8c9a1e6494f5b785fe8ef557ef51c78310d8d93516e690e546b48fd828f5dbbc

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8c9a1e6494f5b785fe8ef557ef51c78310d8d93516e690e546b48fd828f5dbbc.exe
Size 170KB
Sample261030-e57w9av1ax
SHA256 8c9a1e6494f5b785fe8ef557ef51c78310d8d93516e690e546b48fd828f5dbbc
MD5 fb59376dec3fd0c803a7e3593a0d3b97
SHA1 16d29cc9e5adc68dc45fc72cf8e3b2605306117d
SHA512 bf7d180396a3f3239e8ccb11ceca6979f99e13af9a57a9f95ecc7c0bd6e7925b9a0bb09534db3ca78052023519e136e0e161c3c0f21c72d43da7a87ce9bfabaa
SSDEEP 3072:+WJfI6LA1fX58xKEQjWYAeTJTGYmsw+6Y57dLDbpuiZ:vypNpsC+sw56Z
TLSH
T199047D95B3A911F6E1A3823CC9954B06F77278260720DBEF03A44775AF272D19D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion

Malware Config

Signatures

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	8c9a1e6494f5b785fe8ef557ef51c78310d8d93516e690e546b48fd828f5dbbc.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	8c9a1e6494f5b785fe8ef557ef51c78310d8d93516e690e546b48fd828f5dbbc.exe

C:\Users\Admin\AppData\Local\Temp\8c9a1e6494f5b785fe8ef557ef51c78310d8d93516e690e546b48fd828f5dbbc.exe
"C:\Users\Admin\AppData\Local\Temp\8c9a1e6494f5b785fe8ef557ef51c78310d8d93516e690e546b48fd828f5dbbc.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
PID:1340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1340-0-0x000001FBB7B40000-0x000001FBB7B41000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads