8ca2c6237e72f889bfebceea0e6bd6ff9e45971634e2e42f81ae10210190b35c

Analysis

max time kernel
150s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 19:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Installer_v2031_x64.exe
Size 18.2MB
Sample260804-ybnfascr2w
SHA256 8ca2c6237e72f889bfebceea0e6bd6ff9e45971634e2e42f81ae10210190b35c
MD5 6298b4c940c1e0bf262085e1179200d8
SHA1 a044818fa82141901838f7845bdacec35da0952e
SHA512 a79fc7154a9d2730e46a050d59f5c6b984de50f56c380731960f0ae5f9fecaa18d1fa084fcbadbeaf3afc0c934a6cc0e1456751336cda4058b31f1c7c4acccc0
SSDEEP 393216:8EaMWJSyP1zq3603bKaQGfBiuVn8NVy1cwKih8/t9eWEBbgFB6qFRi:8Eabt+HkasgsgcwKihW9eWEBbgBi
TLSH
T10E173336B208DA78EE0341F1F60CDE84EDD55B07A4BC7741A205D6AF6D74A82F69B603
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion execution persistence privilege_escalation themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Installer_v2031_x64.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1212	powershell.exe
256	powershell.exe
1212	powershell.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Installer_v2031_x64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Installer_v2031_x64.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MemoryServices.lnk	AuthResultController.exe

Executes dropped EXE 2 IoCs

pid	Process
1064	AuthResultController.exe
5884	services.exe

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/memory/2136-10-0x0000000000400000-0x0000000001DBA000-memory.dmp	themida
behavioral2/memory/2136-11-0x0000000000400000-0x0000000001DBA000-memory.dmp	themida
behavioral2/memory/2136-63-0x0000000000400000-0x0000000001DBA000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Installer_v2031_x64.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2136	Installer_v2031_x64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4928	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	services.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	services.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4820	timeout.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1212	powershell.exe
1212	powershell.exe
256	powershell.exe
256	powershell.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeDebugPrivilege	2136	Installer_v2031_x64.exe
Token: SeDebugPrivilege	1212	powershell.exe
Token: SeIncreaseQuotaPrivilege	1212	powershell.exe
Token: SeSecurityPrivilege	1212	powershell.exe
Token: SeTakeOwnershipPrivilege	1212	powershell.exe
Token: SeLoadDriverPrivilege	1212	powershell.exe
Token: SeSystemProfilePrivilege	1212	powershell.exe
Token: SeSystemtimePrivilege	1212	powershell.exe
Token: SeProfSingleProcessPrivilege	1212	powershell.exe
Token: SeIncBasePriorityPrivilege	1212	powershell.exe
Token: SeCreatePagefilePrivilege	1212	powershell.exe
Token: SeBackupPrivilege	1212	powershell.exe
Token: SeRestorePrivilege	1212	powershell.exe
Token: SeShutdownPrivilege	1212	powershell.exe
Token: SeDebugPrivilege	1212	powershell.exe
Token: SeSystemEnvironmentPrivilege	1212	powershell.exe
Token: SeRemoteShutdownPrivilege	1212	powershell.exe
Token: SeUndockPrivilege	1212	powershell.exe
Token: SeManageVolumePrivilege	1212	powershell.exe
Token: 33	1212	powershell.exe
Token: 34	1212	powershell.exe
Token: 35	1212	powershell.exe
Token: 36	1212	powershell.exe
Token: SeIncreaseQuotaPrivilege	1212	powershell.exe
Token: SeSecurityPrivilege	1212	powershell.exe
Token: SeTakeOwnershipPrivilege	1212	powershell.exe
Token: SeLoadDriverPrivilege	1212	powershell.exe
Token: SeSystemProfilePrivilege	1212	powershell.exe
Token: SeSystemtimePrivilege	1212	powershell.exe
Token: SeProfSingleProcessPrivilege	1212	powershell.exe
Token: SeIncBasePriorityPrivilege	1212	powershell.exe
Token: SeCreatePagefilePrivilege	1212	powershell.exe
Token: SeBackupPrivilege	1212	powershell.exe
Token: SeRestorePrivilege	1212	powershell.exe
Token: SeShutdownPrivilege	1212	powershell.exe
Token: SeDebugPrivilege	1212	powershell.exe
Token: SeSystemEnvironmentPrivilege	1212	powershell.exe
Token: SeRemoteShutdownPrivilege	1212	powershell.exe
Token: SeUndockPrivilege	1212	powershell.exe
Token: SeManageVolumePrivilege	1212	powershell.exe
Token: 33	1212	powershell.exe
Token: 34	1212	powershell.exe
Token: 35	1212	powershell.exe
Token: 36	1212	powershell.exe
Token: SeDebugPrivilege	256	powershell.exe
Token: SeDebugPrivilege	5884	services.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 1212	2136	Installer_v2031_x64.exe	89
PID 2136 wrote to memory of 256	2136	Installer_v2031_x64.exe	92
PID 256 wrote to memory of 1064	256	powershell.exe	94
PID 1064 wrote to memory of 5884	1064	AuthResultController.exe	95
PID 1064 wrote to memory of 4928	1064	AuthResultController.exe	96
PID 4928 wrote to memory of 4820	4928	cmd.exe	98

C:\Users\Admin\AppData\Local\Temp\Installer_v2031_x64.exe
"C:\Users\Admin\AppData\Local\Temp\Installer_v2031_x64.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath @('C:\Users\Admin\AppData\Local\Temp\Installer_v2031_x64.exe','C:\Users\Admin\AppData\Local','C:\Users\Admin\AppData\Roaming','C:\Users\Admin\AppData\Local','C:\Users\Admin\AppData\Roaming','RuntimeBroker.exe','InstallUtil.exe','AppLaunch.exe','dwm.exe','svchost.exe','explorer.exe','services.exe','schtasks.exe','conhost.exe'); Add-MpPreference -ExclusionProcess @('C:\Users\Admin\AppData\Local\Temp\Installer_v2031_x64.exe','RuntimeBroker.exe','InstallUtil.exe','AppLaunch.exe','dwm.exe','svchost.exe','explorer.exe','services.exe','schtasks.exe','conhost.exe','wscript.exe','ioextender.exe','AuthResultController.exe')"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1212
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -WindowStyle Hidden Start-Process 'C:\Users\Admin\AppData\Roaming\MemoryServices\03254x10024\AuthResultController.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:256
- - C:\Users\Admin\AppData\Roaming\MemoryServices\03254x10024\AuthResultController.exe
    "C:\Users\Admin\AppData\Roaming\MemoryServices\03254x10024\AuthResultController.exe"
    3⤵
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1064
  - - C:\Users\Admin\AppData\Roaming\MemoryServices\03254x10024\services.exe
      "C:\Users\Admin\AppData\Roaming\MemoryServices\03254x10024\services.exe"
      4⤵
      Executes dropped EXE
      Checks processor information in registry
      Suspicious use of AdjustPrivilegeToken
      PID:5884
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qmu6f8fu.bat""
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4928
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 3 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:4820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 6c02c1b39aa9cee3f5070f8c43d40e4651efa2843940ca2258392312a9c63501
MD5 20dcb9e6f10b55f805803ad82be91a84
SHA1 5773f3b583d55fdf5680f7cc8be0c5ebade6f534
SHA512 d9fb4478d091d5b93c178c698a85c437904419658ac9234dd25f7244b0010dd070e13ac5391441d44472dae4bddf462275d833d21caed22f786330d023b9abc7
TLSH
T1E8216837F3DC8610C89A413A10CDAC1036B6C7DB80DECFAB7B85E659A42F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_1zodytsp.d3l.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1zodytsp.d3l.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

qmu6f8fu.bat

Path C:\Users\Admin\AppData\Local\Temp\qmu6f8fu.bat
Size 272B
SHA256 1f104b167d40a738f1ef58ec9e83fa2313c80601afddc8e7020d46c8b81bb19c
MD5 f83ed9a67ac0ee6bb07de42ea5416a39
SHA1 f3f97d3a7816495cfb4319b08bf4ca8553e61703
SHA512 6adaeef56ade2226870daece8c4697edabe5a584a5dc7e90b194867e8b4f02e31c4113d638d5425be1086f801edf85f2abe44fc14b526e89b91f4d5bb03116b3
TLSH
T1E2D02E0412AF0BC8390224628FBF60BC106658A10E8C36034A82089E31C58A864A79E1
MD5 SHA1 SHA512 TLSH

Submit Download

AuthResultController.exe

Path C:\Users\Admin\AppData\Roaming\MemoryServices\03254x10024\AuthResultController.exe
Size 543KB
SHA256 244fedbff5602e71fde67eaafb60ff2817283cb8ea2cbf2d3c623625d5358ad8
MD5 dc5bd98343f8683698ce2252d4132d12
SHA1 4807b68df604a616e7cfb5496bcfb5e4a99c3adb
SHA512 508b69727340aaed80ef8062a2bc037b7496093efbc0b6455ef9a8266a356751edfaaae35b9af0a85c13501f25f72413a59a35e5b97a411852d5c665cf6c111e
SSDEEP 6144:hLOj8PexofXr6WLcMToEJH4/o4HxS1m2bh7+HPMIC7mVs4dwPGCIOOiz+:hLWa7dvY/poLbh9ICws8hCq
TLSH
T12BC43A1BB6464D60C1845733E1E7800037F0958676F7EA8E398E13CA5D137FBAD8AA97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install.dat

Path C:\Users\Admin\AppData\Roaming\MemoryServices\03254x10024\install.dat
Size 70B
SHA256 875811a0d8ad5169d155ae9d12ddd67446521873bdaeeacf83e380d2847e1aec
MD5 4fd853e23b04ae38b0302acbaad1b8d4
SHA1 e8c07d3b4cc278d78520f3d0ec5b20e5c8757635
SHA512 1772ba6bbeb79ce4417b9804566209472061a5ba04c88c65e6825e634ac4e54686bdd9557f381e3b71b29d964302345aa0efca07b7d42060a7739f9943787e19
TLSH
T16BA0025002EF8B6D780394931E7B705C49664A516FEC3A05AFD1985D71C4D9CB895036
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1064-54-0x000001BE83910000-0x000001BE8392E000-memory.dmp

Download

memory/1064-52-0x000001BE83990000-0x000001BE83A06000-memory.dmp

Download

memory/1064-49-0x000001BE82010000-0x000001BE82064000-memory.dmp

Download

memory/1064-46-0x000001BE81B20000-0x000001BE81BAC000-memory.dmp

Download

memory/1212-27-0x00007FFC92810000-0x00007FFC931B4000-memory.dmp

Download

memory/1212-34-0x00007FFC92810000-0x00007FFC931B4000-memory.dmp

Download

memory/1212-15-0x000001FAECC00000-0x000001FAECC22000-memory.dmp

Download

memory/1212-17-0x00007FFC92810000-0x00007FFC931B4000-memory.dmp

Download

memory/1212-18-0x00007FFC92810000-0x00007FFC931B4000-memory.dmp

Download

memory/1212-19-0x00007FFC92810000-0x00007FFC931B4000-memory.dmp

Download

memory/1212-20-0x00007FFC92810000-0x00007FFC931B4000-memory.dmp

Download

memory/1212-23-0x000001FAECEA0000-0x000001FAECEBE000-memory.dmp

Download

memory/1212-24-0x000001FAECEC0000-0x000001FAECF72000-memory.dmp

Download

memory/1212-25-0x000001FAECF80000-0x000001FAECF8A000-memory.dmp

Download

memory/1212-26-0x00007FFC92810000-0x00007FFC931B4000-memory.dmp

Download

memory/1212-31-0x00007FFC92810000-0x00007FFC931B4000-memory.dmp

Download

memory/1212-28-0x00007FFC92810000-0x00007FFC931B4000-memory.dmp

Download

memory/1212-29-0x00007FFC92810000-0x00007FFC931B4000-memory.dmp

Download

memory/1212-30-0x00007FFC92810000-0x00007FFC931B4000-memory.dmp

Download

memory/2136-10-0x0000000000400000-0x0000000001DBA000-memory.dmp

Download

memory/2136-8-0x00007FFC92810000-0x00007FFC931B4000-memory.dmp

Download

memory/2136-16-0x00007FFC92810000-0x00007FFC931B4000-memory.dmp

Download

memory/2136-47-0x00007FFC92810000-0x00007FFC931B4000-memory.dmp

Download

memory/2136-39-0x0000000000400000-0x0000000001DBA000-memory.dmp

Download

memory/2136-12-0x00007FFC92810000-0x00007FFC931B4000-memory.dmp

Download

memory/2136-11-0x0000000000400000-0x0000000001DBA000-memory.dmp

Download

memory/2136-9-0x00007FFC92810000-0x00007FFC931B4000-memory.dmp

Download

memory/2136-32-0x00007FFC92810000-0x00007FFC931B4000-memory.dmp

Download

memory/2136-0-0x0000000000400000-0x0000000001DBA000-memory.dmp

Download

memory/2136-36-0x000000001F110000-0x000000001FED2000-memory.dmp

Download

memory/2136-7-0x00007FFC92810000-0x00007FFC931B4000-memory.dmp

Download

memory/2136-6-0x00007FFC9299F000-0x00007FFC929A0000-memory.dmp

Download

memory/2136-1-0x00007FFC80000000-0x00007FFC80002000-memory.dmp

Download

memory/2136-60-0x00007FFC92810000-0x00007FFC931B4000-memory.dmp

Download

memory/2136-2-0x00007FFC80030000-0x00007FFC80031000-memory.dmp

Download

memory/2136-63-0x0000000000400000-0x0000000001DBA000-memory.dmp

Download

memory/2136-64-0x00007FFC92810000-0x00007FFC931B4000-memory.dmp

Download

memory/2136-65-0x00007FFC92810000-0x00007FFC931B4000-memory.dmp

Download