cbb717c40b468cb79c28792693847407d261c40d5b1234a097fdc5169c724f73

Analysis

user interaction
yes
max time kernel
65s
max time network
66s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/09/2026, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Get_Latest_Version.exe
Size 790KB
Sample260909-ejjyasag87
SHA256 cbb717c40b468cb79c28792693847407d261c40d5b1234a097fdc5169c724f73
MD5 d14c4210a816bdb7fb08edf1df4700ab
SHA1 399aec6078d384a395205e4812c05f4d75f763f2
SHA512 bb621299a9fc205a7f63ece2792d6040ddad94fcc14eb98dec4d2c7527a3c9256a03bfe179c067d973180cfa18091b75aae831ad698ed5c3b10bd247a031f254
SSDEEP 12288:yysCPtun7tC6l9bDfmbhI9L32lxSF176wuM5Pl33Hkvdmr3TlW:yBtC6lprm1I9L3Exy76wuMBlworj8
TLSH
T143058D55BBA511B9D5E7E0B8C7934213F7BAB859132096DB4390DA793F33AE0263B310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion

Malware Config

Signatures

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	Get_Latest_Version.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	Get_Latest_Version.exe

Executes dropped EXE 1 IoCs

pid	Process
5456	update.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
5456	update.exe
5456	update.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4092 wrote to memory of 5456	4092	Get_Latest_Version.exe	90

C:\Users\Admin\AppData\Local\Temp\Get_Latest_Version.exe
"C:\Users\Admin\AppData\Local\Temp\Get_Latest_Version.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Users\Admin\AppData\Local\Temp\update.exe
  "C:\Users\Admin\AppData\Local\Temp\update.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:5456

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2284

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

update.exe

Path C:\Users\Admin\AppData\Local\Temp\update.exe
Size 39.9MB
SHA256 741822fdcf41496ef6d57744a8dbd609e1776a292e28f1e68d789a826dd88d78
MD5 dad6863854cdba09bf695f0659303b8f
SHA1 0c85ad724fa46e665212ddb5062fcc091d21a6c2
SHA512 28b1e2566bdaf4bd662f7b830a63f585f523eed360913590cedf53fe7b97c597f8fe33aff02c631220b46b45137366e39b151b8df9305b9397f4d6975f2b2251
SSDEEP 786432:6MMiuJ96Q7wSB+lYumhjnySBsj5AcYcQg8YGIRVU2TBDOgN:6wuv9wSWYuYjy7elnz2V1U
TLSH
T1099712DA38E491ECC752C935D24A5AFDF0C938894DB9682FBFC748012634DC6C8A6D76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads