Analysis
- user interaction
yes - max time kernel
30s - max time network
28s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/09/2026, 17:20
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
VMProtect Lite 3.10.4 Build 2668/VMProtect.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
300 seconds
Behavioral task
behavioral2
Sample
VMProtect Lite 3.10.4 Build 2668/VMProtect.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
300 seconds
General
- Target VMProtect Lite 3.10.4 Build 2668/VMProtect.exe
- Size 31.6MB
- Sample260910-vwl67aen4t
- SHA256 138d140584e3d703c3592cc3cd15124b428daee75629e25710b65228103ff817
- MD5 fe633bd52b85a6742aad8cfda32d1ae8
- SHA1 011cbf13a6a2dd8d3607657848032e1d57170c4e
- SHA512 6a0d90cd6c6b03cbf0a44894d3fb682a5c2a0e1cdbf1d507b291ea43dbaae15c4c9207f56439a5a9ae45e1cc88c809d6bb5db023adf27b3afa6480057109d80b
- SSDEEP 786432:pKBjq16XQwb9lcVg1j3ir1PjJU8J19TiDU7oXf:pamAXQ89l8Y4Pt19TiP
- TLSH T1727723966C98475EC4C8C635D1091BFDE2D93CB94D76881B7FC62D022E3AD63CCE1A26
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 5000 VMProtect.exe 5000 VMProtect.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies Control Panel 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Control Panel\Colors VMProtect.exe - Modifies registry class 52 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg VMProtect.exe Set value (data) \REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 VMProtect.exe Set value (data) \REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 VMProtect.exe Set value (data) \REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff VMProtect.exe Key created \REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 VMProtect.exe Key created \REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 VMProtect.exe Set value (data) \REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 820074001c00434653461600310000000000e95c2772120041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbee95c27722a5dd28a2e0000005e000000000002000000000000000000000000000000044311004100700070004400610074006100000042000000 VMProtect.exe Set value (int) \REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\NodeSlot = "2" VMProtect.exe Key created \REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 VMProtect.exe Set value (str) \REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic" VMProtect.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ VMProtect.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ VMProtect.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\ VMProtect.exe Key created \REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell VMProtect.exe Key created \REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU VMProtect.exe Set value (data) \REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f49471a0359723fa74489c55595fe6b30ee0000 VMProtect.exe Set value (data) \REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 5000310000000000e95c237514004c6f63616c003c0009000400efbee95c27722a5dd28a2e00000072000000000002000000000000000000000000000000c56692004c006f00630061006c00000014000000 VMProtect.exe Set value (data) \REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 VMProtect.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\ VMProtect.exe Set value (int) \REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" VMProtect.exe Set value (int) \REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" VMProtect.exe Set value (data) \REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff VMProtect.exe Set value (data) \REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 4e00310000000000e95c517c100054656d7000003a0009000400efbee95c2772e95c517c2e000000730000000000020000000000000000000000000000002be77c00540065006d007000000014000000 VMProtect.exe Set value (data) \REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = 00000000ffffffff VMProtect.exe Set value (int) \REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" VMProtect.exe Set value (int) \REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" VMProtect.exe Set value (data) \REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff VMProtect.exe Set value (data) \REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff VMProtect.exe Set value (data) \REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = 00000000ffffffff VMProtect.exe Set value (data) \REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0 = 8e003100000000002a5dce8a1000564d50524f547e312e3442550000720009000400efbe2a5dce8a2a5dce8a2e00000056c4010000000d0000000000000000000000000000000d97170156004d00500072006f00740065006300740020004c00690074006500200033002e00310030002e00340020004200750069006c0064002000320036003600380000001c000000 VMProtect.exe Set value (data) \REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\MRUListEx = ffffffff VMProtect.exe Key created \REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags VMProtect.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ VMProtect.exe Set value (int) \REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" VMProtect.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\ VMProtect.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\ VMProtect.exe Set value (int) \REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" VMProtect.exe Set value (int) \REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" VMProtect.exe Set value (str) \REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" VMProtect.exe Key created \REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings VMProtect.exe Key created \REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 VMProtect.exe Key created \REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell VMProtect.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ VMProtect.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ VMProtect.exe Key created \REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} VMProtect.exe Set value (data) \REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 VMProtect.exe Set value (int) \REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" VMProtect.exe Key created \REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 VMProtect.exe Key created \REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0 VMProtect.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ VMProtect.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ VMProtect.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\ VMProtect.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 5000 VMProtect.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5000 VMProtect.exe 5000 VMProtect.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5000 VMProtect.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5000 VMProtect.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5000 VMProtect.exe 5000 VMProtect.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\VMProtect Lite 3.10.4 Build 2668\VMProtect.exe"C:\Users\Admin\AppData\Local\Temp\VMProtect Lite 3.10.4 Build 2668\VMProtect.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5000