0a8018d9d192b8e1cc5891049be35f5527c74c5ecf8d42d62c121ac5d04a1856

Analysis

max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 02:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 515KB
Sample260823-dfphyasbrb
SHA256 0a8018d9d192b8e1cc5891049be35f5527c74c5ecf8d42d62c121ac5d04a1856
MD5 19bd1eb97bc90ce8a518ff4ce47e6df0
SHA1 9eae6f1e84cddb1e39a34929fe53f408af57c2b3
SHA512 03c79ea8692f5f2cf526d2b440a1d2e88f337992fc1febf5d18bf83123e41a30a7745baa403598272229f4299f8656074bc15f80c25c83543ec42607a58c3815
SSDEEP 6144:zbHrhMJiacaKpZ8SEaWiC8QPgZgo02waNFgq80NYEtgRkY2v:xZ8SETiBQ4GPa0Xh
TLSH
T121B48D99F6A403F9E176C274CD879503F7B278481370AADF03E099761F236A25A3E761
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	file.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	file.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	file.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__	file.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	file.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	file.exe

Looks for VMWare services registry key. 1 TTPs 1 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMMEMCTL	file.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor	file.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\CLSID\{69DDB100-16C8-F5D1-CC78-14A54C92AF8B}	file.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\CLSID\{69DDB100-16C8-F5D1-CC78-14A54C92AF8B}\p = "C:\\Users\\Admin\\AppData\\Local\\Temp\\file.exe"	file.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\CLSID\{69DDB100-16C8-F5D1-CC78-14A54C92AF8B}\g = 9bd4f2ee00000000	file.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4336	file.exe
4336	file.exe
4336	file.exe
4336	file.exe
4336	file.exe
4336	file.exe
4336	file.exe
4336	file.exe
4336	file.exe
4336	file.exe
4336	file.exe
4336	file.exe
4336	file.exe
4336	file.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4336-6-0x000001205C4F0000-0x000001205C4F1000-memory.dmp

Download

memory/4336-5-0x000001205C4D0000-0x000001205C4D1000-memory.dmp

Download

memory/4336-7-0x000001205C4F0000-0x000001205C4F1000-memory.dmp

Download