Overview
overview
7Static
static
3Debug/Micr...es.xml
windows7-x64
3Debug/Micr...es.xml
windows10-2004-x64
1Debug/Mona...xclude
windows7-x64
1Debug/Mona...xclude
windows10-2004-x64
1Debug/Mona...ar.ttf
windows7-x64
4Debug/Mona...ar.ttf
windows10-2004-x64
7Debug/Mona....woff2
windows7-x64
3Debug/Mona....woff2
windows10-2004-x64
3Debug/Mona...on.ttf
windows7-x64
4Debug/Mona...on.ttf
windows10-2004-x64
7Debug/Nexa..._1.zip
windows7-x64
1Debug/Nexa..._1.zip
windows10-2004-x64
1Debug/Nexa..._1.zip
windows7-x64
1Debug/Nexa..._1.zip
windows10-2004-x64
1Debug/Nexa..._1.zip
windows7-x64
1Debug/Nexa..._1.zip
windows10-2004-x64
1Debug/Nexa..._1.zip
windows7-x64
1Debug/Nexa..._1.zip
windows10-2004-x64
1Debug/Nexa..._1.zip
windows7-x64
1Debug/Nexa..._1.zip
windows10-2004-x64
1Debug/Nexa...s.json
windows7-x64
3Debug/Nexa...s.json
windows10-2004-x64
3Debug/Nexa...af.hyb
windows7-x64
3Debug/Nexa...af.hyb
windows10-2004-x64
3Debug/Nexa...as.hyb
windows7-x64
3Debug/Nexa...as.hyb
windows10-2004-x64
3Debug/Nexa...be.hyb
windows7-x64
3Debug/Nexa...be.hyb
windows10-2004-x64
3Debug/Nexa...bg.hyb
windows7-x64
3Debug/Nexa...bg.hyb
windows10-2004-x64
3Debug/Nexa...bn.hyb
windows7-x64
3Debug/Nexa...bn.hyb
windows10-2004-x64
3Analysis
-
max time kernel
92s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09-12-2024 23:59
Static task
static1
Behavioral task
behavioral1
Sample
Debug/Microsoft.Bcl.AsyncInterfaces.xml
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
Debug/Microsoft.Bcl.AsyncInterfaces.xml
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Debug/Monaco/.git/info/exclude
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
Debug/Monaco/.git/info/exclude
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Debug/Monaco/Fonts/JetBrainsMono-Regular.ttf
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral6
Sample
Debug/Monaco/Fonts/JetBrainsMono-Regular.ttf
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Debug/Monaco/Fonts/JetBrainsMono-Regular.woff2
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
Debug/Monaco/Fonts/JetBrainsMono-Regular.woff2
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Debug/Monaco/vs/base/browser/ui/codicons/codicon/codicon.ttf
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
Debug/Monaco/vs/base/browser/ui/codicons/codicon/codicon.ttf
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Debug/Nexam.exe.WebView2/EBWebView/component_crx_cache/fppmbhmldokgmleojlplaaodlkibgikh_1.zip
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral12
Sample
Debug/Nexam.exe.WebView2/EBWebView/component_crx_cache/fppmbhmldokgmleojlplaaodlkibgikh_1.zip
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Debug/Nexam.exe.WebView2/EBWebView/component_crx_cache/kpfehajjjbbcifeehjgfgnabifknmdad_1.zip
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral14
Sample
Debug/Nexam.exe.WebView2/EBWebView/component_crx_cache/kpfehajjjbbcifeehjgfgnabifknmdad_1.zip
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
Debug/Nexam.exe.WebView2/EBWebView/component_crx_cache/ndikpojcjlepofdkaaldkinkjbeeebkl_1.zip
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral16
Sample
Debug/Nexam.exe.WebView2/EBWebView/component_crx_cache/ndikpojcjlepofdkaaldkinkjbeeebkl_1.zip
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
Debug/Nexam.exe.WebView2/EBWebView/component_crx_cache/oankkpibpaokgecfckkdkgaoafllipag_1.zip
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral18
Sample
Debug/Nexam.exe.WebView2/EBWebView/component_crx_cache/oankkpibpaokgecfckkdkgaoafllipag_1.zip
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
Debug/Nexam.exe.WebView2/EBWebView/component_crx_cache/ohckeflnhegojcjlcpbfpciadgikcohk_1.zip
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral20
Sample
Debug/Nexam.exe.WebView2/EBWebView/component_crx_cache/ohckeflnhegojcjlcpbfpciadgikcohk_1.zip
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
Debug/Nexam.exe.WebView2/EBWebView/hyphen-data/120.0.6050.0/_metadata/verified_contents.json
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral22
Sample
Debug/Nexam.exe.WebView2/EBWebView/hyphen-data/120.0.6050.0/_metadata/verified_contents.json
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
Debug/Nexam.exe.WebView2/EBWebView/hyphen-data/120.0.6050.0/hyph-af.hyb
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral24
Sample
Debug/Nexam.exe.WebView2/EBWebView/hyphen-data/120.0.6050.0/hyph-af.hyb
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
Debug/Nexam.exe.WebView2/EBWebView/hyphen-data/120.0.6050.0/hyph-as.hyb
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral26
Sample
Debug/Nexam.exe.WebView2/EBWebView/hyphen-data/120.0.6050.0/hyph-as.hyb
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
Debug/Nexam.exe.WebView2/EBWebView/hyphen-data/120.0.6050.0/hyph-be.hyb
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral28
Sample
Debug/Nexam.exe.WebView2/EBWebView/hyphen-data/120.0.6050.0/hyph-be.hyb
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
Debug/Nexam.exe.WebView2/EBWebView/hyphen-data/120.0.6050.0/hyph-bg.hyb
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral30
Sample
Debug/Nexam.exe.WebView2/EBWebView/hyphen-data/120.0.6050.0/hyph-bg.hyb
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
Debug/Nexam.exe.WebView2/EBWebView/hyphen-data/120.0.6050.0/hyph-bn.hyb
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral32
Sample
Debug/Nexam.exe.WebView2/EBWebView/hyphen-data/120.0.6050.0/hyph-bn.hyb
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
Debug/Nexam.exe.WebView2/EBWebView/component_crx_cache/oankkpibpaokgecfckkdkgaoafllipag_1.zip
-
Size
22KB
-
MD5
025fe5bcab10e941f276145d9d00ec80
-
SHA1
ac4c2c93fe10274716ec5603452269a8b5b31f71
-
SHA256
1ab07e887acca305058eeab9053c96dc531c2c5c067ab4f30afa2b31f1edd966
-
SHA512
3785cfae9f9ad3ecbc40bfbf822cc371965723610af8c6965b8b0a1e3b4728e744a51678178b414329d4b46afa5d3557b44a8723a1d89b7499b09e8f28c8c535
-
SSDEEP
384:puLGn1KIHXgrjzeReRlhv5bzX1sf8ANFlBZlVgQUP49fmA4tVyk4exlfiMRoLndl:puLqgrr/hv514lZmJUei/nb
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 744 7zFM.exe Token: 35 744 7zFM.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 744 7zFM.exe