b8aa14b5f1b5b7a07180b490104f78d17abee506a635c94a6c014f33860203f7

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/10/2026, 12:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bin/windivert.exe
Size 7.8MB
Sample261020-pxp2kshv8x
SHA256 b8aa14b5f1b5b7a07180b490104f78d17abee506a635c94a6c014f33860203f7
MD5 7162333f9481f23070e9607372e6eece
SHA1 ebc8cfb4981d00d6cc9c7152dbfe07e54ae10c87
SHA512 3b67a29105c813b801637faa3a22ada8e7d427046295ddd1c8378eba969c4dae59d4b8be6ddb4cfa88992aff8c9123eb500e520506828e2c36bdfe9d2ed3f4c2
SSDEEP 98304:YKaeG7DVgjKddg15b6xI0DPnLMv7oEVyII+/xdNX6ZTH:PG19d88xI0j4v7kII+fN0
TLSH
T14F86F123A9916778C45AE1354622D022F762FC582B2593F3798DB2783B337F496B4BC1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Signatures

Looks for VirtualBox executables on disk 2 TTPs 2 IoCs

File and Directory Discovery

T1083

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	C:\Windows\System32\VBoxService.exe	windivert.exe
File opened (read-only)	C:\Windows\System32\VBoxTray.exe	windivert.exe

C:\Users\Admin\AppData\Local\Temp\bin\windivert.exe
"C:\Users\Admin\AppData\Local\Temp\bin\windivert.exe"
1⤵
- Looks for VirtualBox executables on disk
PID:2412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

File and Directory Discovery

T1083

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads