06309cf698e0e45822bdd2c8709d772e1082d48dcc34f043b7586696492d68b2

Analysis

user interaction
yes
max time kernel
118s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 17:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
wrah.exe
Size 76KB
Sample260812-vr1tsay1dv
SHA256 06309cf698e0e45822bdd2c8709d772e1082d48dcc34f043b7586696492d68b2
MD5 3508ae10ac1e1380d82d61abf2750949
SHA1 928652309c8dedba51d365621748bd169f584ba1
SHA512 5bfd37f3f0a9dfdaf7b3252a2c9883570295c6994840fe80be5b938148c9e18047a42439900b5fdb4535cd5d0dab97f7ba447d3ac47c01b9f20d0b3732bd286b
SSDEEP 768:2dwRhJOxMzqJ5yDL9wpG1uiGQunBP3ij1zWqmIY9zAfoC3BXd9M4OjSCuz6RDEq4:6wROx1yDRwpG1Cnp3WzWgY9zRdDcOj
TLSH
T10473081BF15320ECC61BC178CAEA1633E772786495342F6E57A0D5722F72AA17E38B05
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	wrah.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	wrah.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	wrah.exe

Looks for VMWare services registry key. 1 TTPs 1 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	wrah.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5844	wrah.exe
5844	wrah.exe

C:\Users\Admin\AppData\Local\Temp\wrah.exe
"C:\Users\Admin\AppData\Local\Temp\wrah.exe"
1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Suspicious behavior: EnumeratesProcesses
PID:5844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5844-0-0x00007FF77EF50000-0x00007FF77EF6A000-memory.dmp

Download