Analysis
- user interaction
yes - max time kernel
899s - max time network
617s - platform
windows11-21h2_x64 - resource
win11-20260911-es - resource tags
- submitted
25/09/2026, 10:51
General
- Target adagnbaerjsdoic.txt
- Size 69B
- Sample260925-mx4tmade89
- SHA256 6b581f741824e733237c8d7232c646d4e2c5209b7c7365795650887e3a1e8fca
Malware Config
Signatures
- Enumerates VirtualBox registry keys 2 TTPs 5 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Downloads MZ/PE file 1 IoCs
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 3 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE 1 IoCs
- Checks system information in the registry 2 TTPs 2 IoCs
System information is often read in order to detect sandboxing environments.
- UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies registry class 2 IoCs
- Opens file in notepad (likely ransom note) 1 IoCs
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious use of AdjustPrivilegeToken 44 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\adagnbaerjsdoic.txt1⤵
- Executes a command shell one-liner
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\adagnbaerjsdoic.txt2⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Modifies registry class
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"1⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w 1 -c . ([type]('Scr'+'iptBl'+'ock'))::Create($env:u8889c8)2⤵
- Badlisted process makes network request
- Downloads MZ/PE file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\{b1f3c8a6-43c7-4278-ac3b-3e42fe659d9c}.exe"C:\Users\Admin\AppData\Local\Temp\{b1f3c8a6-43c7-4278-ac3b-3e42fe659d9c}.exe"3⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Executes dropped EXE
- Checks system information in the registry
- Checks for VirtualBox DLLs, possible anti-VM trick
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
ModuleAnalysisCache
__PSScriptPolicyTest_trh2rgvk.p3a.ps1
{b1f3c8a6-43c7-4278-ac3b-3e42fe659d9c}.exe
memory/2900-29-0x0000027BF8C20000-0x0000027BF96E2000-memory.dmp
memory/2900-32-0x0000027BFAB30000-0x0000027BFB058000-memory.dmp
memory/2900-13-0x0000027BF8C20000-0x0000027BF96E2000-memory.dmp
memory/2900-15-0x0000027BF8C20000-0x0000027BF96E2000-memory.dmp
memory/2900-16-0x0000027BF8C20000-0x0000027BF96E2000-memory.dmp
memory/2900-17-0x0000027BF8C20000-0x0000027BF96E2000-memory.dmp
memory/2900-18-0x0000027BF8C20000-0x0000027BF96E2000-memory.dmp
memory/2900-20-0x0000027BF8C20000-0x0000027BF96E2000-memory.dmp
memory/2900-22-0x0000027BF8C20000-0x0000027BF96E2000-memory.dmp
memory/2900-23-0x0000027BF8C20000-0x0000027BF96E2000-memory.dmp
memory/2900-24-0x0000027BF8C20000-0x0000027BF96E2000-memory.dmp
memory/2900-25-0x0000027BF8C20000-0x0000027BF96E2000-memory.dmp
memory/2900-26-0x0000027BF8C20000-0x0000027BF96E2000-memory.dmp
memory/2900-27-0x0000027BF8C20000-0x0000027BF96E2000-memory.dmp
memory/2900-3-0x0000027BF9A80000-0x0000027BF9AA2000-memory.dmp
memory/2900-30-0x0000027BFA210000-0x0000027BFA25A000-memory.dmp
memory/2900-31-0x0000027BFA430000-0x0000027BFA5F2000-memory.dmp
memory/2900-12-0x0000027BFA170000-0x0000027BFA1B6000-memory.dmp
memory/2900-33-0x0000027BFA1E0000-0x0000027BFA1FE000-memory.dmp
memory/2900-11-0x0000027BF9EF0000-0x0000027BF9FF2000-memory.dmp
memory/2900-10-0x0000027BF9A50000-0x0000027BF9A60000-memory.dmp
memory/2900-2-0x0000027BF9B50000-0x0000027BF9BD2000-memory.dmp
memory/2900-66-0x0000027BF8C20000-0x0000027BF96E2000-memory.dmp
memory/4192-52-0x00007FF7BBCB0000-0x00007FF7BBF45000-memory.dmp
memory/4192-69-0x00007FF7BBCB0000-0x00007FF7BBF45000-memory.dmp
memory/4764-59-0x0000013E9D5F0000-0x0000013E9D60C000-memory.dmp
memory/4764-60-0x0000013E9D610000-0x0000013E9D6C3000-memory.dmp
memory/4764-61-0x0000013E9D590000-0x0000013E9D59A000-memory.dmp
memory/4764-62-0x0000013E9D700000-0x0000013E9D72A000-memory.dmp
memory/4764-64-0x0000013E9D6F0000-0x0000013E9D704000-memory.dmp
memory/4764-63-0x0000013E9D700000-0x0000013E9D724000-memory.dmp
memory/4764-65-0x0000013E9D590000-0x0000013E9D598000-memory.dmp
memory/4764-68-0x0000013E83F30000-0x0000013E849F2000-memory.dmp