0a8bc6819cb893de5c62d2aa51362ec19c38815535efabb759cb0442756caf37

Analysis

user interaction
yes
max time kernel
26s
max time network
23s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/08/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
أداه 2.rar
Size 1.9MB
Sample260821-e6mbyagm7w
SHA256 0a8bc6819cb893de5c62d2aa51362ec19c38815535efabb759cb0442756caf37
MD5 6fff9efa46e2825de64449e9be5745d4
SHA1 4e107683f6844778a05cf9e22b25e1f8708c286b
SHA512 d2e76f94bf7084a9d5ddd6225ebb3c364332d1dd875dcda85750d6f7e1e1a3d7a1aae0e912173675be43d2df899afecff285f546d14ac45f4dcb54ebba5c074d
SSDEEP 49152:jU8o7wu7a5MtxSMe9wxy3kn9tHPm9yK9oIZGwcNbYKOJ:oEeeMjF5xwkn9tH+9n9xZGwubFA
TLSH
T14A9533A90730C4CEFB0797CD771B6B233CA10494ADBD476B94F7688891D49EA22C9E19
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery ransomware themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	P2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	P2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	P2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	P2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	P2.exe

Checks BIOS information in registry 2 TTPs 10 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	P2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	P2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	P2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	P2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	P2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	P2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	P2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	P2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	P2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	P2.exe

Executes dropped EXE 5 IoCs

pid	Process
3984	P2.exe
3784	P2.exe
4396	P2.exe
824	P2.exe
3348	P2.exe

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/files/0x000300000001e6ef-4.dat	themida

Checks whether UAC is enabled 1 TTPs 5 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	P2.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	P2.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	P2.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	P2.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	P2.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

pid	Process
3984	P2.exe
3784	P2.exe
4396	P2.exe
824	P2.exe
3348	P2.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	P2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	P2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	P2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	P2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	P2.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	7zFM.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
1436	NOTEPAD.EXE
4328	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3984	P2.exe
3984	P2.exe
3784	P2.exe
3784	P2.exe
4396	P2.exe
4396	P2.exe
824	P2.exe
824	P2.exe
3348	P2.exe
3348	P2.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4432	7zFM.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeRestorePrivilege	4432	7zFM.exe
Token: 35	4432	7zFM.exe
Token: SeSecurityPrivilege	4432	7zFM.exe
Token: SeSecurityPrivilege	4432	7zFM.exe
Token: SeSecurityPrivilege	4432	7zFM.exe
Token: SeSecurityPrivilege	4432	7zFM.exe
Token: SeSecurityPrivilege	4432	7zFM.exe
Token: SeSecurityPrivilege	4432	7zFM.exe
Token: SeSecurityPrivilege	4432	7zFM.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
4432	7zFM.exe
4432	7zFM.exe
4432	7zFM.exe
4432	7zFM.exe
4432	7zFM.exe
4432	7zFM.exe
4432	7zFM.exe
4432	7zFM.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4432 wrote to memory of 3984	4432	7zFM.exe	90
PID 4432 wrote to memory of 1436	4432	7zFM.exe	100
PID 4432 wrote to memory of 4328	4432	7zFM.exe	101
PID 4432 wrote to memory of 3784	4432	7zFM.exe	102
PID 4432 wrote to memory of 4396	4432	7zFM.exe	103
PID 4432 wrote to memory of 824	4432	7zFM.exe	104
PID 4432 wrote to memory of 3348	4432	7zFM.exe	105

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\أداه 2.rar"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4432
- C:\Users\Admin\AppData\Local\Temp\7zO051EBB58\P2.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO051EBB58\P2.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3984
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7zO051F0898\paoR.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1436
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7zO05147A98\paoR.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4328
- C:\Users\Admin\AppData\Local\Temp\7zO0519DE98\P2.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO0519DE98\P2.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3784
- C:\Users\Admin\AppData\Local\Temp\7zO0514B388\P2.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO0514B388\P2.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4396
- C:\Users\Admin\AppData\Local\Temp\7zO051BE588\P2.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO051BE588\P2.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:824
- C:\Users\Admin\AppData\Local\Temp\7zO05155988\P2.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO05155988\P2.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

paoR.txt

Path C:\Users\Admin\AppData\Local\Temp\7zO05147A98\paoR.txt
Size 277B
SHA256 fac52c509c45cc00f237756a2bd16b4205bb79cad5834b2e28e8023d5cd17c79
MD5 d84e90b0952027d923bf18d00c1bad8d
SHA1 91e5680eda863f76f597c9c7d3c98d7f973a7b42
SHA512 97ae02c78876b999694f5bc96aeecbe34730f0811345e4aa1972e40378a76a9c6e555376dcc3d56f521dfb53d536e59da227c7a8ab1db8813d17c9fbfbe54d66
TLSH
T10ED02BCA4F1E40989788C678C0E33A409CF1BC23E599CC023063428DEB53163F58C13C
MD5 SHA1 SHA512 TLSH

Submit Download

P2.exe

Path C:\Users\Admin\AppData\Local\Temp\7zO051EBB58\P2.exe
Size 2.0MB
SHA256 652aab2d537e3d581b2b58ace9733ee3ee8e9500143bc9e28d5caa4bfc7f8b25
MD5 3bc8f2226f3502ed98803525e4eb6c4f
SHA1 daf795a5012d382ef06029b33d3661ec04d773d0
SHA512 96c6c98bac3222e623ba90e30a1cdc74b3f93e6c22e672e3e73a27acb29830b418c2e6b4c4b1c2a0c709f8bbf788c6e0bdabb0e5c8c5c4eefe6e1b28790aa0eb
SSDEEP 49152:OM+doxUyNlh3Kx1yVg0lj5lch3vqpcwrJT6C32SlUi:OvKxUyNmSVg0lXcpvdM9B3L
TLSH
T10B95339448412D30D9F0FF320D16FAA78DADDC595224C013AB8FEFDA53961E68D29BC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/824-64-0x0000000000400000-0x00000000009E8000-memory.dmp

Download

memory/3348-74-0x0000000000400000-0x00000000009E8000-memory.dmp

Download

memory/3784-41-0x0000000000400000-0x00000000009E8000-memory.dmp

Download

memory/3984-17-0x0000000000400000-0x00000000009E8000-memory.dmp

Download

memory/3984-22-0x0000000076470000-0x0000000076560000-memory.dmp

Download

memory/3984-15-0x0000000076470000-0x0000000076560000-memory.dmp

Download

memory/3984-13-0x0000000076470000-0x0000000076560000-memory.dmp

Download

memory/3984-18-0x0000000076490000-0x0000000076491000-memory.dmp

Download

memory/3984-19-0x0000000076470000-0x0000000076560000-memory.dmp

Download

memory/3984-20-0x0000000076470000-0x0000000076560000-memory.dmp

Download

memory/3984-10-0x0000000076490000-0x0000000076491000-memory.dmp

Download

memory/3984-23-0x0000000076470000-0x0000000076560000-memory.dmp

Download

memory/3984-14-0x0000000076470000-0x0000000076560000-memory.dmp

Download

memory/3984-12-0x0000000076470000-0x0000000076560000-memory.dmp

Download

memory/3984-9-0x0000000000400000-0x00000000009E8000-memory.dmp

Download

memory/3984-11-0x0000000076470000-0x0000000076560000-memory.dmp

Download

memory/4396-53-0x0000000000400000-0x00000000009E8000-memory.dmp

Download