190c5cf31f05ec42f2e14172a8042d0dc922c8143180ddf23cac00b660e0e7de

Analysis

geolocation tags

eueuropefrfrance
user interaction
yes
max time kernel
298s
max time network
121s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-es
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-eslocale:es-esos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 11:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_Vrfc_MISVM-IDLGCohdymr.7452Serv1H71FX.vbs
Size 4.5MB
Sample260820-m88a7aar4x
SHA256 190c5cf31f05ec42f2e14172a8042d0dc922c8143180ddf23cac00b660e0e7de
MD5 26b8f8a0233b8fb88d3eec6db8607788
SHA1 a8ef79c84a2e18ea1ec220a1716a1e42b04e3ae9
SHA512 e7ab56d9dfc2a4e80f40ee094e5496a5c931af02f367f6dd9cac7a7fa77cb8951709c4b5624803b16f467b494b233ee7b75e8fe65f7f75c92beab34ec52c1940
SSDEEP 49152:r77P2/H1kYjhIRzbECwQDET3o9+4O5ogdajbFI/0y7JmbnG2fQhyR8ACYFUx7r:ry
TLSH
T1A82633F179E57F7E09BCE51A20AE7E2C6EEE29478309ED893A906CC105E7F42452741C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution persistence ransomware

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	9sn0xxCL0ezL9mdRl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	9sn0xxCL0ezL9mdRl.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	9sn0xxCL0ezL9mdRl.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	9sn0xxCL0ezL9mdRl.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions	9sn0xxCL0ezL9mdRl.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	9sn0xxCL0ezL9mdRl.exe

Executes dropped EXE 1 IoCs

pid	Process
4508	9sn0xxCL0ezL9mdRl.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
1248	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9sn0xxCL0ezL9mdRl.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
4508	9sn0xxCL0ezL9mdRl.exe
4508	9sn0xxCL0ezL9mdRl.exe
4508	9sn0xxCL0ezL9mdRl.exe
4508	9sn0xxCL0ezL9mdRl.exe
4508	9sn0xxCL0ezL9mdRl.exe
4508	9sn0xxCL0ezL9mdRl.exe
4508	9sn0xxCL0ezL9mdRl.exe
4508	9sn0xxCL0ezL9mdRl.exe
4508	9sn0xxCL0ezL9mdRl.exe
4508	9sn0xxCL0ezL9mdRl.exe
4508	9sn0xxCL0ezL9mdRl.exe
4508	9sn0xxCL0ezL9mdRl.exe
4508	9sn0xxCL0ezL9mdRl.exe
4508	9sn0xxCL0ezL9mdRl.exe
4508	9sn0xxCL0ezL9mdRl.exe
4508	9sn0xxCL0ezL9mdRl.exe
4508	9sn0xxCL0ezL9mdRl.exe
4508	9sn0xxCL0ezL9mdRl.exe
4508	9sn0xxCL0ezL9mdRl.exe
4508	9sn0xxCL0ezL9mdRl.exe
4508	9sn0xxCL0ezL9mdRl.exe
4508	9sn0xxCL0ezL9mdRl.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4508	9sn0xxCL0ezL9mdRl.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1248 wrote to memory of 4508	1248	WScript.exe	91

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Vrfc_MISVM-IDLGCohdymr.7452Serv1H71FX.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Users\Public\9sn0xxCL0ezL9mdRl.exe
  "C:\Users\Public\9sn0xxCL0ezL9mdRl.exe"
  2⤵
  - Enumerates VirtualBox registry keys
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9sn0xxCL0ezL9mdRl.zip

Path C:\Users\Public\9sn0xxCL0ezL9mdRl.zip
Size 3.1MB
SHA256 f928548d73f7c89a057d67b5afef82835813a1bf85d405b5eaebe307970c384e
MD5 a1079054d0984a9468e74e8ccd88f03c
SHA1 0159531b608579fa9f2a08aa75334a3db90ef133
SHA512 33ca9b4e2d7d744298f6a8d414aeba4999a1755a1dcf1ea9ab2cf2ab801531ac6ac88732ff824edf7cd5becfcfff61aa36bdeec894b5964be88edeac51743d17
SSDEEP 98304:eXBH9WSkt/rDThjnwEpguZIBL+UI0SXK/Cc:0Bdk/NwEpguuBLHbSmCc
TLSH
T13DE533F2DF9BB7C5C82912F9E7A9CF2B416980D8A55BDE1907E81F260C774024DE6C21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4508-38-0x0000000000C20000-0x0000000005D00000-memory.dmp

Download

memory/4508-40-0x0000000000C20000-0x0000000005D00000-memory.dmp

Download

memory/4508-42-0x0000000000C20000-0x0000000005D00000-memory.dmp

Download

memory/4508-46-0x0000000000C20000-0x0000000005D00000-memory.dmp

Download

memory/4508-58-0x0000000000C20000-0x0000000005D00000-memory.dmp

Download