Analysis
- max time kernel
148s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 10:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe
- Size 1.0MB
- Sample261002-m2bcwayz8p
- SHA256 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893
- MD5 e5aae38b42c8d88019c8de84e7aea7bd
- SHA1 f5330eba7e9a1cd4076b27e5bac20d550825358f
- SHA512 d7f7a984852d1efd06bea751e37ad475394676d99cbb47521606d82df2e64331e8a1531f2463d409e46ab3016d43ea2fd5e91e68ed5b906f953bf5fe9c6e61cf
- SSDEEP 24576:0U+hmWaC4+6GSk8HPEgUegXLie0rrSCKHlXw:0vJ4+6GSk8HPLUegXLih
- TLSH T11735295BE2B345ECC52FC074C7629772BA70B82946347D2E1E94E7326F21E509B2E724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe - Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe - Checks SCSI registry key(s) 3 TTPs 20 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe - Enumerates system info in registry 2 TTPs 9 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSerialNumber fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5180 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe 5180 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe 5180 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe 5180 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe 5180 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe 5180 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe 5180 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe 5180 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe 5180 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe 5180 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe 5180 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe 5180 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe 5180 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe 5180 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe 5180 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe 5180 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe 5180 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe 5180 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe 5180 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe 5180 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe 5180 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe 5180 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe 5180 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe 5180 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe 5180 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe 5180 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe 5180 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe 5180 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe 5180 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe 5180 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe 5180 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe 5180 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe 5180 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe 5180 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe 5180 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe 5180 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe 5180 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe 5180 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe 5180 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe 5180 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe 5180 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe 5180 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe 5180 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe 5180 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe 5180 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe 5180 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe 5180 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe 5180 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe 5180 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe 5180 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe 5180 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe 5180 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe 5180 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe 5180 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe 5180 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe 5180 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe 5180 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe 5180 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe 5180 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe 5180 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe 5180 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe 5180 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe 5180 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe 5180 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe"C:\Users\Admin\AppData\Local\Temp\fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:5180