Analysis
- max time kernel
149s - max time network
135s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
06/09/2026, 19:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe
- Size 6.9MB
- Sample260906-ym8wdada64
- SHA256 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5
- MD5 ff54e2c4b1a278a7f017fcffdad670c1
- SHA1 42fa42b5cb8b6c7c729d8ee8ffb6d0bc8e1d5687
- SHA512 0f83001c7eda97fccdb063e422273f8be44ca803560ef2d0530ae0c2924190ad9f23b23db507d9960aa703c95d391e140a36aff4c3d713dbbe87c35c5752fbb2
- SSDEEP 196608:4NHFTr/Gogf8T4J+0tZwO7vSwdDpvYCbM:4V1rmUcJ+oZkV7
- TLSH T1DB76121BE6A384ECC51FC174C7539AB29E30FC29053479BE19A4D7312F22D909B6EB64
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe - Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe - Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe - Looks for VMWare services registry key. 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4856 wrote to memory of 2632 4856 01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe"C:\Users\Admin\AppData\Local\Temp\01e203fa2b53218a506745d732841cd2430e3fb8b4adf6138f894f5ea4c30eb5.exe"1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:2632
-