Analysis
- user interaction
yes - max time kernel
197s - max time network
198s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
22/10/2026, 18:30
Errors
Reason
Machine shutdown
General
- Target VirusBuilder.exe
- Size 117KB
- Sample261022-w5thasbc49
- SHA256 9ee86ab1d6e4d75901eaf4f2ac91c9032dc0782c36af449185ab12f4ed7a0de6
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Power Settings 1 TTPs 1 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 6 IoCs
- Modifies registry class 58 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 35 IoCs
- Suspicious use of SendNotifyMessage 32 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 39 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\VirusBuilder.exe"C:\Users\Admin\AppData\Local\Temp\VirusBuilder.exe"1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\nasm.dll"nasm.dll" -f bin "C:\Users\Admin\AppData\Local\Temp\8896f636\m.asm" -o "C:\Users\Admin\AppData\Local\Temp\8896f636\m.bin"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bhpc1iyd\bhpc1iyd.cmdline"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES941E.tmp" "c:\Users\Admin\AppData\Local\Temp\fd57fffba2e3487f8a8865247e4294f9\CSCAA186A842269485C9AABE2A890DD05D.TMP"3⤵
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa0327c728,0x7ffa0327c734,0x7ffa0327c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1616,i,6194089794291480497,8952316661420179991,524288 --field-trial-handle=2056,i,15453556093746030469,9109496458445612986,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2192 /prefetch:32⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1760,i,12854027117391092638,12249536391203825961,262144 --field-trial-handle=2056,i,15453556093746030469,9109496458445612986,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2060 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2428,i,15249745199426567683,14342178096741991147,524288 --field-trial-handle=2056,i,15453556093746030469,9109496458445612986,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2580 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3264,i,18174832221468301233,18199998677554524841,2097152 --field-trial-handle=2056,i,15453556093746030469,9109496458445612986,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3280 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3304,i,14389355264477229354,18001748784171193304,2097152 --field-trial-handle=2056,i,15453556093746030469,9109496458445612986,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3328 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4496,i,11127772463582253238,12053590477427385820,2097152 --field-trial-handle=2056,i,15453556093746030469,9109496458445612986,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4516 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4448,i,6598674112430502747,14003507622002017339,2097152 --field-trial-handle=2056,i,15453556093746030469,9109496458445612986,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4760 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4888,i,17843035727033474281,10996536145831355517,524288 --field-trial-handle=2056,i,15453556093746030469,9109496458445612986,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4896 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5540,i,12316442534605555992,1224554418069225552,524288 --field-trial-handle=2056,i,15453556093746030469,9109496458445612986,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5548 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5564,i,18057211259590990884,11335885974998513171,524288 --field-trial-handle=2056,i,15453556093746030469,9109496458445612986,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5652 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5692,i,13847626378110455527,14180769236841645346,524288 --field-trial-handle=2056,i,15453556093746030469,9109496458445612986,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5780 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5780,i,2097009975830225466,5120811666961567543,524288 --field-trial-handle=2056,i,15453556093746030469,9109496458445612986,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5748 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5856,i,8196542473906840682,11192144997624024572,2097152 --field-trial-handle=2056,i,15453556093746030469,9109496458445612986,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5580 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5592,i,9857397871987038727,6167221485079489067,2097152 --field-trial-handle=2056,i,15453556093746030469,9109496458445612986,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4676 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4844,i,17648000644089074823,12752284721385576823,2097152 --field-trial-handle=2056,i,15453556093746030469,9109496458445612986,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4868 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=2464,i,1416234357914873658,1334216099081688356,524288 --field-trial-handle=2056,i,15453556093746030469,9109496458445612986,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5912 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6364,i,13736027455492351021,1499495728716191975,524288 --field-trial-handle=2056,i,15453556093746030469,9109496458445612986,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2552 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4796,i,16735562640466967532,2965168956083477407,524288 --field-trial-handle=2056,i,15453556093746030469,9109496458445612986,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5952 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Downloads\HitDevice.exe"C:\Users\Admin\Downloads\HitDevice.exe"1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /create /f /sc minute /mo 1 /tn "HitDevice" /tr "C:\Users\Admin\AppData\Roaming\HitDevice.exe"2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\powercfg.exe"powercfg" /h off2⤵
- Power Settings
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Z: /s2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Z: /d2⤵
- Enumerates connected drives
-
-
C:\Users\Admin\AppData\Roaming\HitDevice.exeC:\Users\Admin\AppData\Roaming\HitDevice.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2e4 0x2f41⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Power Settings
1Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
33afa66f-f019-4c7f-8d6d-95163a1c3bc6.tmp
8319e3b2-ed23-4c42-b103-bf591256b959.tmp
24f83e85-b016-47d2-a381-25200a27d7e8.tmp
44f36579-4c86-4c78-9141-ede97bee522e.tmp
temp-index
messages.json
craw_background.js
70faaeec-4108-4200-909d-32dad26b0b14.tmp
temp-index
the-real-index
temp-index
the-real-index
index
data_0
data_1
data_2
data_3
CURRENT
MANIFEST-000001
bfa2c206-6cd2-40b0-bc1b-89f8abc93be2.tmp
e219bb11-f785-4c81-848a-44a3fbc97b52.tmp
f83aafff-15c3-4481-85ea-c0274a121347.tmp
a163f9af-6051-4feb-a1b5-8fe7f0ea27e6.tmp
m.asm
m.bin
RES941E.tmp
b81754e4-b0ff-4d9d-8474-fc4004f219ba.tmp
messages.json
HitDevice.exe
bhpc1iyd.0.cs
bhpc1iyd.1.cs
bhpc1iyd.cmdline
CSCAA186A842269485C9AABE2A890DD05D.TMP
app.manifest
memory/4328-460-0x0000000000400000-0x0000000000539000-memory.dmp
memory/4584-5-0x00000000054C0000-0x00000000054CA000-memory.dmp
memory/4584-1-0x0000000005530000-0x0000000005AD4000-memory.dmp
memory/4584-2-0x0000000004F80000-0x0000000005012000-memory.dmp
memory/4584-435-0x0000000005160000-0x0000000005170000-memory.dmp
memory/4584-3-0x0000000005AE0000-0x0000000005CFC000-memory.dmp
memory/4584-4-0x0000000005160000-0x0000000005170000-memory.dmp
memory/4584-410-0x0000000005160000-0x0000000005170000-memory.dmp
memory/4584-8-0x0000000005160000-0x0000000005170000-memory.dmp
memory/4584-6-0x0000000005160000-0x0000000005170000-memory.dmp
memory/4584-0-0x0000000000520000-0x0000000000544000-memory.dmp
memory/4584-7-0x0000000005160000-0x0000000005170000-memory.dmp
memory/5064-494-0x0000000000FB0000-0x0000000000FBC000-memory.dmp