Analysis
-
max time kernel
8s -
platform
windows11-21h2_x64 -
resource
win11-20250217-en -
resource tags
arch:x64arch:x86image:win11-20250217-enlocale:en-usos:windows11-21h2-x64system -
submitted
18-02-2025 09:23
Behavioral task
behavioral1
Sample
nixware.exe
Resource
win11-20250217-en
windows11-21h2-x64
4 signatures
150 seconds
General
-
Target
nixware.exe
-
Size
397KB
-
MD5
81b78a9441f6f04876687d2038adf13a
-
SHA1
f29918f12093bddd3046cd54750b79967e1ac8bd
-
SHA256
a8e6946c98d209d6b4cb045d3409f19cc068aca19d89d9986d604c4397d0dec4
-
SHA512
809603a8674d06c12667e4fe174913de5a12758a80afcaba6d2487c39ee870549b5384e1685955cfbc90a5e32848408dbcb35a7a9595f16459991f2852664465
-
SSDEEP
6144:cLy84u9nSO2GjZkD10BIY3rb1YfBdfpoZ3u/Ht52w6JSeiFPXoJP:I+u9nx2GjMY3XKfd/H/9PoP
Score
7/10
Malware Config
Signatures
-
Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc nixware.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power nixware.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iai2c.sys nixware.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CBDHSvc nixware.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UserManager nixware.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SerCx2.sys nixware.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000\Software\Microsoft\Windows\CurrentVersion\Run\nixware.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nixware.exe" nixware.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nixware.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5620 nixware.exe 5620 nixware.exe 5620 nixware.exe 5620 nixware.exe 5620 nixware.exe 5620 nixware.exe 5620 nixware.exe 5620 nixware.exe 5620 nixware.exe 5620 nixware.exe 5620 nixware.exe 5620 nixware.exe 5620 nixware.exe 5620 nixware.exe 5620 nixware.exe 5620 nixware.exe 5620 nixware.exe 5620 nixware.exe 5620 nixware.exe 5620 nixware.exe 5620 nixware.exe 5620 nixware.exe 5620 nixware.exe 5620 nixware.exe 5620 nixware.exe 5620 nixware.exe 5620 nixware.exe 5620 nixware.exe 5620 nixware.exe 5620 nixware.exe 5620 nixware.exe 5620 nixware.exe 5620 nixware.exe 5620 nixware.exe 5620 nixware.exe 5620 nixware.exe 5620 nixware.exe 5620 nixware.exe 5620 nixware.exe 5620 nixware.exe 5620 nixware.exe 5620 nixware.exe 5620 nixware.exe 5620 nixware.exe 5620 nixware.exe 5620 nixware.exe 5620 nixware.exe 5620 nixware.exe 5620 nixware.exe 5620 nixware.exe 5620 nixware.exe 5620 nixware.exe 5620 nixware.exe 5620 nixware.exe 5620 nixware.exe 5620 nixware.exe 5620 nixware.exe 5620 nixware.exe 5620 nixware.exe 5620 nixware.exe 5620 nixware.exe 5620 nixware.exe 5620 nixware.exe 5620 nixware.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\nixware.exe"C:\Users\Admin\AppData\Local\Temp\nixware.exe"1⤵
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5620
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:5516