Analysis
- geolocation tags
cacanadananorth-americatoronto - max time kernel
30s - max time network
23s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/08/2026, 22:16
Behavioral task
behavioral1
Sample
dummy_protected.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
30 seconds
Behavioral task
behavioral2
Sample
dummy_protected.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
30 seconds
General
- Target dummy_protected.exe
- Size 3.7MB
- Sample260818-16vtzattcs
- SHA256 387883ad33ad7eff41c8ed6695c4db3641f19f809b0c92cc6ba1c666ac4e3402
- MD5 f39a617f526a29b0c4d93368c18870d3
- SHA1 5a19ac25c9e1c3ebb8c170d43a7c3f0e922b8a2a
- SHA512 d25628fea54f5ab8258d73241ba417bfb3d902a4a8cc7ca4cebc14eaa8e5a83d4c8dda41d144c626b3f499f9f7697a929632cf77644d8e7ec28f4992d78ad781
- SSDEEP 98304:GFC5TrOFnS8509Npq8UF4Ng139uHPiFFFTD:gkTrOFFCq8y33966F3D
- TLSH T1DD0633E2B325158FDD8093B09887EA5C46DC976CCCC78B9B3046FA10089791FD6AE5F9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ dummy_protected.exe - Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions dummy_protected.exe Key opened \REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\SOFTWARE\Oracle\VirtualBox Guest Additions dummy_protected.exe - Looks for VMWare Tools registry key 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools dummy_protected.exe Key opened \REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\SOFTWARE\VMware, Inc.\VMware Tools dummy_protected.exe - Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion dummy_protected.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion dummy_protected.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion dummy_protected.exe Key opened \REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\HARDWARE\DESCRIPTION\System\SystemBiosVersion dummy_protected.exe -
resource yara_rule behavioral2/memory/5852-0-0x0000000140000000-0x00000001409EB000-memory.dmp themida behavioral2/memory/5852-1-0x0000000140000000-0x00000001409EB000-memory.dmp themida behavioral2/memory/5852-3-0x0000000140000000-0x00000001409EB000-memory.dmp themida behavioral2/memory/5852-2-0x0000000140000000-0x00000001409EB000-memory.dmp themida - Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA dummy_protected.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 5852 dummy_protected.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\HARDWARE\DESCRIPTION\System\BIOS dummy_protected.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS dummy_protected.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\ dummy_protected.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry dummy_protected.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315649914851665" dummy_protected.exe - Suspicious behavior: EnumeratesProcesses 56 IoCs
pid Process 5852 dummy_protected.exe 5852 dummy_protected.exe 5852 dummy_protected.exe 5852 dummy_protected.exe 5852 dummy_protected.exe 5852 dummy_protected.exe 5852 dummy_protected.exe 5852 dummy_protected.exe 5852 dummy_protected.exe 5852 dummy_protected.exe 5852 dummy_protected.exe 5852 dummy_protected.exe 5852 dummy_protected.exe 5852 dummy_protected.exe 5852 dummy_protected.exe 5852 dummy_protected.exe 5852 dummy_protected.exe 5852 dummy_protected.exe 5852 dummy_protected.exe 5852 dummy_protected.exe 5852 dummy_protected.exe 5852 dummy_protected.exe 5852 dummy_protected.exe 5852 dummy_protected.exe 5852 dummy_protected.exe 5852 dummy_protected.exe 5852 dummy_protected.exe 5852 dummy_protected.exe 5852 dummy_protected.exe 5852 dummy_protected.exe 5852 dummy_protected.exe 5852 dummy_protected.exe 5852 dummy_protected.exe 5852 dummy_protected.exe 5852 dummy_protected.exe 5852 dummy_protected.exe 5852 dummy_protected.exe 5852 dummy_protected.exe 5852 dummy_protected.exe 5852 dummy_protected.exe 5852 dummy_protected.exe 5852 dummy_protected.exe 5852 dummy_protected.exe 5852 dummy_protected.exe 5852 dummy_protected.exe 5852 dummy_protected.exe 5852 dummy_protected.exe 5852 dummy_protected.exe 5852 dummy_protected.exe 5852 dummy_protected.exe 5852 dummy_protected.exe 5852 dummy_protected.exe 5852 dummy_protected.exe 5852 dummy_protected.exe 5852 dummy_protected.exe 5852 dummy_protected.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dummy_protected.exe"C:\Users\Admin\AppData\Local\Temp\dummy_protected.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:5852