Analysis
- user interaction
yes - max time kernel
148s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/08/2026, 15:26
Behavioral task
behavioral1
Sample
teste.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
teste.exe
Resource
win11ltsc2024-20260709-en
7 signatures
150 seconds
General
- Target teste.exe
- Size 936KB
- Sample260820-svd33seb88
- SHA256 4bb8928dc5f208ac698838ae4a2e043cea29d0bce26310fefaf5bc6390768bf0
- MD5 e44ca71c710f9ea583a9edea77a47cba
- SHA1 fe0e98e68ec0cc23070b950e0266561f8441cd9a
- SHA512 a6464fbb6c24a8becc8b69d5ad53cd437e4373cbe5cbc4d4820231b82ace970cf871e70b8e7ffc8054d6b3a02f99ac548da3aa25ab524ee12d528cec2841c32f
- SSDEEP 24576:5pXA4DQoRbeIzW4iEZ31m2Rx2+siA/s8:5pdDiEB1vRYd/
- TLSH T1A215F142779716EAE6738D3889A2D312EF32F8560B65D7CF63900EE52D232D01D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions teste.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" teste.exe - Disables Task Manager via registry modification
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools teste.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 3276 teste.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3276 teste.exe 3276 teste.exe 3276 teste.exe 3276 teste.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3276 teste.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\teste.exe"C:\Users\Admin\AppData\Local\Temp\teste.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Disables RegEdit via registry modification
- Looks for VMWare Tools registry key
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3276