995ed821ea164668fb7744183b39cace5adc913f03a15014d6a08500b6ccfb04

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 02:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 513KB
Sample260823-cs4mysdn6t
SHA256 995ed821ea164668fb7744183b39cace5adc913f03a15014d6a08500b6ccfb04
MD5 357e95b07d7fd0151e74fb6195987bb8
SHA1 139997a7e16727f9e907f489ef59df59e7f48124
SHA512 3f9f883a3e3267ad5f158df08b2cf75c1af57ddbcd0b6e10a2fdd9dadc905a88b381f37979cb6993b854a3e1e151dde2da8c3259c6b53ba0b97c78efdff9ea3f
SSDEEP 6144:6edVxAw777HKu694PEhpAbl14JkyA2Kj+lzS961vqy9TJr0R5V3luJSdrw:1694PCpMcCUsgvlNJUf7Fw
TLSH
T171B48D98F6A403F9E176C278CD875503F7B278481370AADF03E499761F236A25A3E761
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	file.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	file.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	file.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__	file.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	file.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	file.exe

Looks for VMWare services registry key. 1 TTPs 1 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMMEMCTL	file.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor	file.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	file.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\CLSID\{B882E3E9-90B4-8F8A-1D27-464CCAEED5D0}	file.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\CLSID\{B882E3E9-90B4-8F8A-1D27-464CCAEED5D0}\p = "C:\\Users\\Admin\\AppData\\Local\\Temp\\file.exe"	file.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\CLSID\{B882E3E9-90B4-8F8A-1D27-464CCAEED5D0}\g = 99d86a4f00000000	file.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4960	file.exe
4960	file.exe
4960	file.exe
4960	file.exe
4960	file.exe
4960	file.exe
4960	file.exe
4960	file.exe
4960	file.exe
4960	file.exe
4960	file.exe
4960	file.exe
4960	file.exe
4960	file.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4960-6-0x00000233C3540000-0x00000233C3541000-memory.dmp

Download

memory/4960-5-0x00000233C3530000-0x00000233C3531000-memory.dmp

Download