Analysis
- max time kernel
148s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/08/2026, 15:28
Behavioral task
behavioral1
Sample
teste.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
teste.exe
Resource
win11ltsc2024-20260709-en
7 signatures
150 seconds
General
- Target teste.exe
- Size 936KB
- Sample260820-swlvbaeb92
- SHA256 358b7f22bbbbf5a3c8b713752ea23e7d7e8e8c9d286f40532b8aa45e1ba059cf
- MD5 80b87c8444fab795f9fc362121f23ce9
- SHA1 23fc1472a5f6acdc1029a790497728d957c9973a
- SHA512 ab82b55b980f454d8479469de55129a6c0528a1ed92ca166ad92d399b2e3e76e691d969a0bd951747886d4a522acba37dd6c408d06cd03cb6c7f56569cf53a4c
- SSDEEP 24576:5pXA4FQoRbeIzW4iEZ31m2Rx2+siA/s8:5p/DiEB1vRYd/
- TLSH T19715F142779716EAE6738D3889A2D312EF32F8560B65D7CF63900EE52D272D01D39B42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions teste.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" teste.exe - Disables Task Manager via registry modification
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools teste.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 3556 teste.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3556 teste.exe 3556 teste.exe 3556 teste.exe 3556 teste.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3556 teste.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\teste.exe"C:\Users\Admin\AppData\Local\Temp\teste.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Disables RegEdit via registry modification
- Looks for VMWare Tools registry key
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3556