af0ee048237393752928d984f6fee110ed24b10b0c0db6f6d83b71b9490c1b3e

Analysis

user interaction
yes
max time kernel
149s
max time network
142s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
30/09/2026, 02:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
system.exe
Size 3.3MB
Sample260930-ceyjsattft
SHA256 af0ee048237393752928d984f6fee110ed24b10b0c0db6f6d83b71b9490c1b3e
MD5 0f80a50bff916680d1c0e8c7dceacc00
SHA1 240183183cdca42163f934e0b941e97dbe07949d
SHA512 6f7a255c87057c3331b009c04c488459e3c92569c317c46f83b7fd184ad6505f0edd509cc5555c132dff988f5a3cb55dac8a22187218ffeca62286bcda3c14ef
SSDEEP 49152:bGkx0bjX3bO2q7SAfvq5rnzI2RD8F8aEZczpYD8dhpCVjMVOr7UI:bV0v3iEd5rnzPmDzpYUjCVjSnI
TLSH
T14CF5E14FE641D5CDD7E7953E050529B05A82C86C8FB3AB0D1124B22AFFB72592B3EB44
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

Malware Config

Signatures

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

ioc	Process
\??\VBoxMiniRdrDN	system.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	system.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	system.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	system.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeSystemEnvironmentPrivilege	4572	system.exe

C:\Users\Admin\AppData\Local\Temp\system.exe
"C:\Users\Admin\AppData\Local\Temp\system.exe"
1⤵
- Checks for VirtualBox DLLs, possible anti-VM trick
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:4572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4572-0-0x00007FF74EAE0000-0x00007FF74EE42000-memory.dmp

Download

memory/4572-2-0x0000026EDEFA0000-0x0000026EDEFA1000-memory.dmp

Download

memory/4572-1-0x0000026EDEFA0000-0x0000026EDEFA1000-memory.dmp

Download

memory/4572-3-0x00007FF74EAE0000-0x00007FF74EE42000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads