Analysis
- max time kernel
148s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 03:37
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
General
- Target 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe
- Size 901KB
- Sample260808-d6f99aswe1
- SHA256 475157277e1af39d9fd28b3c55670ab0a68be03e33fd5961ab191186e7df6ffa
- MD5 4fa4a356d79f238d0533b541117c32ff
- SHA1 c134364162f0514f9cbf3107d764b853832dad72
- SHA512 3babf1aa45c07ba09d7b1ab3fd44ba3e3f35b5d98bb8a09acd860bf73f63d72c7cfe26b611f89e5f080f0232594ddd5b282d708bfc1bc28d4c6a8aa5c2891bba
- SSDEEP 12288:zccC6LvF+TQgqt5BXki1IcSusaRA2l9LwEssqnmrsHhC9IqLYomFsuoPEn0:zc/6Lv4cNP1uusaRX9c1sWC3Yom+ub
- TLSH T178157C47BAD991BCD15AC078C35B9633BA73B88A02317DBF03E496302E69E512F1D719
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables referencing combination of virtualization drivers 1 IoCs
resource yara_rule behavioral2/memory/4108-0-0x00007FF683270000-0x00007FF683358000-memory.dmp INDICATOR_SUSPICIOUS_VM_Evasion_VirtDrvComb - Detects ransomware indicator 1 IoCs
resource yara_rule behavioral2/memory/4108-0-0x00007FF683270000-0x00007FF683358000-memory.dmp SUSP_RANSOMWARE_Indicator_Jul20 - Enumerates VirtualBox DLL files 2 TTPs 10 IoCs
description ioc Process File opened (read-only) C:\Windows\system32\vboxoglcrutil.dll 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe File opened (read-only) C:\Windows\system32\vboxoglerrorspu.dll 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe File opened (read-only) C:\Windows\system32\vboxoglpackspu.dll 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe File opened (read-only) C:\Windows\system32\vboxoglpassthroughspu.dll 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe File opened (read-only) C:\Windows\system32\vboxoglarrayspu.dll 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe File opened (read-only) C:\Windows\system32\vboxoglfeedbackspu.dll 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe File opened (read-only) C:\Windows\system32\vboxdisp.dll 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe File opened (read-only) C:\Windows\system32\vboxhook.dll 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe File opened (read-only) C:\Windows\system32\vboxmrxnp.dll 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe File opened (read-only) C:\Windows\system32\vboxogl.dll 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe - Enumerates VirtualBox registry keys 2 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse reg.exe - Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__ reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__ reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ reg.exe - Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions reg.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions reg.exe - Looks for VirtualBox drivers on disk 2 TTPs 4 IoCs
description ioc Process File opened (read-only) C:\Windows\system32\drivers\VBoxMouse.sys 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe File opened (read-only) C:\Windows\system32\drivers\VBoxGuest.sys 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe File opened (read-only) C:\Windows\system32\drivers\VBoxSF.sys 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe File opened (read-only) C:\Windows\system32\drivers\VBoxVideo.sys 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe - Looks for VirtualBox executables on disk 2 TTPs 3 IoCs
description ioc Process File opened (read-only) C:\Windows\system32\vboxservice.exe 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe File opened (read-only) C:\Windows\system32\vboxtray.exe 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe File opened (read-only) C:\Windows\system32\VBoxControl.exe 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe - Looks for VMWare Tools registry key 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools reg.exe Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools reg.exe - Looks for VMWare drivers on disk 2 TTPs 4 IoCs
description ioc Process File opened (read-only) C:\Windows\system32\drivers\vmmouse.sys 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe File opened (read-only) C:\Windows\system32\drivers\vmhgfs.sys 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe File opened (read-only) C:\Windows\system32\drivers\vmmemctl.sys 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe File opened (read-only) C:\Windows\system32\drivers\vmusbmouse.sys 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe - Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\SystemBiosDate reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\SystemBiosVersion reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\SystemBiosVersion reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\SystemBiosVersion reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\SystemBiosVersion reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\SystemBiosVersion reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\SystemBiosVersion reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\VideoBiosVersion reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\VideoBiosVersion reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\SystemBiosDate reg.exe - Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wine reg.exe - Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 3424 ipconfig.exe - Modifies registry key 1 TTPs 15 IoCs
pid Process 3976 reg.exe 4648 reg.exe 5880 reg.exe 3856 reg.exe 1788 reg.exe 4620 reg.exe 4344 reg.exe 1052 reg.exe 2856 reg.exe 2016 reg.exe 5312 reg.exe 2132 reg.exe 6108 reg.exe 2864 reg.exe 4256 reg.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4108 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe 4108 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe 4108 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe 4108 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe 4108 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe 4108 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe 3384 wmic.exe 3384 wmic.exe 3384 wmic.exe 3384 wmic.exe - Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3384 wmic.exe Token: SeSecurityPrivilege 3384 wmic.exe Token: SeTakeOwnershipPrivilege 3384 wmic.exe Token: SeLoadDriverPrivilege 3384 wmic.exe Token: SeSystemProfilePrivilege 3384 wmic.exe Token: SeSystemtimePrivilege 3384 wmic.exe Token: SeProfSingleProcessPrivilege 3384 wmic.exe Token: SeIncBasePriorityPrivilege 3384 wmic.exe Token: SeCreatePagefilePrivilege 3384 wmic.exe Token: SeBackupPrivilege 3384 wmic.exe Token: SeRestorePrivilege 3384 wmic.exe Token: SeShutdownPrivilege 3384 wmic.exe Token: SeDebugPrivilege 3384 wmic.exe Token: SeSystemEnvironmentPrivilege 3384 wmic.exe Token: SeRemoteShutdownPrivilege 3384 wmic.exe Token: SeUndockPrivilege 3384 wmic.exe Token: SeManageVolumePrivilege 3384 wmic.exe Token: 33 3384 wmic.exe Token: 34 3384 wmic.exe Token: 35 3384 wmic.exe Token: 36 3384 wmic.exe Token: SeIncreaseQuotaPrivilege 3384 wmic.exe Token: SeSecurityPrivilege 3384 wmic.exe Token: SeTakeOwnershipPrivilege 3384 wmic.exe Token: SeLoadDriverPrivilege 3384 wmic.exe Token: SeSystemProfilePrivilege 3384 wmic.exe Token: SeSystemtimePrivilege 3384 wmic.exe Token: SeProfSingleProcessPrivilege 3384 wmic.exe Token: SeIncBasePriorityPrivilege 3384 wmic.exe Token: SeCreatePagefilePrivilege 3384 wmic.exe Token: SeBackupPrivilege 3384 wmic.exe Token: SeRestorePrivilege 3384 wmic.exe Token: SeShutdownPrivilege 3384 wmic.exe Token: SeDebugPrivilege 3384 wmic.exe Token: SeSystemEnvironmentPrivilege 3384 wmic.exe Token: SeRemoteShutdownPrivilege 3384 wmic.exe Token: SeUndockPrivilege 3384 wmic.exe Token: SeManageVolumePrivilege 3384 wmic.exe Token: 33 3384 wmic.exe Token: 34 3384 wmic.exe Token: 35 3384 wmic.exe Token: 36 3384 wmic.exe - Suspicious use of WriteProcessMemory 41 IoCs
description pid Process procid_target PID 4108 wrote to memory of 236 4108 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe 91 PID 4108 wrote to memory of 3920 4108 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe 92 PID 4108 wrote to memory of 4140 4108 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe 93 PID 4108 wrote to memory of 3976 4108 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe 94 PID 4108 wrote to memory of 6108 4108 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe 95 PID 4108 wrote to memory of 4648 4108 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe 96 PID 4108 wrote to memory of 2864 4108 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe 97 PID 4108 wrote to memory of 4720 4108 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe 98 PID 4108 wrote to memory of 5880 4108 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe 99 PID 4108 wrote to memory of 3952 4108 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe 100 PID 4108 wrote to memory of 2104 4108 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe 101 PID 4108 wrote to memory of 2780 4108 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe 102 PID 4108 wrote to memory of 1492 4108 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe 103 PID 4108 wrote to memory of 5312 4108 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe 104 PID 4108 wrote to memory of 2132 4108 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe 105 PID 4108 wrote to memory of 4620 4108 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe 106 PID 4108 wrote to memory of 3856 4108 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe 107 PID 4108 wrote to memory of 1788 4108 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe 108 PID 4108 wrote to memory of 4344 4108 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe 109 PID 4108 wrote to memory of 3396 4108 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe 110 PID 4108 wrote to memory of 2508 4108 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe 111 PID 4108 wrote to memory of 5924 4108 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe 112 PID 4108 wrote to memory of 3248 4108 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe 113 PID 4108 wrote to memory of 4256 4108 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe 114 PID 4108 wrote to memory of 1052 4108 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe 115 PID 4108 wrote to memory of 2856 4108 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe 116 PID 4108 wrote to memory of 2016 4108 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe 117 PID 4108 wrote to memory of 3780 4108 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe 118 PID 4108 wrote to memory of 3204 4108 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe 119 PID 4108 wrote to memory of 3628 4108 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe 120 PID 4108 wrote to memory of 3388 4108 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe 121 PID 4108 wrote to memory of 3044 4108 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe 122 PID 4108 wrote to memory of 6112 4108 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe 123 PID 4108 wrote to memory of 2012 4108 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe 124 PID 4108 wrote to memory of 5096 4108 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe 125 PID 4108 wrote to memory of 1816 4108 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe 126 PID 4108 wrote to memory of 3508 4108 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe 127 PID 4108 wrote to memory of 4904 4108 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe 128 PID 4108 wrote to memory of 4420 4108 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe 129 PID 4108 wrote to memory of 3384 4108 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe 130 PID 4108 wrote to memory of 3424 4108 2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe 131
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_4fa4a356d79f238d0533b541117c32ff_akira_glassworm.exe"1⤵
- Enumerates VirtualBox DLL files
- Looks for VirtualBox drivers on disk
- Looks for VirtualBox executables on disk
- Looks for VMWare drivers on disk
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Windows\system32\reg.exe"reg" query "HKLM\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0"2⤵PID:236
-
-
C:\Windows\system32\reg.exe"reg" query "HKLM\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0" /v Identifier2⤵PID:3920
-
-
C:\Windows\system32\reg.exe"reg" query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools"2⤵
- Looks for VMWare Tools registry key
PID:4140
-
-
C:\Windows\system32\reg.exe"reg" query HKLM\HARDWARE\Description\System\SystemBiosVersion2⤵
- Checks BIOS information in registry
- Modifies registry key
PID:3976
-
-
C:\Windows\system32\reg.exe"reg" query HKLM\HARDWARE\Description\System\SystemBiosVersion /v ""2⤵
- Checks BIOS information in registry
- Modifies registry key
PID:6108
-
-
C:\Windows\system32\reg.exe"reg" query HKLM\HARDWARE\Description\System\SystemBiosVersion2⤵
- Checks BIOS information in registry
- Modifies registry key
PID:4648
-
-
C:\Windows\system32\reg.exe"reg" query HKLM\HARDWARE\Description\System\SystemBiosVersion /v ""2⤵
- Checks BIOS information in registry
- Modifies registry key
PID:2864
-
-
C:\Windows\system32\reg.exe"reg" query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions"2⤵
- Looks for VirtualBox Guest Additions in registry
PID:4720
-
-
C:\Windows\system32\reg.exe"reg" query HKLM\HARDWARE\ACPI\DSDT\VBOX__2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Modifies registry key
PID:5880
-
-
C:\Windows\system32\reg.exe"reg" query "HKLM\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0"2⤵PID:3952
-
-
C:\Windows\system32\reg.exe"reg" query "HKLM\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0" /v Identifier2⤵PID:2104
-
-
C:\Windows\system32\reg.exe"reg" query "HKLM\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0"2⤵PID:2780
-
-
C:\Windows\system32\reg.exe"reg" query "HKLM\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0" /v Identifier2⤵PID:1492
-
-
C:\Windows\system32\reg.exe"reg" query HKLM\HARDWARE\Description\System\SystemBiosVersion2⤵
- Checks BIOS information in registry
- Modifies registry key
PID:5312
-
-
C:\Windows\system32\reg.exe"reg" query HKLM\HARDWARE\Description\System\SystemBiosVersion /v ""2⤵
- Checks BIOS information in registry
- Modifies registry key
PID:2132
-
-
C:\Windows\system32\reg.exe"reg" query HKLM\HARDWARE\Description\System\VideoBiosVersion2⤵
- Checks BIOS information in registry
- Modifies registry key
PID:4620
-
-
C:\Windows\system32\reg.exe"reg" query HKLM\HARDWARE\Description\System\VideoBiosVersion /v ""2⤵
- Checks BIOS information in registry
- Modifies registry key
PID:3856
-
-
C:\Windows\system32\reg.exe"reg" query HKLM\HARDWARE\Description\System\SystemBiosDate2⤵
- Checks BIOS information in registry
- Modifies registry key
PID:1788
-
-
C:\Windows\system32\reg.exe"reg" query HKLM\HARDWARE\Description\System\SystemBiosDate /v ""2⤵
- Checks BIOS information in registry
- Modifies registry key
PID:4344
-
-
C:\Windows\system32\reg.exe"reg" query "HKLM\HARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0"2⤵PID:3396
-
-
C:\Windows\system32\reg.exe"reg" query "HKLM\HARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0" /v Identifier2⤵PID:2508
-
-
C:\Windows\system32\reg.exe"reg" query "HKLM\HARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0"2⤵PID:5924
-
-
C:\Windows\system32\reg.exe"reg" query "HKLM\HARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0" /v Identifier2⤵PID:3248
-
-
C:\Windows\system32\reg.exe"reg" query HKLM\SYSTEM\ControlSet001\Control\SystemInformation2⤵
- Modifies registry key
PID:4256
-
-
C:\Windows\system32\reg.exe"reg" query HKLM\SYSTEM\ControlSet001\Control\SystemInformation /v SystemManufacturer2⤵
- Modifies registry key
PID:1052
-
-
C:\Windows\system32\reg.exe"reg" query HKLM\SYSTEM\ControlSet001\Control\SystemInformation2⤵
- Modifies registry key
PID:2856
-
-
C:\Windows\system32\reg.exe"reg" query HKLM\SYSTEM\ControlSet001\Control\SystemInformation /v SystemProductName2⤵
- Modifies registry key
PID:2016
-
-
C:\Windows\system32\reg.exe"reg" query HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
PID:3780
-
-
C:\Windows\system32\reg.exe"reg" query HKEY_LOCAL_MACHINE\HARDWARE\ACPI\FADT\VBOX__2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
PID:3204
-
-
C:\Windows\system32\reg.exe"reg" query HKEY_LOCAL_MACHINE\HARDWARE\ACPI\RSDT\VBOX__2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
PID:3628
-
-
C:\Windows\system32\reg.exe"reg" query "HKEY_LOCAL_MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions"2⤵
- Looks for VirtualBox Guest Additions in registry
PID:3388
-
-
C:\Windows\system32\reg.exe"reg" query HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest2⤵
- Enumerates VirtualBox registry keys
PID:3044
-
-
C:\Windows\system32\reg.exe"reg" query HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse2⤵
- Enumerates VirtualBox registry keys
PID:6112
-
-
C:\Windows\system32\reg.exe"reg" query HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VBoxService2⤵
- Enumerates VirtualBox registry keys
PID:2012
-
-
C:\Windows\system32\reg.exe"reg" query HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VBoxSF2⤵
- Enumerates VirtualBox registry keys
PID:5096
-
-
C:\Windows\system32\reg.exe"reg" query HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo2⤵
- Enumerates VirtualBox registry keys
PID:1816
-
-
C:\Windows\system32\reg.exe"reg" query "HKEY_LOCAL_MACHINE\SOFTWARE\VMware, Inc.\VMware Tools"2⤵
- Looks for VMWare Tools registry key
PID:3508
-
-
C:\Windows\system32\reg.exe"reg" query HKEY_LOCAL_MACHINE\SOFTWARE\Wine2⤵
- Identifies Wine through registry keys
PID:4904
-
-
C:\Windows\system32\reg.exe"reg" query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters"2⤵PID:4420
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" process get name2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3384
-
-
C:\Windows\system32\ipconfig.exe"ipconfig" /all2⤵
- Gathers network information
PID:3424
-