Analysis
- user interaction
yes - max time kernel
781s - max time network
783s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
28/08/2026, 18:58
General
- Target $PLUGINSDIR/System.dll
- Size 12KB
- Sample260828-xmkccasdnc
- SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
Malware Config
Signatures
- Enumerates VirtualBox registry keys 2 TTPs 10 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs
- Badlisted process makes network request 24 IoCs
Network request originating from process or tool commonly abused by malware.
- Looks for VMWare Tools registry key 2 TTPs 2 IoCs
- Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE 2 IoCs
- Checks system information in the registry 2 TTPs 4 IoCs
System information is often read in order to detect sandboxing environments.
- Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Enumerates system info in registry 2 TTPs 6 IoCs
- Suspicious behavior: EnumeratesProcesses 24 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#12⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 4603⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2036 -ip 20361⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"1⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\00d916\fe00045e.exe"C:\Users\Admin\AppData\Local\00d916\fe00045e.exe"2⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Executes dropped EXE
- Checks system information in the registry
- Checks for VirtualBox DLLs, possible anti-VM trick
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"1⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\468c8e\25684a6b.exe"C:\Users\Admin\AppData\Local\468c8e\25684a6b.exe"2⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Executes dropped EXE
- Checks system information in the registry
- Checks for VirtualBox DLLs, possible anti-VM trick
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
fe00045e.exe
powershell.exe.log
ModuleAnalysisCache
StartupProfileData-Interactive
__PSScriptPolicyTest_0ur0pq5h.wsf.ps1
ConsoleHost_history.txt
590aee7bdd69b59b.customDestinations-ms
590aee7bdd69b59b.customDestinations-ms
memory/720-134-0x0000000750000000-0x0000000750295000-memory.dmp
memory/720-133-0x0000000750000000-0x0000000750295000-memory.dmp
memory/2332-39-0x000002B5933B0000-0x000002B593E72000-memory.dmp
memory/2332-20-0x000002B5933B0000-0x000002B593E72000-memory.dmp
memory/2332-24-0x000002B5933B0000-0x000002B593E72000-memory.dmp
memory/2332-26-0x000002B5933B0000-0x000002B593E72000-memory.dmp
memory/2332-28-0x000002B5933B0000-0x000002B593E72000-memory.dmp
memory/2332-29-0x000002B5933B0000-0x000002B593E72000-memory.dmp
memory/2332-30-0x000002B5933B0000-0x000002B593E72000-memory.dmp
memory/2332-31-0x000002B5933B0000-0x000002B593E72000-memory.dmp
memory/2332-32-0x000002B5933B0000-0x000002B593E72000-memory.dmp
memory/2332-35-0x000002B5933B0000-0x000002B593E72000-memory.dmp
memory/2332-36-0x000002B5933B0000-0x000002B593E72000-memory.dmp
memory/2332-37-0x000002B5933B0000-0x000002B593E72000-memory.dmp
memory/2332-21-0x000002B5933B0000-0x000002B593E72000-memory.dmp
memory/2332-41-0x000002B5933B0000-0x000002B593E72000-memory.dmp
memory/2332-43-0x000002B5AC920000-0x000002B5ACAE2000-memory.dmp
memory/2332-50-0x000002B5AC750000-0x000002B5AC76C000-memory.dmp
memory/2332-2-0x000002B5AC170000-0x000002B5AC192000-memory.dmp
memory/2332-52-0x000002B5AC280000-0x000002B5AC28A000-memory.dmp
memory/2332-53-0x000002B5AC830000-0x000002B5AC84C000-memory.dmp
memory/2332-54-0x000002B5AC290000-0x000002B5AC29A000-memory.dmp
memory/2332-55-0x000002B5AC870000-0x000002B5AC88A000-memory.dmp
memory/2332-56-0x000002B5AC2A0000-0x000002B5AC2A8000-memory.dmp
memory/2332-57-0x000002B5AC850000-0x000002B5AC856000-memory.dmp
memory/2332-58-0x000002B5AC860000-0x000002B5AC86A000-memory.dmp
memory/2332-9-0x000002B5AC230000-0x000002B5AC276000-memory.dmp
memory/2332-68-0x000002B5933B0000-0x000002B593E72000-memory.dmp
memory/2332-71-0x000002B5933B0000-0x000002B593E72000-memory.dmp
memory/2332-18-0x000002B5933B0000-0x000002B593E72000-memory.dmp
memory/2332-17-0x000002B5933B0000-0x000002B593E72000-memory.dmp
memory/2332-14-0x000002B5933B0000-0x000002B593E72000-memory.dmp
memory/2332-13-0x000002B5933B0000-0x000002B593E72000-memory.dmp
memory/2332-12-0x000002B5933B0000-0x000002B593E72000-memory.dmp
memory/2332-10-0x000002B5933B0000-0x000002B593E72000-memory.dmp
memory/2332-23-0x000002B5933B0000-0x000002B593E72000-memory.dmp
memory/2332-51-0x000002B5AC770000-0x000002B5AC823000-memory.dmp
memory/4428-98-0x0000000750000000-0x0000000750295000-memory.dmp
memory/4428-96-0x0000000750000000-0x0000000750295000-memory.dmp
memory/4428-90-0x0000000750000000-0x0000000750295000-memory.dmp
memory/4428-89-0x0000000750000000-0x0000000750295000-memory.dmp
memory/4428-97-0x0000000750000000-0x0000000750295000-memory.dmp
memory/4428-99-0x0000000750000000-0x0000000750295000-memory.dmp
memory/4592-114-0x00000118AC4A0000-0x00000118ACF62000-memory.dmp
memory/4592-137-0x00000118AC4A0000-0x00000118ACF62000-memory.dmp
memory/4592-88-0x00000118AC4A0000-0x00000118ACF62000-memory.dmp
memory/4592-101-0x00000118AC4A0000-0x00000118ACF62000-memory.dmp
memory/4592-102-0x00000118AC4A0000-0x00000118ACF62000-memory.dmp
memory/4592-110-0x00000118C57F0000-0x00000118C58A3000-memory.dmp
memory/4592-111-0x00000118AC4A0000-0x00000118ACF62000-memory.dmp
memory/4592-113-0x00000118AC4A0000-0x00000118ACF62000-memory.dmp
memory/4592-94-0x00000118AC4A0000-0x00000118ACF62000-memory.dmp
memory/4592-115-0x00000118AC4A0000-0x00000118ACF62000-memory.dmp
memory/4592-116-0x00000118AC4A0000-0x00000118ACF62000-memory.dmp
memory/4592-117-0x00000118AC4A0000-0x00000118ACF62000-memory.dmp
memory/4592-119-0x00000118AC4A0000-0x00000118ACF62000-memory.dmp
memory/4592-120-0x00000118AC4A0000-0x00000118ACF62000-memory.dmp
memory/4592-121-0x00000118AC4A0000-0x00000118ACF62000-memory.dmp
memory/4592-93-0x00000118AC4A0000-0x00000118ACF62000-memory.dmp
memory/4592-91-0x00000118AC4A0000-0x00000118ACF62000-memory.dmp
memory/4592-153-0x00000118AC4A0000-0x00000118ACF62000-memory.dmp
memory/4592-136-0x00000118AC4A0000-0x00000118ACF62000-memory.dmp
memory/4592-95-0x00000118AC4A0000-0x00000118ACF62000-memory.dmp
memory/4592-138-0x00000118AC4A0000-0x00000118ACF62000-memory.dmp
memory/4592-139-0x00000118AC4A0000-0x00000118ACF62000-memory.dmp
memory/4592-140-0x00000118AC4A0000-0x00000118ACF62000-memory.dmp
memory/4592-141-0x00000118AC4A0000-0x00000118ACF62000-memory.dmp
memory/4592-142-0x00000118AC4A0000-0x00000118ACF62000-memory.dmp
memory/4592-144-0x00000118AC4A0000-0x00000118ACF62000-memory.dmp
memory/4592-146-0x00000118AC4A0000-0x00000118ACF62000-memory.dmp
memory/4592-147-0x00000118AC4A0000-0x00000118ACF62000-memory.dmp
memory/4592-148-0x00000118AC4A0000-0x00000118ACF62000-memory.dmp
memory/4592-149-0x00000118AC4A0000-0x00000118ACF62000-memory.dmp
memory/4592-151-0x00000118AC4A0000-0x00000118ACF62000-memory.dmp
memory/4592-135-0x00000118AC4A0000-0x00000118ACF62000-memory.dmp
memory/4592-154-0x00000118AC4A0000-0x00000118ACF62000-memory.dmp
memory/4592-156-0x00000118AC4A0000-0x00000118ACF62000-memory.dmp
memory/4592-166-0x00000118C6600000-0x00000118C6B28000-memory.dmp
memory/4592-168-0x00000118C5EA0000-0x00000118C5EA8000-memory.dmp
memory/4592-169-0x00000118C6F30000-0x00000118C6F68000-memory.dmp
memory/4592-170-0x00000118C65C0000-0x00000118C65CE000-memory.dmp
memory/4592-171-0x00000118CA2F0000-0x00000118CA478000-memory.dmp