d6cb08411deb408a4b24c554835093d5af921d5634deeff971bce158f381d7ce

Resubmissions

15/08/2026, 18:12

260815-wtngxa11ct9

28/07/2026, 18:08

260728-wqxleasanh9

28/07/2026, 18:03

260728-wnhdps1hpg9

17/07/2026, 01:31

260717-bxfagshs7l9

Analysis

user interaction
yes
max time kernel
148s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/08/2026, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
liHPF2KWjt8xGPW2c.exe
Size 42.9MB
Sample260815-wtngxa11ct
SHA256 d6cb08411deb408a4b24c554835093d5af921d5634deeff971bce158f381d7ce
MD5 3075fa2bac2f75b5b8f49e51ce57095e
SHA1 e571efc25fde6f9cae5f55005b3cd6668972ba56
SHA512 0d09a5a7e92f231de0bfbe41571988534be9474918b31522c7dcc69110e87a8c300b2f204943c186f003a333c6e300ffecdaaeb09736faac7fffc9f3399dd2ef
SSDEEP 786432:Rqtekqmc1CaQFDtdtB8NZc/eJL2T1WotnwjAG5FaSOtprMCY:RNNiDf8k7nRwrsxp0
TLSH
T14FA73362C3A274EBE425AEF01C285C50CDB36C67BF1112E6F61742365C27EC64F26E99
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion ransomware trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	liHPF2KWjt8xGPW2c.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	liHPF2KWjt8xGPW2c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	liHPF2KWjt8xGPW2c.exe

Loads dropped DLL 1 IoCs

pid	Process
4140	liHPF2KWjt8xGPW2c.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	liHPF2KWjt8xGPW2c.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4140	liHPF2KWjt8xGPW2c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings	liHPF2KWjt8xGPW2c.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1552	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4140	liHPF2KWjt8xGPW2c.exe
4140	liHPF2KWjt8xGPW2c.exe
4140	liHPF2KWjt8xGPW2c.exe
4140	liHPF2KWjt8xGPW2c.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4140 wrote to memory of 1552	4140	liHPF2KWjt8xGPW2c.exe	81

C:\Users\Admin\AppData\Local\Temp\liHPF2KWjt8xGPW2c.exe
"C:\Users\Admin\AppData\Local\Temp\liHPF2KWjt8xGPW2c.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\logs.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7a7db4ee.dll

Path C:\Users\Admin\AppData\Local\Temp\7a7db4ee.dll
Size 10KB
SHA256 eebab9f95e2768ad193cd343de9a0ce6694f8a1faa7e84048e079d42d751fe86
MD5 590b9fdbdb8c29399a638ede12951010
SHA1 ec5d0f5c6335d9c025c450828dfc47019d270a67
SHA512 104b94ef3f6157f6f0deb0a01ca4a11d1f3833f0c9c06b4a88ec80ee0d9db23e4cd84188b89de0752885babddb829d6081e902d4e9976183d492df31c67f96b3
SSDEEP 48:aOnTG0Cfj3gF2/e1LIa0Wh4PYCvo+ocjpERuqSx:xTG3jDe1Ud3Q+fUx
TLSH
T18B224296F754C566E63E03FC08178A1A70BCB260039257FB6E1C611E2ED27A0B976A40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logs.txt

Path C:\Users\Admin\AppData\Local\Temp\logs.txt
Size 79B
SHA256 897a488fd4d7c5e37a1425d2791278f9371120ee731fa06d376f5f472805417e
MD5 0312273fba9b756c1b68e768c34a1b6d
SHA1 54764937d759b3a1f1c62965b922d947e582c0b7
SHA512 9f601044588c856b1853e0477ba160e597c1f471d1ad5c150eb5ee3a629ad5e3959bf9d281c8f7a24100b25e040058fc483ce216d0b47ee1b3d1fce3407e58ef
TLSH
T181A012C204E02945502140451B162C40A2DC44E9246B8D4413B000566004B3CA048D8A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4140-0-0x0000000140000000-0x0000000141000000-memory.dmp

Download

memory/4140-1-0x0000000140000000-0x0000000141000000-memory.dmp

Download

memory/4140-2-0x0000000140000000-0x0000000141000000-memory.dmp

Download

memory/4140-4-0x0000000180000000-0x00000001841F3000-memory.dmp

Download

memory/4140-19-0x0000000140000000-0x0000000141000000-memory.dmp

Download