e28c19d9dab46ec3e8a44ad67b5aa5c0727299086aedc25df24b96738c42c58b

Analysis

max time kernel
149s
max time network
72s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 01:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LauncherV31182x64.exe
Size 18.5MB
Sample260814-b7tkvssvby
SHA256 e28c19d9dab46ec3e8a44ad67b5aa5c0727299086aedc25df24b96738c42c58b
MD5 af1aece27721f73910b410db827c3fd5
SHA1 c2231044e9b8ddb191060edca0655cb40bf675c1
SHA512 533ef7dd79ffcee081b9fda22a80b754a1206035ceba991bf5f830461c8021e4fd9da8a4b7f8b07d43439fd4f85f5506b190e7c6c957f1541b837c8837a99efa
SSDEEP 393216:0o1h1t7f/xtK1uULNsYmCekH/J3obKZD+zbZgNYHU022AUz:0AfxA3xsfkfVUlge002E
TLSH
T1291733F964B5AF16D4E6DBBE67839095CF7CFC1145434EEA59F0B8AA4A14880303C4BD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion execution persistence privilege_escalation themida trojan

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 4 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	services.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	services.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	NullCacheAuth.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	NullCacheAuth.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	LauncherV31182x64.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	NullCacheAuth.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	services.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
6888	powershell.exe
6340	powershell.exe
6888	powershell.exe

Looks for VMWare Tools registry key 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	services.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	NullCacheAuth.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	LauncherV31182x64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	LauncherV31182x64.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ShortcutsControl.lnk	NullCacheAuth.exe

Executes dropped EXE 2 IoCs

pid	Process
6444	NullCacheAuth.exe
2944	services.exe

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/memory/4560-8-0x0000000000400000-0x0000000001E60000-memory.dmp	themida
behavioral2/memory/4560-9-0x0000000000400000-0x0000000001E60000-memory.dmp	themida
behavioral2/memory/4560-63-0x0000000000400000-0x0000000001E60000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	LauncherV31182x64.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4560	LauncherV31182x64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6244	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	services.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	services.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
1396	timeout.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
6888	powershell.exe
6888	powershell.exe
6340	powershell.exe
6340	powershell.exe
6340	powershell.exe
6444	NullCacheAuth.exe
6444	NullCacheAuth.exe
2944	services.exe
2944	services.exe

Suspicious use of AdjustPrivilegeToken 47 IoCs

description	pid	Process
Token: SeDebugPrivilege	4560	LauncherV31182x64.exe
Token: SeDebugPrivilege	6888	powershell.exe
Token: SeIncreaseQuotaPrivilege	6888	powershell.exe
Token: SeSecurityPrivilege	6888	powershell.exe
Token: SeTakeOwnershipPrivilege	6888	powershell.exe
Token: SeLoadDriverPrivilege	6888	powershell.exe
Token: SeSystemProfilePrivilege	6888	powershell.exe
Token: SeSystemtimePrivilege	6888	powershell.exe
Token: SeProfSingleProcessPrivilege	6888	powershell.exe
Token: SeIncBasePriorityPrivilege	6888	powershell.exe
Token: SeCreatePagefilePrivilege	6888	powershell.exe
Token: SeBackupPrivilege	6888	powershell.exe
Token: SeRestorePrivilege	6888	powershell.exe
Token: SeShutdownPrivilege	6888	powershell.exe
Token: SeDebugPrivilege	6888	powershell.exe
Token: SeSystemEnvironmentPrivilege	6888	powershell.exe
Token: SeRemoteShutdownPrivilege	6888	powershell.exe
Token: SeUndockPrivilege	6888	powershell.exe
Token: SeManageVolumePrivilege	6888	powershell.exe
Token: 33	6888	powershell.exe
Token: 34	6888	powershell.exe
Token: 35	6888	powershell.exe
Token: 36	6888	powershell.exe
Token: SeIncreaseQuotaPrivilege	6888	powershell.exe
Token: SeSecurityPrivilege	6888	powershell.exe
Token: SeTakeOwnershipPrivilege	6888	powershell.exe
Token: SeLoadDriverPrivilege	6888	powershell.exe
Token: SeSystemProfilePrivilege	6888	powershell.exe
Token: SeSystemtimePrivilege	6888	powershell.exe
Token: SeProfSingleProcessPrivilege	6888	powershell.exe
Token: SeIncBasePriorityPrivilege	6888	powershell.exe
Token: SeCreatePagefilePrivilege	6888	powershell.exe
Token: SeBackupPrivilege	6888	powershell.exe
Token: SeRestorePrivilege	6888	powershell.exe
Token: SeShutdownPrivilege	6888	powershell.exe
Token: SeDebugPrivilege	6888	powershell.exe
Token: SeSystemEnvironmentPrivilege	6888	powershell.exe
Token: SeRemoteShutdownPrivilege	6888	powershell.exe
Token: SeUndockPrivilege	6888	powershell.exe
Token: SeManageVolumePrivilege	6888	powershell.exe
Token: 33	6888	powershell.exe
Token: 34	6888	powershell.exe
Token: 35	6888	powershell.exe
Token: 36	6888	powershell.exe
Token: SeDebugPrivilege	6340	powershell.exe
Token: SeDebugPrivilege	6444	NullCacheAuth.exe
Token: SeDebugPrivilege	2944	services.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4560 wrote to memory of 6888	4560	LauncherV31182x64.exe	88
PID 4560 wrote to memory of 6340	4560	LauncherV31182x64.exe	91
PID 6340 wrote to memory of 6444	6340	powershell.exe	93
PID 6444 wrote to memory of 2944	6444	NullCacheAuth.exe	95
PID 6444 wrote to memory of 6244	6444	NullCacheAuth.exe	96
PID 6244 wrote to memory of 1396	6244	cmd.exe	98

C:\Users\Admin\AppData\Local\Temp\LauncherV31182x64.exe
"C:\Users\Admin\AppData\Local\Temp\LauncherV31182x64.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath @('C:\Users\Admin\AppData\Local\Temp\','C:\Users\Admin\AppData\Local\Temp\LauncherV31182x64.exe','C:\Users\Admin\AppData\Local','C:\Users\Admin\AppData\Roaming','C:\Users\Admin\AppData\Local','C:\Users\Admin\AppData\Roaming','RuntimeBroker.exe','AppLaunch.exe','dwm.exe','svchost.exe','explorer.exe','services.exe','schtasks.exe','conhost.exe'); Add-MpPreference -ExclusionProcess @('C:\Users\Admin\AppData\Local\Temp\LauncherV31182x64.exe','RuntimeBroker.exe','InstallUtil.exe','AppLaunch.exe','dwm.exe','svchost.exe','explorer.exe','services.exe','schtasks.exe','conhost.exe','wscript.exe','concheck.exe','pathmsil.exe','ioextender.exe','NullCacheAuth.exe')"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6888
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -WindowStyle Hidden Start-Process 'C:\Users\Admin\AppData\Local\Temp\\NullCacheAuth.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:6340
- - C:\Users\Admin\AppData\Local\Temp\NullCacheAuth.exe
    "C:\Users\Admin\AppData\Local\Temp\NullCacheAuth.exe"
    3⤵
    - Enumerates VirtualBox registry keys
    - Looks for VirtualBox Guest Additions in registry
    - Looks for VMWare Tools registry key
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:6444
  - - C:\Users\Admin\AppData\Roaming\ShortcutsControl\VRS0036941\services.exe
      "C:\Users\Admin\AppData\Roaming\ShortcutsControl\VRS0036941\services.exe"
      4⤵
      Enumerates VirtualBox registry keys
      Looks for VirtualBox Guest Additions in registry
      Looks for VMWare Tools registry key
      Executes dropped EXE
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2944
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\x4wx5ssd.bat""
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:6244
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 3 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:1396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a976a31824c3a0cc2a6b0fd9ec6045c398d82990e5e96df2ad86ba09a9b05be5
MD5 66f9b690d4e5313231bc173ce7b2c029
SHA1 b0dbce2f97d8ca067ddde29c06272e56e38fa195
SHA512 8f0c4c220fc64928778bf68c853246126b44f40fcdc99aa2fdaa491797ce02783c8776fdd7bd3154544336f0466000a8b92c740ed0d0df75b8a6990da450650e
TLSH
T158216833B3DD8614C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

NullCacheAuth.exe

Path C:\Users\Admin\AppData\Local\Temp\NullCacheAuth.exe
Size 545KB
SHA256 638dd49fadaa3b585028fababa6bab60bb21c02d932c76e7bcedd6c940aa876d
MD5 1b8827d114cd37b48bdf6c4ce7632b1a
SHA1 aba8878cb9f0bd8f5a5e0bc16b06b5ee7d24e70c
SHA512 c68fcb13f2181a3da89d97b773be63d00478da8811466956b8b763de3e189a4ce897481df3aed6c7c4c37861a9e6a8ee370510fcb021c911ebf9cea6a8517fe8
SSDEEP 6144:1LWxdGgKa8NrmSr+/K8wH9vdTQRCy8VwSyUWZT1yrBPKSazyXUGlPnaabSNO3:4ntKfTQRROyV9SaIUGfGs
TLSH
T10AC44B1BBB568D20C1852776D1D7800017F49682BAA7DB4E788D17CA9D033BFBD4B2A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_iawrs5ct.qtq.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iawrs5ct.qtq.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

x4wx5ssd.bat

Path C:\Users\Admin\AppData\Local\Temp\x4wx5ssd.bat
Size 210B
SHA256 cac5e9dc97a1c76ef5b15d82a25c19ea74f9c5c00c62b7d3279bb88512117dff
MD5 c29c9bed7dbddc56fc6b44cfaea2a8dc
SHA1 d360a6ccdb7004c5c394c2d4665202a2b2cf09a6
SHA512 940901ec82cb7f038cfea7418718ea850e4cbce98e5f93d5ec9a9f908ec270c1a1deb646c8e7df02e6f6e80442ee883dbbb84646652317e2625447206ae5e7b2
TLSH
T185D0120A334B47C5080034778EBFA3DDB0AE4D662F8566425761C06D63A701E96D77C1
MD5 SHA1 SHA512 TLSH

Submit Download

install.dat

Path C:\Users\Admin\AppData\Roaming\ShortcutsControl\VRS0036941\install.dat
Size 71B
SHA256 7d47c9a4f08687ff7fb34c82335a6b2cd68cc05a607dd961d050e76c90205ec3
MD5 bf4a4bbbc185e1d824ea23077a341a39
SHA1 470737b09f33589e27d8f19836566c8e186f492d
SHA512 43d914d026861661850cabb43bde7db3b0f236f269d0fae211886c8628d6af5ed05625c82a99c081c29b804dc7888d32ca294c58ee4e40cf48378b517f795619
TLSH
T125A0220020CECF38A003808B2F32F008C8B3BA003ACA3C00E300BC2820E0A88E88B002
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4560-12-0x00007FFCEE400000-0x00007FFCEEDA4000-memory.dmp

Download

memory/4560-59-0x00007FFCEE400000-0x00007FFCEEDA4000-memory.dmp

Download

memory/4560-9-0x0000000000400000-0x0000000001E60000-memory.dmp

Download

memory/4560-10-0x00007FFCEE400000-0x00007FFCEEDA4000-memory.dmp

Download

memory/4560-11-0x00007FFCEE400000-0x00007FFCEEDA4000-memory.dmp

Download

memory/4560-0-0x0000000000400000-0x0000000001E60000-memory.dmp

Download

memory/4560-64-0x00007FFCEE400000-0x00007FFCEEDA4000-memory.dmp

Download

memory/4560-16-0x00007FFCEE400000-0x00007FFCEEDA4000-memory.dmp

Download

memory/4560-63-0x0000000000400000-0x0000000001E60000-memory.dmp

Download

memory/4560-60-0x00007FFCEE400000-0x00007FFCEEDA4000-memory.dmp

Download

memory/4560-8-0x0000000000400000-0x0000000001E60000-memory.dmp

Download

memory/4560-7-0x00007FFCEE400000-0x00007FFCEEDA4000-memory.dmp

Download

memory/4560-2-0x00007FFD00030000-0x00007FFD00031000-memory.dmp

Download

memory/4560-1-0x00007FFD00000000-0x00007FFD00002000-memory.dmp

Download

memory/4560-55-0x0000000000400000-0x0000000001E60000-memory.dmp

Download

memory/4560-35-0x000000001F340000-0x0000000020104000-memory.dmp

Download

memory/4560-34-0x00007FFCEE400000-0x00007FFCEEDA4000-memory.dmp

Download

memory/4560-6-0x00007FFCEE400000-0x00007FFCEEDA4000-memory.dmp

Download

memory/4560-5-0x00007FFCEE58F000-0x00007FFCEE590000-memory.dmp

Download

memory/6444-42-0x00000245B0FF0000-0x00000245B107C000-memory.dmp

Download

memory/6444-45-0x00000245B15A0000-0x00000245B15F4000-memory.dmp

Download

memory/6444-48-0x00000245CB8C0000-0x00000245CB936000-memory.dmp

Download

memory/6444-50-0x00000245B1610000-0x00000245B162E000-memory.dmp

Download

memory/6888-21-0x0000021974BF0000-0x0000021974C0E000-memory.dmp

Download

memory/6888-32-0x00007FFCEE400000-0x00007FFCEEDA4000-memory.dmp

Download

memory/6888-31-0x00007FFCEE400000-0x00007FFCEEDA4000-memory.dmp

Download

memory/6888-29-0x00007FFCEE400000-0x00007FFCEEDA4000-memory.dmp

Download

memory/6888-28-0x00007FFCEE400000-0x00007FFCEEDA4000-memory.dmp

Download

memory/6888-27-0x00007FFCEE400000-0x00007FFCEEDA4000-memory.dmp

Download

memory/6888-26-0x00007FFCEE400000-0x00007FFCEEDA4000-memory.dmp

Download

memory/6888-25-0x00007FFCEE400000-0x00007FFCEEDA4000-memory.dmp

Download

memory/6888-24-0x00007FFCEE400000-0x00007FFCEEDA4000-memory.dmp

Download

memory/6888-23-0x0000021974BE0000-0x0000021974BEA000-memory.dmp

Download

memory/6888-22-0x0000021974E40000-0x0000021974EF2000-memory.dmp

Download

memory/6888-18-0x00007FFCEE400000-0x00007FFCEEDA4000-memory.dmp

Download

memory/6888-61-0x00007FFCEE400000-0x00007FFCEEDA4000-memory.dmp

Download

memory/6888-17-0x00007FFCEE400000-0x00007FFCEEDA4000-memory.dmp

Download

memory/6888-15-0x0000021974B50000-0x0000021974B72000-memory.dmp

Download