Malwagon
EXE
Data Center.exe File Analysis · first seen Sep 19, 2026 15:34 · 652.0 KB
1proc 1reg 3IOCs
Suspicious35 Completed Public
Get sample Report Sign in

Data Center.exetigerrat analysis report - Suspicious

Run integrity

sample ran

The guest staged the sample and launched it, so what follows describes this file rather than an empty desktop.

35.5sto launch
5telemetry events
4observed
60agent notes

Suspicious

35/100

0 points past the suspicious line at 35, 35 short of malicious at 70.

Clean0-34 Suspicious35-69 Malicious70-100

Why this verdict

+35
Malware family
  • Identified as Tiger RAT (possible confidence, named by static_yara)

Model reading

Measured SUSPICIOUS35 of 100

Evidence ledger above, row by row. Published verdict rests on this column and on nothing to its right.

Model reads it asadvisory, no points NOT ASSESSEDthe model was not asked

Reads this report's derived findings, never the sample itself.

This scan was never submitted to the model. Review runs after the verdict is published, so a scan that completed before this layer existed has nothing stored here. Treat that as a gap in this report's coverage, not a result: no part of the verdict above rests on it, and it is not evidence that the sample is harmless.

Analysis layers

Static ran no points
Dynamic ran no points
Threat intel local feeds only no points
AI not included

Sample

TypeFile
MIMEapplication/vnd.microsoft.portable-executable

Run conditions

Sandbox OSWindows 10
EnvironmentWorkgroup
InternetIsolated
Execution134s
Guest hardware2 vCPU4095 MB RAM

Malware family

1 independent source
Tiger RAT possible

Named by a single source. Treat it as a lead rather than a classification.

LayerSourceWhat it matched
static_yara rule corpus TigerRAT_pe_yaraify

Detection signatures

1 detected · 7 withheld as common
Severity Detection Evidence Layer
MED
Anti-analysis strings present
MITRE T1497
string isdebuggerpresent matched string
static
Withheld: 7 rules fired and were not reported above

These rules matched this sample, and they also match this much of known-clean software (measured over 1145 signed Windows and third-party binaries). A rule that fires on most clean files cannot move a verdict, so it is held back unless the detonation confirms the behaviour. They are listed because a count that shrinks without saying so is not a count an analyst can check.

Timing-based anti-analysis (QueryPerformanceCounter/rdtsc) fires on 92% of benign software
Anti-debugging capability fires on 65% of benign software
Dynamic API resolution (obfuscation) fires on 65% of benign software
Anti-debug: checks for a debugger fires on 60% of benign software
Resolves APIs dynamically (LoadLibrary + GetProcAddress) fires on 49% of benign software
Reads its own startup info (parent/desktop check) fires on 36% of benign software
Enumerates files recursively (staging/collection) fires on 21% of benign software

What the tests returned

8 tests

Each test this run performed and what it returned. A test that was not performed says so rather than reading as a negative result.

TestResult
Persistence mechanismsnone established at runtime
Cross-process injectionnone observed
Payloads written to disknone observed
Network connectionsnot tested - internet was disabled
Behavioural rule matches (Sigma)none observed
Known-malicious hash (reputation sources)no source reported this file
Local anti-virus enginereported no detection
Anti-analysis / evasion checksnot measured on this run - no in-process API monitor reported in, so the runtime anti-debug and anti-VM calls were never watched

Absence of an observation is not proof of absence - see Coverage for what this run could and could not test.

Arguing against malice

  • The local anti-virus engine reported no detection.
  • No reputation source reported this file as malicious.

How much weight this carries

Structure only. Structural evidence only. Nothing matching this verdict was seen running. The one fact that decided it: capability analysis of the file's imports.

Structure

What the file is made of: headers, imports, how it was built and whether it was signed.

Signature
Microsoft Visual C/C++(19.36.34433)[C++]
Not packed Unsigned
CompilerMicrosoft Visual C/C++(19.36.34433)[C++]
LinkerMicrosoft Linker(14.36.34433)
Identity
File
typeexecutable
size652.0 KB
file arch64-bit (x64)
subsystemGUI
entropy4.3068
date2026-06-14 08:19:29 UTC
version6000.4.12.3973735
languageEN

Antivirus engine

no signature matched

Nothing in the signature set below matched this file. That is one engine's negative answer against one signature set on one day, and it is not a verdict. A signature engine only recognises what has already been named and published, so a file nobody has named yet scans exactly like a file that is harmless. What this file does when it runs is the stronger evidence; read the behaviour sections for that.

This run did not record which signature set answered, so the result above cannot be tied to a named set or reproduced against one. Recording the set began part way through this platform's history, and this scan predates it.

Local ML assessment

no model score

This scan ran before the local classifier was installed on this host, so no model score was produced for it. Submitting the same file again produces one.

Structural rules of thumb, not a model. 1 cheap static signal fired, for 10 of 100 on a rule-of-thumb scale that is deliberately left out of the verdict score: the packing, entropy and signing cards on this report already price the same facts, and counting them a second time under a machine-learning heading would charge one piece of evidence twice.

  • unsigned executable
Packing
Not packed
This file's code is readable on disk - nothing is compressed or encrypted around it.
0/100
packer confidence
Static analysis reads this file directly Nothing is hiding the code from a static pass, so what the file contains is what the report shows.
Indicators weighed

No packer indicator fired: the entry point, the section layout and the entropy all read as an ordinary build.

Secrets & malicious strings

1 flagged string

Flagged string categories

anti-analysis / evasion med 1 hit
IndicatorFound inEvidence from the sample
isdebuggerpresent import table KERNEL32.dll!IsDebuggerPresent

Capabilities

4 behaviour buckets · 1 high-risk
SeverityCapabilityMITREAPIs
high Anti-debugging
Detects or obstructs a debugger
 T1622 isdebuggerpresent
med Evasion / stalling
Sleeps, times, or otherwise stalls analysis
 T1497, T1497.003 getsystemtimeasfiletime, queryperformancecounter
med Ransomware behaviour
Enumerates + encrypts files, deletes backups
 T1083 findnextfilew
med Dynamic API resolution
Resolves APIs at runtime (obfuscation)
 T1129 getprocaddress

Security mitigations

partial posture
ON ASLR (DynamicBase)
ON High-entropy ASLR (64-bit)
ON DEP / NX (NxCompat)
OFF Control Flow Guard
OFF SafeSEH
ON Stack cookies (GS)
OFF Force Integrity
OFF AppContainer isolation
OFF Authenticode signed

Rich header (toolchain)

richhash a1c1113c5e427d9a
ToolBuildUses
Utc1900 (VS2017)289005
Export 14.1028900138
Cvtres 14.102890010
Utc1900 (VS2017)289002
Utc1900 (VS2017)343219
Cvtres 14.103432116
Export 14.103432140
Utc1900 (VS2017)344333
Import (linker)089
Export 14.10344332
Alias344331
Implib344331
AliasObj 14.10344331

Sections

6 sections · the file's memory layout
SectionVirtual addrRaw sizeVirtual sizeAccessEntropy
.textEP
Executable code
 0x1000
51.5 KB
51.4 KB
EXECUTEREAD
6.4502
.rdata
Read-only data
 0xe000
38.0 KB
37.9 KB
READ
4.6923
.data
Initialised data
 0x18000
3.0 KB
7.4 KB
expands
READWRITE
1.9077
.pdata
Exception unwind data
 0x1a000
4.0 KB
3.7 KB
READ
4.6021
.rsrc
Resources
 0x1b000
552.5 KB
552.0 KB
READ
3.8814
.reloc
Base relocations
 0xa6000
2.0 KB
1.6 KB
READ
4.8674
code data imports/exports resources metadata packer non-standard Entropy above 7.0 means compressed or encrypted content.

Imports

72 funcs / 2 DLLs · 4 suspicious
▸UnityPlayer.dll1 func
NameFile RVAIs undocumentedMITRE (tactic - technique)
UnityMain2 0x0000e240 - -
▸KERNEL32.dll71 funcs 4 suspicious
NameFile RVAIs undocumentedMITRE (tactic - technique)
HeapAlloc 0x0000e000 - -
WriteConsoleW 0x0000e008 - -
QueryPerformanceCounter 0x0000e010 - T1497
GetCurrentProcessId 0x0000e018 - -
GetCurrentThreadId 0x0000e020 - -
GetSystemTimeAsFileTime 0x0000e028 - -
InitializeSListHead 0x0000e030 - -
RtlCaptureContext 0x0000e038 yes -
RtlLookupFunctionEntry 0x0000e040 yes -
RtlVirtualUnwind 0x0000e048 yes -
IsDebuggerPresent 0x0000e050 - T1622
UnhandledExceptionFilter 0x0000e058 - -
SetUnhandledExceptionFilter 0x0000e060 - -
GetStartupInfoW 0x0000e068 - -
IsProcessorFeaturePresent 0x0000e070 - -
GetModuleHandleW 0x0000e078 - -
CloseHandle 0x0000e080 - -
RtlUnwindEx 0x0000e088 yes -
GetLastError 0x0000e090 - -
SetLastError 0x0000e098 - -
EnterCriticalSection 0x0000e0a0 - -
LeaveCriticalSection 0x0000e0a8 - -
DeleteCriticalSection 0x0000e0b0 - -
InitializeCriticalSectionAndSpinCount 0x0000e0b8 - -
TlsAlloc 0x0000e0c0 - -
TlsGetValue 0x0000e0c8 - -
TlsSetValue 0x0000e0d0 - -
TlsFree 0x0000e0d8 - -
FreeLibrary 0x0000e0e0 - -
GetProcAddress 0x0000e0e8 - T1129
LoadLibraryExW 0x0000e0f0 - -
EncodePointer 0x0000e0f8 - -
RaiseException 0x0000e100 - -
RtlPcToFileHeader 0x0000e108 yes -
GetStdHandle 0x0000e110 - -
WriteFile 0x0000e118 - -
GetModuleFileNameW 0x0000e120 - -
GetCurrentProcess 0x0000e128 - -
ExitProcess 0x0000e130 - -
TerminateProcess 0x0000e138 - -
GetModuleHandleExW 0x0000e140 - -
HeapFree 0x0000e148 - -
FindClose 0x0000e150 - -
FindFirstFileExW 0x0000e158 - -
FindNextFileW 0x0000e160 - T1083
IsValidCodePage 0x0000e168 - -
GetACP 0x0000e170 - -
GetOEMCP 0x0000e178 - -
GetCPInfo 0x0000e180 - -
GetCommandLineA 0x0000e188 - -
GetCommandLineW 0x0000e190 - -
MultiByteToWideChar 0x0000e198 - -
WideCharToMultiByte 0x0000e1a0 - -
GetEnvironmentStringsW 0x0000e1a8 - -
FreeEnvironmentStringsW 0x0000e1b0 - -
SetStdHandle 0x0000e1b8 - -
GetFileType 0x0000e1c0 - -
GetStringTypeW 0x0000e1c8 - -
FlsAlloc 0x0000e1d0 - -
FlsGetValue 0x0000e1d8 - -
FlsSetValue 0x0000e1e0 - -
FlsFree 0x0000e1e8 - -
LCMapStringW 0x0000e1f0 - -
GetProcessHeap 0x0000e1f8 - -
HeapSize 0x0000e200 - -
HeapReAlloc 0x0000e208 - -
FlushFileBuffers 0x0000e210 - -
GetConsoleOutputCP 0x0000e218 - -
GetConsoleMode 0x0000e220 - -
SetFilePointerEx 0x0000e228 - -
CreateFileW 0x0000e230 - -

Binary metadata

what the headers declare about this build
Resource langsEN
Debug infoyes
TLS callbacksno

Code signing

Unsigned

This binary carries no Authenticode signature. Unsigned executables are a weak suspicious signal - most legitimate vendor software is signed.

Similar samples

1 related sample

Ranked by fuzzy hash (TLSH distance - lower is closer) and ssdeep similarity, plus an identical import table. A near-identical neighbour is usually the same build; a variant is the same family rebuilt or repacked.

RelationSampleVerdictWhy it matched
related AoiChan.exe Suspicious identical import table (imphash) · identical export table (exphash)

Threat classification

Signature family candidates
FamilyAgreeing rulesMatched rulesDisposition
Tiger RAT1TigerRAT_pe_yaraify Not a classification: one rule cannot establish a family, so this named nothing and scored nothing.

Capability detection

9 capabilities
CapabilityNamespace
link function at runtime on Windows linking/runtime-linking
parse PE header load-code/pe
contain loop -
terminate process host-interaction/process/terminate
enumerate files on Windows host-interaction/file-system/files/list
query environment variable host-interaction/environment-variable
write file on Windows host-interaction/file-system/write
contains PDB path executable/pe/pdb
reference analysis tools strings anti-analysis
ATT&CK techniques
Discovery::File and Directory Discovery [T1083]Discovery::System Information Discovery [T1082]Execution::Shared Modules [T1129]
Malware Behavior Catalog
Discovery::Analysis Tool Discovery::Process detectionDiscovery::File and Directory DiscoveryDiscovery::System Information DiscoveryFile System::Writes FileProcess::Terminate Process

Signature matches

1 finding · 4 file properties · 0 scored
Rule What it matched Corpus Weight
TigerRAT_pe_yaraify
rule dated 2026-08-21
YARAify-tightened byte rule from 9 sample(s) -- VERIFY hits
1 of 1 string matched
$c0 \x0f\xb6\x08B\x0f\xb6\x14\x00+\xcau\x07H\xff\xc0\x85\xd2u\xed at 0x2b4e
Tier 1 - curated family set
licence-gated and benign-tested; may name a malware family
 SCORED 0
Scored 0: the rule declares no category. No branch of the score model reads it.
Names Tiger RAT, but one rule cannot establish a family: two independent rules must agree, so this named nothing.
File properties - not findings
IsPE64IsWindowsGUIHasDebugDataHasRichSignature

These say what the file IS or holds - bitness, subsystem, an overlay, an embedded macro stream, which compiler built it. Ordinary files match several, and none of them carry weight in the score.

None of the rules above moved the score. The score model reads four rule categories - anti-vm, anti-debug, dropper and packer - and a rule outside them can match, and be worth reading, without being evidence the verdict is built on.

Extracted strings

showing 200 of 313
  • !This program cannot be run in DOS mode.
  • yRichR
  • .text
  • `.rdata
  • @.data
  • .pdata
  • @.rsrc
  • @.reloc
  • ineIA
  • ntelD
  • Genu
  • VWATAVAWH
  • @USVWATAUAVAWH
  • p AWL
  • l$ VWATAVAWH
  • \$ VWATAUAVH
  • ATAUAVH
  • VWATAVAW
  • __cdecl
  • __pascal
  • __stdcall
  • __thiscall
  • __fastcall
  • __vectorcall
  • __clrcall
  • __eabi
  • __restrict
  • __unaligned
  • restrict(
  • delete
  • operator
  • `vftable'
  • `vbtable'
  • `vcall'
  • `typeof'
  • `local static guard'
  • `string'
  • `vbase destructor'
  • `vector deleting destructor'
  • `default constructor closure'
  • `scalar deleting destructor'
  • `vector constructor iterator'
  • `vector destructor iterator'
  • `vector vbase constructor iterator'
  • `virtual displacement map'
  • `eh vector constructor iterator'
  • `eh vector destructor iterator'
  • `eh vector vbase constructor iterator'
  • `copy constructor closure'
  • `udt returning'
  • `RTTI
  • `local vftable'
  • `local vftable constructor closure'
  • delete[]
  • `omni callsig'
  • `placement delete closure'
  • `placement delete[] closure'
  • `managed vector constructor iterator'
  • `managed vector destructor iterator'
  • `eh vector copy constructor iterator'
  • `eh vector vbase copy constructor iterator'
  • `dynamic initializer for '
  • `dynamic atexit destructor for '
  • `vector copy constructor iterator'
  • `vector vbase copy constructor iterator'
  • `managed vector copy constructor iterator'
  • `local static thread guard'
  • operator ""
  • operator co_await
  • operator<=>
  • Type Descriptor'
  • Base Class Descriptor at (
  • Base Class Array'
  • Class Hierarchy Descriptor'
  • Complete Object Locator'
  • `anonymous namespace'
  • FlsAlloc
  • FlsGetValue
  • FlsSetValue
  • InitializeCriticalSectionEx
  • Unknown exception
  • bad exception
  • CorExitProcess
  • Monday
  • Wednesday
  • Thursday
  • Friday
  • Saturday
  • January
  • March
  • April
  • June
  • July
  • August
  • September
  • October
  • November
  • December
  • LCMapStringEx
  • LocaleNameToLCID
  • AppPolicyGetProcessTerminationMethod
  • =imb;D
  • K&>.yC
  • .xJ>Hf
  • C:\build\output\unity\unity\artifacts\WindowsPlayer\Win_x64_VS2022_VB_MT_nondev_i_r\WindowsPlayer_player_Master_il2cpp_x64.pdb
  • .text$mn
  • .text$mn$00
  • .text$mn$21
  • .text$x
  • .idata$5
  • .CRT$XCA
  • .CRT$XCAA
  • .CRT$XCZ
  • .CRT$XIA
  • .CRT$XIAA
  • .CRT$XIAC
  • .CRT$XIC
  • .CRT$XIZ
  • .CRT$XPA
  • .CRT$XPX
  • .CRT$XPXA
  • .CRT$XPZ
  • .CRT$XTA
  • .CRT$XTZ
  • .rdata
  • .rdata$00
  • .rdata$r
  • .rdata$voltmd
  • .rtc$IAA
  • .rtc$IZZ
  • .rtc$TAA
  • .rtc$TZZ
  • .xdata
  • .xdata$x
  • .edata
  • .idata$2
  • .idata$3
  • .idata$4
  • .idata$6
  • .data
  • .data$r
  • .data$rs
  • .bss
  • .rsrc$01
  • .rsrc$02
  • WindowsPlayer.exe
  • AmdPowerXpressRequestHighPerformance
  • D3D12SDKPath
  • D3D12SDKVersion
  • NvOptimusEnablement
  • UnityMain2
  • UnityPlayer.dll
  • QueryPerformanceCounter
  • GetCurrentProcessId
  • GetCurrentThreadId
  • GetSystemTimeAsFileTime
  • InitializeSListHead
  • RtlCaptureContext
  • RtlLookupFunctionEntry
  • IsDebuggerPresent
  • UnhandledExceptionFilter
  • SetUnhandledExceptionFilter
  • GetStartupInfoW
  • IsProcessorFeaturePresent
  • GetModuleHandleW
  • KERNEL32.dll
  • RtlUnwindEx
  • GetLastError
  • SetLastError
  • EnterCriticalSection
  • LeaveCriticalSection
  • DeleteCriticalSection
  • InitializeCriticalSectionAndSpinCount
  • TlsAlloc
  • TlsGetValue
  • TlsSetValue
  • FreeLibrary
  • GetProcAddress
  • LoadLibraryExW
  • EncodePointer
  • RaiseException
  • RtlPcToFileHeader
  • GetStdHandle
  • WriteFile
  • GetModuleFileNameW
  • GetCurrentProcess
  • ExitProcess
  • TerminateProcess
  • GetModuleHandleExW
  • HeapAlloc
  • HeapFree
  • FindClose
  • FindFirstFileExW
  • FindNextFileW
  • IsValidCodePage
  • GetACP
  • GetOEMCP
  • GetCPInfo
  • GetCommandLineA
  • GetCommandLineW

Stack and decoded strings were not recovered: no reason was recorded. Only literal strings present in the file are listed above.

Disassembly

entry point · x64 · 60 insns (listing capped)
AddressBytesMnemonicOperands
0x1400012644883ec28subrsp, 0x28
0x140001268e84b020000call0x1400014b8
0x14000126d4883c428addrsp, 0x28
0x140001271e97afeffffjmp0x1400010f0
0x140001276ccint3
0x140001277ccint3
0x1400012784883ec28subrsp, 0x28
0x14000127ce8ef080000call0x140001b70
0x14000128185c0testeax, eax
0x1400012837421je0x1400012a6
0x14000128565488b042530000000movrax, qword ptr gs:[0x30]
0x14000128e488b4808movrcx, qword ptr [rax + 8]
0x140001292eb05jmp0x140001299
0x140001294483bc8cmprcx, rax
0x1400012977414je0x1400012ad
0x14000129933c0xoreax, eax
0x14000129bf0480fb10d3c780100lock cmpxchgqword ptr [rip + 0x1783c], rcx
0x1400012a475eejne0x140001294
0x1400012a632c0xoral, al
0x1400012a84883c428addrsp, 0x28
0x1400012acc3ret
0x1400012adb001moval, 1
0x1400012afebf7jmp0x1400012a8
0x1400012b1ccint3
0x1400012b2ccint3
0x1400012b3ccint3
0x1400012b44883ec28subrsp, 0x28
0x1400012b885c9testecx, ecx
0x1400012ba7507jne0x1400012c3
0x1400012bcc6052578010001movbyte ptr [rip + 0x17825], 1
0x1400012c3e8dc050000call0x1400018a4
0x1400012c8e8cb0a0000call0x140001d98
0x1400012cd84c0testal, al
0x1400012cf7504jne0x1400012d5
0x1400012d132c0xoral, al
0x1400012d3eb14jmp0x1400012e9
0x1400012d5e8fa420000call0x1400055d4
0x1400012da84c0testal, al
0x1400012dc7509jne0x1400012e7
0x1400012de33c9xorecx, ecx
0x1400012e0e8db0a0000call0x140001dc0
0x1400012e5ebeajmp0x1400012d1
0x1400012e7b001moval, 1
0x1400012e94883c428addrsp, 0x28
0x1400012edc3ret
0x1400012eeccint3
0x1400012efccint3
0x1400012f04053pushrbx
0x1400012f24883ec20subrsp, 0x20
0x1400012f6803dec77010000cmpbyte ptr [rip + 0x177ec], 0
0x1400012fd8bd9movebx, ecx
0x1400012ff7567jne0x140001368
0x14000130183f901cmpecx, 1
0x140001304776aja0x140001370
0x140001306e865080000call0x140001b70
0x14000130b85c0testeax, eax
0x14000130d7428je0x140001337
0x14000130f85dbtestebx, ebx
0x1400013117524jne0x140001337
0x140001313488d0dd6770100learcx, [rip + 0x177d6]
callbranchretstackarithregisterimmediatememory

Screen recording

54 frames · screen recording · 134s
Screen recording frame
1 / 54
0:00 · 1/54
Download this recording Download video (.mp4) Download GIF (.gif) Building the file runs an encode on this platform, so it is kept to signed-in accounts. Signing in brings you back to this report.

Behavior summary

ran 134s

1 process(es) observed

LaunchedC:\Users\user\Desktop\Data_Center.exe
Privilegestandard
Telemetry sources: Kernel ETW (3 of 85 events) Process audit: 1keydiff: 1Autostart diff: 1

Evasion / anti-analysis checks

4 checks
MED
Anti-debug API imports static-api
MITRE T1622 · isdebuggerpresent
MED
Reference analysis tools strings Capability rule
MITRE T1497 · Anti-analysis
MED
Anti-analysis strings (VM/debugger/tool names) strings
MITRE T1497 · isdebuggerpresent
LOW
CPUID hypervisor/feature probe static-instruction
MITRE T1497.001 · 6x cpuid - no timing or descriptor-table instruction beside it

Statically visible checks (RDTSC/CPUID/red-pill instructions, anti-debug APIs) plus runtime evasion signals. Instruction-level interception at runtime requires hypervisor introspection (VMI).

No WMI attributed to the sample. The WMI-Activity trace was running and recorded 929 operations on the machine during the run; none of them came from the sample's process tree.

Command lines, unwrapped

1 read

1 captured text was read and unwrapped locally. No address was recovered from any of them, and none of them was hiding its own contents behind an encoding or a format string. This is a result, not a gap.

Network activity

The network section is a paid-plan layer: the DNS the sample resolved, the connections it opened, the TLS it negotiated, and the rule engine's reading of the capture.

This run was captured, and what it captured is on a paid plan rather than absent. An internet-connected detonation is the same plan, so a paid run also shows what the sample reached rather than only what it tried.

See plans Create an account

Process tree

What ran during the detonation, and what each process did. Select a node to see the activity attributed to it.

1process

Data Center.exe

1 process
1 process

Attributed activity

Not attributed to any process

1 kind

These operations were captured but carry no pid this tree could match, so they are not shown against any node above.

Registry operations2
0Mechanisms found
90Methods checked
0ATT&CK techniques
NONEHighest severity

Persistence mechanisms

clean

No persistence established

None of the 90 auto-start methods below were established during this run.

Detection coverage

0 / 90

Every auto-start method checked on this sample, grouped by family. A method with no result is reported clean, and one the sample only names in its own strings reads "named" rather than "detected".

Logon & Startup 22 clean
  • Active Setup Installed Component T1547.014 clean
  • Explorer Delay-Load Object T1547.001 clean
  • Explorer Run Key T1547.001 clean
  • Explorer SharedTaskScheduler T1547.001 clean
  • Group Policy Extension DLL T1547.004 clean
  • Group Policy Run Key T1547.001 clean
  • Logon Script T1037.001 clean
  • RDP WDS Startup Program T1547.001 clean
  • Registry Run Key T1547.001 clean
  • Registry RunEx Key T1547.001 clean
  • Registry RunOnce Key T1547.001 clean
  • Registry RunOnceEx Key T1547.001 clean
  • Registry RunServices Key T1547.001 clean
  • Startup Folder Item T1547.001 clean
  • Startup Folder Redirection T1547.001 clean
  • Terminal Services Initial Program T1547.001 clean
  • Winlogon GINA DLL T1547.004 clean
  • Winlogon MPNotify Value T1547.004 clean
  • Winlogon Notify Package T1547.004 clean
  • Winlogon Shell Value T1547.004 clean
  • Winlogon Taskman Value T1547.004 clean
  • Winlogon Userinit Value T1547.004 clean
Services & Tasks 9 clean
  • BITS Job T1197 clean
  • Print Monitor DLL T1547.010 clean
  • Print Processor DLL T1547.012 clean
  • Scheduled Task T1053.005 clean
  • Scheduled Task Registry Implant T1053.005 clean
  • Service Control Manager Security Descriptor T1574.011 clean
  • Service DLL Hijack T1543.003 clean
  • Time Provider DLL T1547.003 clean
  • Windows Service Creation T1543.003 clean
Execution Hijack 17 clean
  • .NET Managed Debugger T1546.012 clean
  • Accessibility Tool Hijack T1546.008 clean
  • AeDebug Postmortem Debugger T1546.012 clean
  • App Paths Hijack T1546.012 clean
  • Application Shim Database T1546.011 clean
  • Boot Verification Program T1547.002 clean
  • Command Processor AutoRun T1546.011 clean
  • Explorer Load Value T1547.001 clean
  • Explorer MyComputer Tool Hijack T1546.001 clean
  • Registry Image File Execution Options T1546.012 clean
  • Screensaver Hijack T1546.002 clean
  • Setup ErrorHandler Script T1546 clean
  • Shell Open Command Hijack T1546.001 clean
  • SilentProcessExit Monitor T1546.012 clean
  • Telemetry Controller Command T1546.015 clean
  • WER ReflectDebugger T1546.012 clean
  • Windows Error Reporting Debugger T1546.012 clean
DLL Load Order 12 clean
  • .NET CLR Profiler DLL T1574.012 clean
  • .NET Startup Hook DLL T1574 clean
  • AppCert DLLs T1546.009 clean
  • AppInit DLLs T1546.010 clean
  • AutodialDLL Winsock Injection T1546.006 clean
  • DLL Search-Order Hijack T1574.001 T1574.002 clean
  • DNS Server Plugin DLL T1574.001 clean
  • HTML Help Helper DLL T1546 clean
  • KnownDLLs Manipulation T1574.001 clean
  • Natural Language Platform DLL Override T1546 clean
  • Netsh Helper DLL T1546.007 clean
  • Winsock Layered Service Provider T1546.006 clean
COM & Browser 6 clean
  • Browser Extension T1176 clean
  • Browser Helper Object T1176 clean
  • COM Server Hijack T1546.015 clean
  • HTML Help COM Object Hijack T1546.015 clean
  • Shell Context Menu Handler T1546.001 clean
  • Shell Extension Handler T1546.001 clean
Security Providers & Accounts 11 clean
  • Account RID Hijack T1098 clean
  • AMSI Provider T1562.001 clean
  • Credential Provider T1547.014 clean
  • DSRM Admin Logon Backdoor T1556 clean
  • Hidden Local Account T1136.001 clean
  • LSA Authentication Package T1547.002 clean
  • LSA Extension DLL T1547.005 clean
  • LSA Notification Package T1547.005 clean
  • LSA Security Package T1547.005 clean
  • Network Provider DLL T1556.008 clean
  • Security Support Provider T1547.005 clean
Scripting & Applications 9 clean
  • Netsh Port Proxy T1090.001 clean
  • Office Add-in T1137.006 clean
  • Office Executable Sideload T1574.002 clean
  • Office Startup Template T1137.001 clean
  • Office Test Key T1137.002 clean
  • Power Automate Flow T1546 clean
  • PowerShell Profile T1546.013 clean
  • Windows Terminal Startup Action T1546 clean
  • WMI Event Subscription T1546.003 clean
Boot & Firmware 4 clean
  • BootExecute Native Image T1547.002 clean
  • PlatformExecute Native Image T1547.002 clean
  • SetupExecute Native Image T1547.002 clean
  • UEFI / Bootkit Artifact T1542.003 T1542.001 clean

File activity summary

create 0 write 0 modify 0 delete 0 rename 0

Dropped payload analysis

none kept

The sample ran and none of what it wrote was a payload this run kept and examined. That is a measured absence rather than an unasked question.

File & registry ops

0 file · 1 registry · sample scope
OperationTargetProcess
create
Software\Microsoft\RFC1156Agent\CurrentVersion\Parameters
not the sample
 - pid 2672
setvalue
System\CurrentControlSet\Services\BITS
Start = 3
autostart diff
 -
setvalue
Software\Microsoft\RFC1156Agent\CurrentVersion\Parameters
TrapPollTimeMilliSecs = 15000
read back
 -

External reputation was not produced for this scan. Threat intelligence enrichment is a paid-plan layer: every extracted indicator - hashes, addresses, hostnames - is checked against the external reputation services. Our own ingested feeds ran on this scan and every result below is theirs. Adding the paid layer adds an external reputation verdict on each indicator, so VirusTotal, MalwareBazaar and filescan.io are listed below as not checked. See plans.

1 reported a hit 16 answered no 1 could not answer 5 had nothing to check
1Sources with a hit
18Sources queriedof 23 available
470.6kFeed records
1Could not answer

File reputation

4 clear · 3 not checked
SourceChecksResultDetailFeed
MalwareBazaar hash feed File hash clean not in feed 3,003 records
51 minutes ago
MalwareBazaar ransomware feed File hash clean not in feed 3,348 records
4 hours ago
ThreatFox hash IOCs File hash clean not in feed 1,153 records
51 minutes ago
URLhaus payload hashes File hash clean not in feed 1,680 records
51 minutes ago
filescan.io File hash not checked no hash lookup ran for this scan live lookup
MalwareBazaar File hash not checked no hash lookup ran for this scan live lookup
VirusTotal File hash not checked no hash lookup ran for this scan live lookup

Hash lookups only - the sample itself is never uploaded to any third party.

Network indicators

7 clear · 1 could not answer
SourceChecksResultDetailFeed
URLhaus IP / domain / URL feed unavailable 4 observed indicators, none listed no records ingested
blocklist.de IP / domain / URL clean 4 observed indicators, none listed 27.6k records
51 minutes ago
CINS Army IP / domain / URL clean 4 observed indicators, none listed 15k records
51 minutes ago
Emerging Threats IP / domain / URL clean 4 observed indicators, none listed 482 records
51 minutes ago
Feodo Tracker IP / domain / URL clean 4 observed indicators, none listed 5 records
51 minutes ago
IPsum IP / domain / URL clean 4 observed indicators, none listed 19.7k records
51 minutes ago
Phishing.Database IP / domain / URL clean 4 observed indicators, none listed 391.5k records
4 hours ago
ThreatFox IP / domain / URL clean 4 observed indicators, none listed 1,153 records
51 minutes ago

TLS fingerprints

nothing of this kind to check
SourceChecksResultDetailFeed
JA3 / JA4 fingerprint blocklists JA3 / JA4 not checked no TLS client fingerprint observed 97 records
10 hours ago
SSL blocklist Server certificate not checked no server certificate fingerprint is extracted to check live lookup

Detection rules

1 of 2 listed
SourceChecksResultDetailFeed
Signature rules Sample content 1 match TigerRAT_pe_yaraify 110 records
51 minutes ago
Sigma rules Behavior log clean - 2,275 records
5 hours ago

Tooling catalogs

4 clear
SourceChecksResultDetailFeed
LOLBAS Process image paths clean 1 process image path, none masqueraded 245 records
51 minutes ago
LOLBootloaders File hash clean not a known vulnerable bootloader 520 records
50 minutes ago
LOLDrivers File hash clean not a known vulnerable driver 2,333 records
51 minutes ago
LOLRMM Names and domains clean 2 name/domain indicators checked, no remote-management tooling 360 records
50 minutes ago

AI analysis

The AI layer is a paid-plan feature. It reads what the other layers produced - the behaviour summary, the call sequence, the indicator list - and writes the narrative and the kill-chain walkthrough.

Nothing is being withheld. This layer did not run for this scan, so there is no result stored behind the lock.

See plans Create an account

0 malicious 0 suspicious 3 info

File indicators

3
SeverityTypeIndicatorDescription
info sample_sha256 69de4ce220de733703e51b8c2d6f88360161db9bdd267da425ad9aa577bf4feb Submitted sample (SHA256)
info sample_md5 01354f21c96008740b92ea9a28fd52e7 Submitted sample (MD5)
info imphash a136217cdd3247ff6a8766561064ca0b Import table hash (imphash)

Sigma detections

0 matches of 2275 rules

The Sigma corpus was evaluated against this run's processes, registry, file, network, DNS and script activity. Nothing matched.

Generated rules

Sigma: auto_file_2451_sigma_reg

Auto-generated
title: Auto-generated registry behavior rule (sandbox scan 2451)
id: sandbox-auto-2451-reg
status: experimental
description: Auto-generated from sandbox scan 2451
logsource:
    category: registry_event
    product: windows
detection:
    selection:
        TargetObject|contains:
            - 'Software\Microsoft\RFC1156Agent\CurrentVersion\Parameters'
    condition: selection
level: medium

YARA: auto_file_2451_yara

Auto-generated
rule auto_file_2451_yara
{
    meta:
        description = "Auto-generated from scan 2451"
        author = "sandbox auto-generator"
        imphash = "a136217cdd3247ff6a8766561064ca0b"
        anchors = "5 independent regions"
    strings:
        $s0 = "WindowsPlayer.exe" ascii fullword
        $s1 = "api-ms-win-core-datetime-l1-1-1" wide fullword
        $s2 = "AppPolicyGetProcessTerminationMethod" ascii fullword
        $s3 = "api-ms-win-core-xstate-l2-1-0" wide fullword
        $s4 = "api-ms-win-core-fibers-l1-1-1" wide fullword
    condition:
        uint16(0) == 0x5a4d and filesize < 2670592 and all of them
}

Extracted files

What came out of the sample: unpacked payloads, carved objects and captured memory. Each one is stored by content hash, so the same object extracted twice is the same row.

No extracted files

Nothing was unpacked or carved out of this sample. Packed samples, documents with embedded objects and installers are the ones that usually produce artifacts here.

Export & download

/s/2451

Structured exports for your SIEM/TIP - ATT&CK Navigator layer, STIX 2.1 bundle, MISP event and a defanged IOC list - are free on every report. The packet capture follows this scan's plan, because a capture is the rawest network output this platform produces.

AI analysis report

An enterprise report with an AI-written executive summary, threat assessment, kill chain, and recommendations, plus the derived evidence (verdict, MITRE ATT&CK, network, file modifications, dropped files, IOCs) and screenshots. The AI narrative is built from derived analysis data only, so the raw sample never leaves the host (no-upload and AI-boundary preserved).

Public analyses of this file

1 run
SubmittedEnvironmentVerdictScore
2026-09-19 15:34 Shown below Windows 10 22H2 Suspicious 35/100