6a521af0a945cdadf29673e929e99e828202f4ff555d7d8d19c615dd65e5bc33

Analysis

max time kernel
148s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 15:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6a521af0a945cdadf29673e929e99e828202f4ff555d7d8d19c615dd65e5bc33.exe
Size 936KB
Sample260809-sw659a1apf
SHA256 6a521af0a945cdadf29673e929e99e828202f4ff555d7d8d19c615dd65e5bc33
MD5 1b04f2677270adc0f57606b82d2ddfab
SHA1 0006fd83c9670377275be8a0f04837e6c06a72b3
SHA512 d472f364240228666f5cbf782a081d78b7cdbcca0bb65308d5775fb6b039af6add6a9d641780bfc4a7e4833a4d1eb722fe95a81969c3bfe105d28d2dfd720bc1
SSDEEP 24576:5pXA46QoRbeIzW4iEZ31m2Rx2+siA/s8:5peDiEB1vRYd/
TLSH
T1D115F142779716EAE6738D3889A2D312EF32F8560B65D7CF63900EE52D232D01D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion

Malware Config

Signatures

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	6a521af0a945cdadf29673e929e99e828202f4ff555d7d8d19c615dd65e5bc33.exe

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	6a521af0a945cdadf29673e929e99e828202f4ff555d7d8d19c615dd65e5bc33.exe

Disables Task Manager via registry modification
defense_evasion

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	6a521af0a945cdadf29673e929e99e828202f4ff555d7d8d19c615dd65e5bc33.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
5460	6a521af0a945cdadf29673e929e99e828202f4ff555d7d8d19c615dd65e5bc33.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5460	6a521af0a945cdadf29673e929e99e828202f4ff555d7d8d19c615dd65e5bc33.exe
5460	6a521af0a945cdadf29673e929e99e828202f4ff555d7d8d19c615dd65e5bc33.exe
5460	6a521af0a945cdadf29673e929e99e828202f4ff555d7d8d19c615dd65e5bc33.exe
5460	6a521af0a945cdadf29673e929e99e828202f4ff555d7d8d19c615dd65e5bc33.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5460	6a521af0a945cdadf29673e929e99e828202f4ff555d7d8d19c615dd65e5bc33.exe

C:\Users\Admin\AppData\Local\Temp\6a521af0a945cdadf29673e929e99e828202f4ff555d7d8d19c615dd65e5bc33.exe
"C:\Users\Admin\AppData\Local\Temp\6a521af0a945cdadf29673e929e99e828202f4ff555d7d8d19c615dd65e5bc33.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Disables RegEdit via registry modification
- Looks for VMWare Tools registry key
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads