c7b2edcd0f5c24dd5e571a1983c5c514e7d2e6ef2e0268a3f43d50d79076e69e

Analysis

max time kernel
148s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_Notif_BVOG-deusjNSJV.YHRTConfgXQALE.vbs
Size 4.6MB
Sample260809-phz81axeqf
SHA256 c7b2edcd0f5c24dd5e571a1983c5c514e7d2e6ef2e0268a3f43d50d79076e69e
MD5 5c943b9ee464e13570b4d57e643f6a93
SHA1 9b98e58f69c12767928ba5d02977592db3f99c2b
SHA512 b96ccb832a51869df7d0f704fe29d7879640d275f9b0d948b3d6a6dfa0c70802586c0c61f810068d891c6409ac8f00fd7f62fbeeef8c1edf551894fd5de65975
SSDEEP 49152:zr8dQ+eyJ1HTqEkinExwG4bMHQgsAux+GD9uaegMSnsI:Q
TLSH
T19A2623769E551E270F914399F02F2A22BE7D8923424D92FAD4CDE246328F9D5C13F878
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution persistence ransomware

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	Un%QFDyes8Vv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	Un%QFDyes8Vv.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Un%QFDyes8Vv.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	Un%QFDyes8Vv.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions	Un%QFDyes8Vv.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	Un%QFDyes8Vv.exe

Executes dropped EXE 1 IoCs

pid	Process
5040	Un%QFDyes8Vv.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
3896	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Un%QFDyes8Vv.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
5040	Un%QFDyes8Vv.exe
5040	Un%QFDyes8Vv.exe
5040	Un%QFDyes8Vv.exe
5040	Un%QFDyes8Vv.exe
5040	Un%QFDyes8Vv.exe
5040	Un%QFDyes8Vv.exe
5040	Un%QFDyes8Vv.exe
5040	Un%QFDyes8Vv.exe
5040	Un%QFDyes8Vv.exe
5040	Un%QFDyes8Vv.exe
5040	Un%QFDyes8Vv.exe
5040	Un%QFDyes8Vv.exe
5040	Un%QFDyes8Vv.exe
5040	Un%QFDyes8Vv.exe
5040	Un%QFDyes8Vv.exe
5040	Un%QFDyes8Vv.exe
5040	Un%QFDyes8Vv.exe
5040	Un%QFDyes8Vv.exe
5040	Un%QFDyes8Vv.exe
5040	Un%QFDyes8Vv.exe
5040	Un%QFDyes8Vv.exe
5040	Un%QFDyes8Vv.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5040	Un%QFDyes8Vv.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3896 wrote to memory of 5040	3896	WScript.exe	91

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Notif_BVOG-deusjNSJV.YHRTConfgXQALE.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:3896
- C:\Users\Admin\AppData\Local\Un%QFDyes8Vv.exe
  "C:\Users\Admin\AppData\Local\Un%QFDyes8Vv.exe"
  2⤵
  - Enumerates VirtualBox registry keys
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Un%QFDyes8Vv.zip

Path C:\Users\Admin\AppData\Local\Un%QFDyes8Vv.zip
Size 3.3MB
SHA256 ab9ed657670b5c1b7f356514ce0d718e487f63152fc3f0c2a8ddeca3ade1fd4a
MD5 3859daaeabd8621059470d2005ae15b4
SHA1 3304f77ca2f169c74a609d8165a8da42c9726d2e
SHA512 b5d892488d244341882c991b5fda71685b4afe54ab24677b0506bd253f89d2b760b26fd415ed69d1c0027c9b53e4c52d62f56ce2900cbea6016a767195dc44ae
SSDEEP 49152:en/3AMIeO3yWRuizhvq42QMiEWiDcC1oBhjckHvZhJtcyaquJYHoFeO3OLzmk:en/3AKAADQMiEWNL9vZhJtpa5VMzmk
TLSH
T149F53358CBDD056DE4AD08B64C57DAFE3939875E0A023D1AEBAA3B3E61073432F11D85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5040-37-0x00000000001E0000-0x0000000005028000-memory.dmp

Download

memory/5040-40-0x00000000001E0000-0x0000000005028000-memory.dmp

Download

memory/5040-42-0x00000000001E0000-0x0000000005028000-memory.dmp

Download

memory/5040-44-0x00000000001E0000-0x0000000005028000-memory.dmp

Download