af532639be61482d12a186b901db5ad5797fdb0335f3f5a55a9b983eda3cddcc

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 09:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
af532639be61482d12a186b901db5ad5797fdb0335f3f5a55a9b983eda3cddcc.exe
Size 22KB
Sample260808-ltqbdsx1bw
SHA256 af532639be61482d12a186b901db5ad5797fdb0335f3f5a55a9b983eda3cddcc
MD5 4f487dc0f50c0c64cb27c8c87785c0d4
SHA1 824bd00550a91b794327fd692ff588b9acb64027
SHA512 81d978a5de84ed075767081e70106eff1cc9d82a22b06684b4d4bd77bb91f96b766d1a4cd59a767104bd3257b8760b913ecf575129dae594fb09d57f20277c6d
SSDEEP 384:IZu6YnTo3g2fQxjNd9s2R/aFI9hTChRs0DZwb3o:IZcM3g0QhG2sI9hTwyb3o
TLSH
T12FA26D95E6A442DDFC2FE27CC5932B1FF062B41A2B25F7EF4B9408520D706A9743B182
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService	af532639be61482d12a186b901db5ad5797fdb0335f3f5a55a9b983eda3cddcc.exe

Looks for VMWare services registry key. 1 TTPs 1 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMTools	af532639be61482d12a186b901db5ad5797fdb0335f3f5a55a9b983eda3cddcc.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3516	af532639be61482d12a186b901db5ad5797fdb0335f3f5a55a9b983eda3cddcc.exe
3516	af532639be61482d12a186b901db5ad5797fdb0335f3f5a55a9b983eda3cddcc.exe
3516	af532639be61482d12a186b901db5ad5797fdb0335f3f5a55a9b983eda3cddcc.exe
3516	af532639be61482d12a186b901db5ad5797fdb0335f3f5a55a9b983eda3cddcc.exe
3516	af532639be61482d12a186b901db5ad5797fdb0335f3f5a55a9b983eda3cddcc.exe
3516	af532639be61482d12a186b901db5ad5797fdb0335f3f5a55a9b983eda3cddcc.exe
3516	af532639be61482d12a186b901db5ad5797fdb0335f3f5a55a9b983eda3cddcc.exe
3516	af532639be61482d12a186b901db5ad5797fdb0335f3f5a55a9b983eda3cddcc.exe
3516	af532639be61482d12a186b901db5ad5797fdb0335f3f5a55a9b983eda3cddcc.exe
3516	af532639be61482d12a186b901db5ad5797fdb0335f3f5a55a9b983eda3cddcc.exe
3516	af532639be61482d12a186b901db5ad5797fdb0335f3f5a55a9b983eda3cddcc.exe
3516	af532639be61482d12a186b901db5ad5797fdb0335f3f5a55a9b983eda3cddcc.exe

C:\Users\Admin\AppData\Local\Temp\af532639be61482d12a186b901db5ad5797fdb0335f3f5a55a9b983eda3cddcc.exe
"C:\Users\Admin\AppData\Local\Temp\af532639be61482d12a186b901db5ad5797fdb0335f3f5a55a9b983eda3cddcc.exe"
1⤵
- Enumerates VirtualBox registry keys
- Looks for VMWare services registry key.
- Suspicious behavior: EnumeratesProcesses
PID:3516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads