000-0x000000000713D000-memory.dmp
memory/4248-110-0x00000000070D0000-0x000000000713D000-memory.dmp
memory/4248-108-0x00000000070D0000-0x000000000713D000-memory.dmp
memory/4248-104-0x00000000070D0000-0x000000000713D000-memory.dmp
memory/4248-102-0x00000000070D0000-0x000000000713D000-memory.dmp
memory/4248-98-0x00000000070D0000-0x000000000713D000-memory.dmp
memory/4248-96-0x00000000070D0000-0x000000000713D000-memory.dmp
memory/4248-92-0x00000000070D0000-0x000000000713D000-memory.dmp
memory/4248-90-0x00000000070D0000-0x000000000713D000-memory.dmp
memory/4248-88-0x00000000070D0000-0x000000000713D000-memory.dmp
memory/4248-86-0x00000000070D0000-0x000000000713D000-memory.dmp
memory/4248-80-0x00000000070D0000-0x000000000713D000-memory.dmp
memory/4248-76-0x00000000070D0000-0x000000000713D000-memory.dmp
memory/4248-74-0x00000000070D0000-0x000000000713D000-memory.dmp
memory/4248-70-0x00000000070D0000-0x000000000713D000-memory.dmp
memory/4248-68-0x00000000070D0000-0x000000000713D000-memory.dmp
memory/4248-66-0x00000000070D0000-0x000000000713D000-memory.dmp
memory/4248-62-0x00000000070D0000-0x000000000713D000-memory.dmp
memory/4248-10-0x0000000074AF0000-0x00000000752AC000-memory.dmp
memory/4248-54-0x00000000070D0000-0x000000000713D000-memory.dmp
memory/4248-52-0x00000000070D0000-0x000000000713D000-memory.dmp
memory/4248-48-0x00000000070D0000-0x000000000713D000-memory.dmp
memory/4248-46-0x00000000070D0000-0x000000000713D000-memory.dmp
memory/4248-42-0x00000000070D0000-0x000000000713D000-memory.dmp
memory/4248-40-0x00000000070D0000-0x000000000713D000-memory.dmp
memory/4248-34-0x00000000070D0000-0x000000000713D000-memory.dmp
memory/4248-13-0x0000000074AF0000-0x00000000752AC000-memory.dmp
memory/4248-28-0x00000000070D0000-0x000000000713D000-memory.dmp
memory/4248-26-0x00000000070D0000-0x000000000713D000-memory.dmp
memory/4248-20-0x00000000070D0000-0x000000000713D000-memory.dmp
memory/4248-19-0x00000000070D0000-0x000000000713D000-memory.dmp
memory/4248-16-0x00000000070D0000-0x000000000713D000-memory.dmp
memory/4248-134-0x00000000070D0000-0x000000000713D000-memory.dmp
memory/4248-128-0x00000000070D0000-0x000000000713D000-memory.dmp
memory/4248-124-0x00000000070D0000-0x000000000713D000-memory.dmp
memory/4248-120-0x00000000070D0000-0x000000000713D000-memory.dmp
memory/4248-114-0x00000000070D0000-0x000000000713D000-memory.dmp
memory/4248-106-0x00000000070D0000-0x000000000713D000-memory.dmp
memory/4248-100-0x00000000070D0000-0x000000000713D000-memory.dmp
memory/4248-94-0x00000000070D0000-0x000000000713D000-memory.dmp
memory/4248-84-0x00000000070D0000-0x000000000713D000-memory.dmp
memory/4248-82-0x00000000070D0000-0x000000000713D000-memory.dmp
memory/4248-79-0x00000000070D0000-0x000000000713D000-memory.dmp
memory/4248-72-0x00000000070D0000-0x000000000713D000-memory.dmp
memory/4248-64-0x00000000070D0000-0x000000000713D000-memory.dmp
memory/4248-60-0x00000000070D0000-0x000000000713D000-memory.dmp
memory/4248-58-0x00000000070D0000-0x000000000713D000-memory.dmp
memory/4248-51-0x00000000070D0000-0x000000000713D000-memory.dmp
memory/4248-44-0x00000000070D0000-0x000000000713D000-memory.dmp
memory/4248-30-0x00000000070D0000-0x000000000713D000-memory.dmp
memory/4248-24-0x00000000070D0000-0x000000000713D000-memory.dmp
memory/4248-22-0x00000000070D0000-0x000000000713D000-memory.dmp
memory/4248-15-0x00000000070D0000-0x000000000713D000-memory.dmp
memory/4248-9-0x0000000007020000-0x0000000007094000-memory.dmp
memory/4248-8-0x0000000074B02000-0x0000000074B03000-memory.dmp
memory/4248-7-0x0000000004980000-0x0000000004981000-memory.dmp
memory/4248-6-0x0000000004990000-0x0000000004991000-memory.dmp
memory/4248-1-0x00000000049D0000-0x00000000049D1000-memory.dmp
memory/4248-2-0x00000000049A0000-0x00000000049A1000-memory.dmp
memory/4248-3-0x00000000049B0000-0x00000000049B1000-memory.dmp
memory/4248-4-0x00000000049C0000-0x00000000049C1000-memory.dmp
memory/4248-5-0x0000000004970000-0x0000000004971000-memory.dmp
memory/4248-0-0x0000000000400000-0x000000000072F000-memory.dmp
memory/4248-11-0x0000000007170000-0x000000000772A000-memory.dmp
memory/4248-1016-0x0000000000400000-0x000000000072F000-memory.dmp
memory/4248-1842-0x0000000007730000-0x00000000077CC000-memory.dmp
memory/4248-1843-0x0000000074AF0000-0x00000000752AC000-memory.dmp
memory/4248-1845-0x0000000074AF0000-0x00000000752AC000-memory.dmp