Analysis
- max time kernel
151s - max time network
18s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
19/08/2026, 13:27
General
- Target BBi7rkDtISweZy4k.exe
- Size 20.0MB
- Sample260819-qqa5hsxtdv
- SHA256 c74a1ec988a67d23bb32989e406b8b48e9cdb9d39a1472d1d2994c260019d908
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 25 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\BBi7rkDtISweZy4k.exe"C:\Users\Admin\AppData\Local\Temp\BBi7rkDtISweZy4k.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3908-0-0x0000000140000000-0x0000000142458000-memory.dmp
memory/3908-1-0x0000000140000000-0x0000000142458000-memory.dmp
memory/3908-2-0x0000000140000000-0x0000000142458000-memory.dmp
memory/3908-3-0x0000000140000000-0x0000000142458000-memory.dmp
memory/3908-4-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-576-0x0000000002D30000-0x00000000031FA000-memory.dmp
memory/3908-578-0x0000000002D30000-0x00000000031FA000-memory.dmp
memory/3908-577-0x0000000002D30000-0x00000000031FA000-memory.dmp
memory/3908-580-0x0000000002D30000-0x00000000031FA000-memory.dmp
memory/3908-579-0x0000000002D30000-0x00000000031FA000-memory.dmp
memory/3908-658-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-657-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-659-0x0000000002D30000-0x00000000031FA000-memory.dmp
memory/3908-660-0x0000000000830000-0x0000000000831000-memory.dmp
memory/3908-656-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-655-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-654-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-653-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-652-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-651-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-650-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-649-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-648-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-647-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-646-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-645-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-644-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-643-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-642-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-641-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-640-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-639-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-638-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-637-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-636-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-635-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-634-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-633-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-632-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-631-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-630-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-629-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-628-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-627-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-626-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-625-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-624-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-623-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-622-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-621-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-620-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-619-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-618-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-617-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-616-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-615-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-614-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-613-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-612-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-611-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-610-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-609-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-608-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-607-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-606-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-605-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-604-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-603-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-602-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-601-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-600-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-599-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-598-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-597-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-596-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-595-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-594-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-593-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-592-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-591-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-590-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-589-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-588-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-587-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-586-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-585-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-584-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-583-0x00000000007F0000-0x00000000007F1000-memory.dmp
memory/3908-582-0x0000000140000000-0x0000000142458000-memory.dmp
memory/3908-581-0x0000000002D30000-0x00000000031FA000-memory.dmp
memory/3908-700-0x0000000000860000-0x0000000000861000-memory.dmp
memory/3908-721-0x0000000140000000-0x0000000142458000-memory.dmp
memory/3908-845-0x0000000002D30000-0x00000000031FA000-memory.dmp
memory/3908-847-0x0000000140000000-0x0000000142458000-memory.dmp