74c66faabbab048a567c8550d2cfb9268e61724fb58292a604d44d296777f260

Analysis

max time kernel
298s
max time network
206s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
20/08/2026, 18:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
InstallerV21039x64.exe
Size 14.5MB
Sample260820-xhv82stdpa
SHA256 74c66faabbab048a567c8550d2cfb9268e61724fb58292a604d44d296777f260
MD5 44a551af59e8f76a426f249bd945cc62
SHA1 3b2d036e8ab48b53226af106267858970203fc06
SHA512 128f5083600d3512cd74cac6bb77d8e7b5700806c40c4d9e2e3e0fd00605856964efafafc171fd3d8ec65bfcd9f1b58938d43abded88ac76ab50dc5d6a3f3aac
SSDEEP 393216:F4b+oRXgK4CjpVBWwQfgaW+L4B2tOUNKj3rpXNpJoJ:F4b+mXgKv9VD+hW+kkmzxNpJo
TLSH
T15EE6339C7CC1986DD9F354B0BE128EAE15E55CEAC104871F2C873BAEF52D629B58340B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion execution persistence privilege_escalation themida trojan

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 4 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	SolutionExpressions.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	SolutionExpressions.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	services.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	services.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	InstallerV21039x64.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	SolutionExpressions.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	services.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4804	powershell.exe
2520	powershell.exe
4804	powershell.exe

Looks for VMWare Tools registry key 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	SolutionExpressions.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	services.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	InstallerV21039x64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	InstallerV21039x64.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GroupResults.lnk	SolutionExpressions.exe

Executes dropped EXE 2 IoCs

pid	Process
2288	SolutionExpressions.exe
3344	services.exe

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/memory/4820-7-0x0000000000400000-0x0000000001A34000-memory.dmp	themida
behavioral2/memory/4820-8-0x0000000000400000-0x0000000001A34000-memory.dmp	themida
behavioral2/memory/4820-56-0x0000000000400000-0x0000000001A34000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	InstallerV21039x64.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4820	InstallerV21039x64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2608	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	services.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	services.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
3608	timeout.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
4804	powershell.exe
4804	powershell.exe
2520	powershell.exe
2520	powershell.exe
2288	SolutionExpressions.exe
3344	services.exe
3344	services.exe
3344	services.exe
3344	services.exe
3344	services.exe
3344	services.exe
3344	services.exe
3344	services.exe
3344	services.exe
3344	services.exe
3344	services.exe
3344	services.exe
3344	services.exe
3344	services.exe
3344	services.exe
3344	services.exe
3344	services.exe
3344	services.exe
3344	services.exe
3344	services.exe
3344	services.exe
3344	services.exe
3344	services.exe

Suspicious use of AdjustPrivilegeToken 47 IoCs

description	pid	Process
Token: SeDebugPrivilege	4820	InstallerV21039x64.exe
Token: SeDebugPrivilege	4804	powershell.exe
Token: SeIncreaseQuotaPrivilege	4804	powershell.exe
Token: SeSecurityPrivilege	4804	powershell.exe
Token: SeTakeOwnershipPrivilege	4804	powershell.exe
Token: SeLoadDriverPrivilege	4804	powershell.exe
Token: SeSystemProfilePrivilege	4804	powershell.exe
Token: SeSystemtimePrivilege	4804	powershell.exe
Token: SeProfSingleProcessPrivilege	4804	powershell.exe
Token: SeIncBasePriorityPrivilege	4804	powershell.exe
Token: SeCreatePagefilePrivilege	4804	powershell.exe
Token: SeBackupPrivilege	4804	powershell.exe
Token: SeRestorePrivilege	4804	powershell.exe
Token: SeShutdownPrivilege	4804	powershell.exe
Token: SeDebugPrivilege	4804	powershell.exe
Token: SeSystemEnvironmentPrivilege	4804	powershell.exe
Token: SeRemoteShutdownPrivilege	4804	powershell.exe
Token: SeUndockPrivilege	4804	powershell.exe
Token: SeManageVolumePrivilege	4804	powershell.exe
Token: 33	4804	powershell.exe
Token: 34	4804	powershell.exe
Token: 35	4804	powershell.exe
Token: 36	4804	powershell.exe
Token: SeIncreaseQuotaPrivilege	4804	powershell.exe
Token: SeSecurityPrivilege	4804	powershell.exe
Token: SeTakeOwnershipPrivilege	4804	powershell.exe
Token: SeLoadDriverPrivilege	4804	powershell.exe
Token: SeSystemProfilePrivilege	4804	powershell.exe
Token: SeSystemtimePrivilege	4804	powershell.exe
Token: SeProfSingleProcessPrivilege	4804	powershell.exe
Token: SeIncBasePriorityPrivilege	4804	powershell.exe
Token: SeCreatePagefilePrivilege	4804	powershell.exe
Token: SeBackupPrivilege	4804	powershell.exe
Token: SeRestorePrivilege	4804	powershell.exe
Token: SeShutdownPrivilege	4804	powershell.exe
Token: SeDebugPrivilege	4804	powershell.exe
Token: SeSystemEnvironmentPrivilege	4804	powershell.exe
Token: SeRemoteShutdownPrivilege	4804	powershell.exe
Token: SeUndockPrivilege	4804	powershell.exe
Token: SeManageVolumePrivilege	4804	powershell.exe
Token: 33	4804	powershell.exe
Token: 34	4804	powershell.exe
Token: 35	4804	powershell.exe
Token: 36	4804	powershell.exe
Token: SeDebugPrivilege	2520	powershell.exe
Token: SeDebugPrivilege	2288	SolutionExpressions.exe
Token: SeDebugPrivilege	3344	services.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4820 wrote to memory of 4804	4820	InstallerV21039x64.exe	86
PID 4820 wrote to memory of 2520	4820	InstallerV21039x64.exe	94
PID 2520 wrote to memory of 2288	2520	powershell.exe	96
PID 2288 wrote to memory of 3344	2288	SolutionExpressions.exe	97
PID 2288 wrote to memory of 2608	2288	SolutionExpressions.exe	98
PID 2608 wrote to memory of 3608	2608	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\InstallerV21039x64.exe
"C:\Users\Admin\AppData\Local\Temp\InstallerV21039x64.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath @('C:\Users\Admin\AppData\Local\Temp\','C:\Users\Admin\AppData\Local\Temp\InstallerV21039x64.exe','C:\Users\Admin\AppData\Local','C:\Users\Admin\AppData\Roaming','C:\Users\Admin\AppData\Local','C:\Users\Admin\AppData\Roaming','RuntimeBroker.exe','AppLaunch.exe','dwm.exe','svchost.exe','explorer.exe','services.exe','schtasks.exe','conhost.exe'); Add-MpPreference -ExclusionProcess @('C:\Users\Admin\AppData\Local\Temp\InstallerV21039x64.exe','RuntimeBroker.exe','InstallUtil.exe','AppLaunch.exe','dwm.exe','svchost.exe','explorer.exe','services.exe','schtasks.exe','conhost.exe','wscript.exe','concheck.exe','pathmsil.exe','ioextender.exe','SolutionExpressions.exe')"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4804
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -WindowStyle Hidden Start-Process 'C:\Users\Admin\AppData\Local\Temp\\SolutionExpressions.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2520
- - C:\Users\Admin\AppData\Local\Temp\SolutionExpressions.exe
    "C:\Users\Admin\AppData\Local\Temp\SolutionExpressions.exe"
    3⤵
    - Enumerates VirtualBox registry keys
    - Looks for VirtualBox Guest Additions in registry
    - Looks for VMWare Tools registry key
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2288
  - - C:\Users\Admin\AppData\Roaming\ProjectsServices\E036101\services.exe
      "C:\Users\Admin\AppData\Roaming\ProjectsServices\E036101\services.exe"
      4⤵
      Enumerates VirtualBox registry keys
      Looks for VirtualBox Guest Additions in registry
      Looks for VMWare Tools registry key
      Executes dropped EXE
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3344
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fd1cuyjm.bat""
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2608
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 3 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 c485a6e2fd17c342fca60060f47d6a5655a65a412e35e001bb5bf88d96e6e485
MD5 3eb3833f769dd890afc295b977eab4b4
SHA1 e857649b037939602c72ad003e5d3698695f436f
SHA512 c24bbc8f278478d43756807b8c584d4e3fb2289db468bc92986a489f74a8da386a667a758360a397e77e018e363be8912ac260072fa3e31117ad0599ac749e72
TLSH
T13A51EE313375B0D4C95A7F07193819C063BF8386E698AF58B65C521ED92751B9B222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 25a2df49257989fa02262e00cbd22e20f2c79e3e814f6f71462565797e77ce2b
MD5 2db0d6c5b09fe5a3950adf3cbe429186
SHA1 c9a680fb8bb00cad14fafa7793f64aaef69e9fdf
SHA512 6f35fb4fc0f6afb3740484ed997dc9db1d0c50f075ac7e666ad7b2762fb232a9f29e25154896a5c4a6249724ff6ca895f223919cebb76a1fb8e18c83b5d70b11
TLSH
T106219323B3DDC850CC99023A609C9CA076B6D7C780DEDF9B3EC4C212A07FA89CB101A0
MD5 SHA1 SHA512 TLSH

Submit Download

SolutionExpressions.exe

Path C:\Users\Admin\AppData\Local\Temp\SolutionExpressions.exe
Size 544KB
SHA256 6429896f539b108ddf7a477ee7e5b777b89e3087c75bce28926e7abd289118da
MD5 113c648e26109acc8616d9d93afefa8d
SHA1 0c93e324debe31092a17edc1d614e90285f1b04d
SHA512 b30974dd37d4bccb634aafd61cfa966d5834b228dde04a270db6f641eb379ec8092ac7af8e7bf2436ef2d2986790e9522d5e4ef8550e588ef41fc4d29c192bf4
SSDEEP 6144:dWuXqqv/0tWMSlOT36U//34+3QvooOPbXQvQsUyHzYTcgP/dLCwbfyItz3rldJe:NqquwlmB/8bOPEFkTcg3BC2tz3UYz
TLSH
T1C7C45B1FB74A4E60C1845777D1D7900097F4A582BAABDB0A398913D6CD033BFED4A68B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_acrq10bn.ho5.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_acrq10bn.ho5.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

fd1cuyjm.bat

Path C:\Users\Admin\AppData\Local\Temp\fd1cuyjm.bat
Size 222B
SHA256 c04d3c05a94604a94c40fae54418b86e93379a4b511a5cc0abc69b5ca8503f3b
MD5 4cac9ec2242cc0dd77e6685613a80aea
SHA1 e84d04265cbb314bcab08953037645c28803e27c
SHA512 473c6e6c4b8dc1e640a3698225457abf1a50bbda64d848d45351a63b0cad5c29b9ca9f04d8310c7ac27c4080175bcd98bc250a441e55026a56b30740298664a9
TLSH
T143D02209294B4BD6040168BF0ABFA089F5BD04B66E8462471321803DA78381EDEDB7C3
MD5 SHA1 SHA512 TLSH

Submit Download

install.dat

Path C:\Users\Admin\AppData\Roaming\ProjectsServices\E036101\install.dat
Size 68B
SHA256 2c2562fc9cdbd85e4d2d0137750670fdce9d2d08fc9ad20bb4a0923083d805d4
MD5 53b237c770eb3891c2804eea5987fced
SHA1 5fcee27fa049b0b8428fc55f35301249464e5204
SHA512 288db6c1eb6f6b815c84daa050cadfb10bdc8c8dcfc81316db74aa4be5816cd5386643b55baccc0fda6b335a68d77cff192827b3de35a4e12e478a8e92ab389e
TLSH
T15FA0220000CFCEA8A88880C32F33A00CF02202C2AEE8302883C0CC0C83C0C8CE8F0033
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2288-45-0x00000264EB880000-0x00000264EB89E000-memory.dmp

Download

memory/2288-43-0x00000264EBA00000-0x00000264EBA76000-memory.dmp

Download

memory/2288-40-0x00000264EB7F0000-0x00000264EB844000-memory.dmp

Download

memory/2288-36-0x00000264E9B80000-0x00000264E9C0C000-memory.dmp

Download

memory/4804-10-0x0000027143E10000-0x0000027143E32000-memory.dmp

Download

memory/4820-8-0x0000000000400000-0x0000000001A34000-memory.dmp

Download

memory/4820-23-0x000000001EBC0000-0x000000001F5B6000-memory.dmp

Download

memory/4820-21-0x00007FFE26C50000-0x00007FFE26F46000-memory.dmp

Download

memory/4820-18-0x0000000000400000-0x0000000001A34000-memory.dmp

Download

memory/4820-9-0x00007FFE26C50000-0x00007FFE26F46000-memory.dmp

Download

memory/4820-0-0x0000000000400000-0x0000000001A34000-memory.dmp

Download

memory/4820-7-0x0000000000400000-0x0000000001A34000-memory.dmp

Download

memory/4820-3-0x00007FFE26C50000-0x00007FFE26F46000-memory.dmp

Download

memory/4820-2-0x00007FFE26C50000-0x00007FFE26F46000-memory.dmp

Download

memory/4820-1-0x00007FFE26CBD000-0x00007FFE26CBE000-memory.dmp

Download

memory/4820-55-0x00007FFE26C50000-0x00007FFE26F46000-memory.dmp

Download

memory/4820-56-0x0000000000400000-0x0000000001A34000-memory.dmp

Download