50f0a5a8fd7dd5da7ad6e4f3b37cb25d6218f101c9b46579dcbb0d30fcb814d3

Analysis

max time kernel
149s
max time network
161s
platform
windows11-21h2_x64
resource
win11-20260130-de
resource tags

arch:x64arch:x86image:win11-20260130-delocale:de-deos:windows11-21h2-x64systemwindows
submitted
07/05/2026, 09:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
voyupuSpark.exe
Size 180.0MB
Sample260507-lvvbqsaz7v
SHA256 50f0a5a8fd7dd5da7ad6e4f3b37cb25d6218f101c9b46579dcbb0d30fcb814d3
MD5 6000dca3553c969f967556f57a672053
SHA1 89534ee3ea15bacc0f410c745899f936f5d36806
SHA512 ced51c5e3cbd978d45557594a8e32e9c00816778703a83182c5200b8829280ba62840f21202fa8107893fadb9b698fd2540a57978aee88cf56bf77eae00e4a3c
SSDEEP 1572864:IH0f0gqxb0WBFh/LVO9dyKcRmAswCXj5EtV4ga5h0q2ZOADpAyK5/Y3P8kbVr+qI:9sok+hK7
TLSH
T1DC988C03F39A50D9E01DD1B58B9B9633EAB1B8854324A2DF27540B512F77EE86B3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	86095db8e974d477.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	86095db8e974d477.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	86095db8e974d477.exe

Executes dropped EXE 1 IoCs

pid	Process
4380	86095db8e974d477.exe

Themida packer 5 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral11/files/0x001d00000002b5af-56.dat	themida
behavioral11/memory/4380-61-0x0000000140000000-0x0000000140859000-memory.dmp	themida
behavioral11/memory/4380-60-0x0000000140000000-0x0000000140859000-memory.dmp	themida
behavioral11/memory/4380-59-0x0000000140000000-0x0000000140859000-memory.dmp	themida
behavioral11/memory/4380-68-0x0000000140000000-0x0000000140859000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	86095db8e974d477.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	voyupuSpark.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	voyupuSpark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	voyupuSpark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	voyupuSpark.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	voyupuSpark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	voyupuSpark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	voyupuSpark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	voyupuSpark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	voyupuSpark.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	voyupuSpark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	voyupuSpark.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	voyupuSpark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	voyupuSpark.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	voyupuSpark.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	voyupuSpark.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	voyupuSpark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	voyupuSpark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	voyupuSpark.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	voyupuSpark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	voyupuSpark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	voyupuSpark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	voyupuSpark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	voyupuSpark.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	voyupuSpark.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4400	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4132	powershell.exe
4132	powershell.exe
2480	powershell.exe
2480	powershell.exe
4380	86095db8e974d477.exe
4380	86095db8e974d477.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeDebugPrivilege	4132	powershell.exe
Token: SeShutdownPrivilege	4796	voyupuSpark.exe
Token: SeCreatePagefilePrivilege	4796	voyupuSpark.exe
Token: SeIncreaseQuotaPrivilege	4132	powershell.exe
Token: SeSecurityPrivilege	4132	powershell.exe
Token: SeTakeOwnershipPrivilege	4132	powershell.exe
Token: SeLoadDriverPrivilege	4132	powershell.exe
Token: SeSystemProfilePrivilege	4132	powershell.exe
Token: SeSystemtimePrivilege	4132	powershell.exe
Token: SeProfSingleProcessPrivilege	4132	powershell.exe
Token: SeIncBasePriorityPrivilege	4132	powershell.exe
Token: SeCreatePagefilePrivilege	4132	powershell.exe
Token: SeBackupPrivilege	4132	powershell.exe
Token: SeRestorePrivilege	4132	powershell.exe
Token: SeShutdownPrivilege	4132	powershell.exe
Token: SeDebugPrivilege	4132	powershell.exe
Token: SeSystemEnvironmentPrivilege	4132	powershell.exe
Token: SeRemoteShutdownPrivilege	4132	powershell.exe
Token: SeUndockPrivilege	4132	powershell.exe
Token: SeManageVolumePrivilege	4132	powershell.exe
Token: 33	4132	powershell.exe
Token: 34	4132	powershell.exe
Token: 35	4132	powershell.exe
Token: 36	4132	powershell.exe
Token: SeDebugPrivilege	4400	taskkill.exe
Token: SeShutdownPrivilege	4796	voyupuSpark.exe
Token: SeCreatePagefilePrivilege	4796	voyupuSpark.exe
Token: SeDebugPrivilege	2480	powershell.exe
Token: SeShutdownPrivilege	4796	voyupuSpark.exe
Token: SeCreatePagefilePrivilege	4796	voyupuSpark.exe
Token: SeShutdownPrivilege	4796	voyupuSpark.exe
Token: SeCreatePagefilePrivilege	4796	voyupuSpark.exe
Token: SeShutdownPrivilege	4796	voyupuSpark.exe
Token: SeCreatePagefilePrivilege	4796	voyupuSpark.exe
Token: SeShutdownPrivilege	4796	voyupuSpark.exe
Token: SeCreatePagefilePrivilege	4796	voyupuSpark.exe
Token: SeShutdownPrivilege	4796	voyupuSpark.exe
Token: SeCreatePagefilePrivilege	4796	voyupuSpark.exe
Token: SeShutdownPrivilege	4796	voyupuSpark.exe
Token: SeCreatePagefilePrivilege	4796	voyupuSpark.exe
Token: SeShutdownPrivilege	4796	voyupuSpark.exe
Token: SeCreatePagefilePrivilege	4796	voyupuSpark.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 4292	4796	voyupuSpark.exe	78
PID 4796 wrote to memory of 4292	4796	voyupuSpark.exe	78
PID 4796 wrote to memory of 4908	4796	voyupuSpark.exe	79
PID 4908 wrote to memory of 4132	4908	cmd.exe	81
PID 4796 wrote to memory of 2548	4796	voyupuSpark.exe	83
PID 2548 wrote to memory of 1856	2548	cmd.exe	85
PID 1856 wrote to memory of 4272	1856	net.exe	86
PID 4796 wrote to memory of 5244	4796	voyupuSpark.exe	87
PID 5244 wrote to memory of 4400	5244	cmd.exe	89
PID 4796 wrote to memory of 2480	4796	voyupuSpark.exe	90
PID 4796 wrote to memory of 3096	4796	voyupuSpark.exe	91
PID 4796 wrote to memory of 4380	4796	voyupuSpark.exe	93

C:\Users\Admin\AppData\Local\Temp\voyupuSpark.exe
"C:\Users\Admin\AppData\Local\Temp\voyupuSpark.exe"
1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Users\Admin\AppData\Local\Temp\voyupuSpark.exe
  "C:\Users\Admin\AppData\Local\Temp\voyupuSpark.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\voyupuspark-uj83" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1688,i,2988998935884941570,13516716586956288884,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1724 /prefetch:2
  2⤵
  PID:4292
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -EncodedCommand RwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIABXAGkAbgAzADIAXwBWAGkAZABlAG8AQwBvAG4AdAByAG8AbABsAGUAcgAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBFAHgAcABhAG4AZABQAHIAbwBwAGUAcgB0AHkAIABOAGEAbQBlAA=="
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4908
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -EncodedCommand RwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIABXAGkAbgAzADIAXwBWAGkAZABlAG8AQwBvAG4AdAByAG8AbABsAGUAcgAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBFAHgAcABhAG4AZABQAHIAbwBwAGUAcgB0AHkAIABOAGEAbQBlAA==
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2548
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1856
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:4272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM SecHealthUI.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5244
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM SecHealthUI.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -EncodedCommand dAByAHkAIAB7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAJwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAH0AIABjAGEAdABjAGgAIAB7AH0A
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2480
- C:\Users\Admin\AppData\Local\Temp\voyupuSpark.exe
  "C:\Users\Admin\AppData\Local\Temp\voyupuSpark.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=de --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\voyupuspark-uj83" --field-trial-handle=1792,i,2988998935884941570,13516716586956288884,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1648 /prefetch:11
  2⤵
  PID:3096
- C:\Users\Admin\AppData\Local\Temp\86095db8e974d477.exe
  C:\Users\Admin\AppData\Local\Temp\86095db8e974d477.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  PID:4380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 7f8f97ee615f534fb3a3d4ab1d554cd33b788f10c559754714d1e7ce0726b362
MD5 a71e351e0584693771a3e1ab5ed855ee
SHA1 5bbadb2db8240a293fce7bf6a965634703e51aa4
SHA512 95148933c9fc727c3f88c9b5a0bd489f660bc0b24b3cb8b8e6e7ffbec937810d473cf57ff0c8a34075ce7f822f0c007be8893daa409738cd4782ab526bb5a185
TLSH
T18B71EE323375B0D4C9663F07192C1AC463BF4396EA58AF4CB658521ED92710BDB222F7
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3aefde46e083e91df5137feac534ebaa7d1d9cf6aaf96e151f6afd402c0c565e
MD5 0d34e64b104c61ed6aa1e0424a3dc1e6
SHA1 f7ef151c09b8d3c103fd13dfe55c3ca1473fdd84
SHA512 08e7f2fb78c4d86e2bcb7c263c77cc7f72fd4465bac876e953073ee30c3719160ae3dc2f7c9b6f8f52ab2293071bb02aec428d9e2dcc796c4c3c3b012b2fd8b9
TLSH
T1BB218B33B79DC165C8D9117A20CCAD10B275C3C744DECF8B2A84C228A97F5DADB945E4
MD5 SHA1 SHA512 TLSH

Submit Download

86095db8e974d477.exe

Path C:\Users\Admin\AppData\Local\Temp\86095db8e974d477.exe
Size 3.5MB
SHA256 844dc9bcfb1978454b38aae3586989a81468bfcb7cf3dd707241efc19663ba33
MD5 da3d099489657ee75c5f6875255b1f5f
SHA1 2f938babc6e7a133dbbc49896354711ecf840f66
SHA512 4bb7d61409351980efc9e18f5e78c7d3f88d771292bfbaf408fe745bb7d650a971c7f6a42e44c8b659cf09a78cf10bb8ce2db88837a1b8fc38d8c7656d4aa5d7
SSDEEP 98304:yWnqkt3kvhOc84A+pK63kWHYY1tnR2j5Gnsncu:yGVGvw4A+hkWtfnR21Gqt
TLSH
T17F06330B77C54F5DE76891393F843221D2FB659C16564B7EAEBF88079DEC2261A83B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_cb4pptzc.kie.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cb4pptzc.kie.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2480-49-0x00000288F91C0000-0x00000288F91CA000-memory.dmp

Download

memory/2480-51-0x00000288E0200000-0x00000288E020C000-memory.dmp

Download

memory/2480-52-0x00000288E0270000-0x00000288E0282000-memory.dmp

Download

memory/2480-48-0x00000288F9160000-0x00000288F9166000-memory.dmp

Download

memory/2480-47-0x00000288F9130000-0x00000288F9138000-memory.dmp

Download

memory/2480-46-0x00000288F91E0000-0x00000288F91FA000-memory.dmp

Download

memory/2480-45-0x00000288F9120000-0x00000288F912A000-memory.dmp

Download

memory/2480-44-0x00000288F9140000-0x00000288F915C000-memory.dmp

Download

memory/2480-43-0x00000288F9170000-0x00000288F91BA000-memory.dmp

Download

memory/3096-63-0x0000026078740000-0x00000260787EE000-memory.dmp

Download

memory/4132-22-0x000001D02C0A0000-0x000001D02C0C4000-memory.dmp

Download

memory/4132-10-0x000001D02B770000-0x000001D02B780000-memory.dmp

Download

memory/4132-27-0x000001D013420000-0x000001D01342C000-memory.dmp

Download

memory/4132-24-0x000001D02B9E0000-0x000001D02B9E8000-memory.dmp

Download

memory/4132-23-0x000001D02C090000-0x000001D02C0A6000-memory.dmp

Download

memory/4132-2-0x000001D02B780000-0x000001D02B806000-memory.dmp

Download

memory/4132-21-0x000001D02C0A0000-0x000001D02C0CA000-memory.dmp

Download

memory/4132-20-0x000001D02BAC0000-0x000001D02BACA000-memory.dmp

Download

memory/4132-19-0x000001D02B9F0000-0x000001D02BAA3000-memory.dmp

Download

memory/4132-18-0x000001D02B9D0000-0x000001D02B9EC000-memory.dmp

Download

memory/4132-11-0x000001D02BAE0000-0x000001D02BBE4000-memory.dmp

Download

memory/4132-28-0x000001D02B6F0000-0x000001D02B702000-memory.dmp

Download

memory/4132-3-0x000001D02B740000-0x000001D02B762000-memory.dmp

Download

memory/4292-64-0x000002D2AA0C0000-0x000002D2AA16E000-memory.dmp

Download

memory/4380-60-0x0000000140000000-0x0000000140859000-memory.dmp

Download

memory/4380-61-0x0000000140000000-0x0000000140859000-memory.dmp

Download

memory/4380-59-0x0000000140000000-0x0000000140859000-memory.dmp

Download

memory/4380-68-0x0000000140000000-0x0000000140859000-memory.dmp

Download

memory/4380-67-0x0000000001F30000-0x0000000001FDE000-memory.dmp

Download

memory/4380-74-0x0000000001F30000-0x0000000001FDE000-memory.dmp

Download

memory/4796-62-0x0000026EED8D0000-0x0000026EED97E000-memory.dmp

Download

memory/4796-65-0x0000026EED8D0000-0x0000026EED97E000-memory.dmp

Download