fd197b5332cc41d847e01fc23e6a57aeba28e85d0d2710b1ecf97fb7cfe9f7ba

Analysis

user interaction
yes
max time kernel
24s
max time network
24s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/10/2026, 08:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
watajudensex.exe
Size 4.4MB
Sample261020-j49rnsbs8m
SHA256 fd197b5332cc41d847e01fc23e6a57aeba28e85d0d2710b1ecf97fb7cfe9f7ba
MD5 a28042f9d76e8abff8972efe05911d79
SHA1 53d9a7b8fd3536c9768c1d179559c037b3f552fa
SHA512 c2695e712553c9d617a4631bf7a3853447b6b80a42e044954d3b541bdde73ae16e675a19f49aa6d7d2bc69d21f4db2a6c635071347518a727cd1f876cce4b0ad
SSDEEP 98304:jAoiV0rrEhSI3UUPMo/Wui0S60Cj4bh+u:pXr6UUPoufS4Mb
TLSH
T1C926CF2C5605F0BCEB87B2328667AB924B54E139C7D349F742444EE3BF129959E33263
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 3 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	watajudensex.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	watajudensex.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	watajudensex.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions	watajudensex.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	watajudensex.exe

Looks for VMWare services registry key. 1 TTPs 1 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmmouse	watajudensex.exe

Deletes itself 1 TTPs 2 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
4204	watajudensex.exe
4204	watajudensex.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	watajudensex.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	watajudensex.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	watajudensex.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	watajudensex.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	watajudensex.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion	watajudensex.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	watajudensex.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	watajudensex.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	watajudensex.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	watajudensex.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4204	watajudensex.exe
4204	watajudensex.exe
4204	watajudensex.exe
4204	watajudensex.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4204	watajudensex.exe

C:\Users\Admin\AppData\Local\Temp\watajudensex.exe
"C:\Users\Admin\AppData\Local\Temp\watajudensex.exe"
1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Deletes itself
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:4204