59dd29982f9644046b726452978de2dbed11d12c4c5a7eb22e4ad52d7951c16d

Resubmissions

18/05/2026, 12:42

260518-pxc21scw9w9

07/05/2026, 10:20

260507-mdfmpabw219

Analysis

max time kernel
30s
max time network
30s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/05/2026, 10:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NBB.exe
Size 145KB
Sample260507-mdfmpabw21
SHA256 59dd29982f9644046b726452978de2dbed11d12c4c5a7eb22e4ad52d7951c16d
MD5 7bb88ef9a32ba352e0c130fbc441c81e
SHA1 82b48a56249b81f039168c6bf206e997a4c35e40
SHA512 bb0a8795af7e90d3d1182296f0f59362cfd89051e6d86cf50d92cd34492a5b8d8ed9f7c89bb2fd32dd803f15d242649932dd9e02812a122e12e7facabb2a3bfc
SSDEEP 3072:Yf/eCmTWXbwDwNGfURw91mN7fH/6Hm5ZzckbdA:iuTWXbqw0fUG91ezH/6HmVbd
TLSH
T1E4E35A53E3A32033F56A4A383461160B19711C773068EE2AAACB799E673BFF45C31D59
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution impact persistence ransomware

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 3 IoCs

pid	Process
2960	bcdedit.exe
1888	bcdedit.exe
640	bcdedit.exe

Deletes backup catalog 3 TTPs 1 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
2160	wbadmin.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Control Panel\International\Geo\Nation	NBB.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3944	powershell.exe

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\NBL_Sys_edba\Downloads\desktop.ini	NBB.exe
File created	C:\Users\Admin\AppData\Local\Temp\NBL_Sys_edba\Pictures\desktop.ini	NBB.exe
File created	C:\Users\Admin\AppData\Local\Temp\NBL_Sys_edba\Desktop\desktop.ini	NBB.exe
File created	C:\Users\Admin\AppData\Local\Temp\NBL_Sys_edba\Documents\desktop.ini	NBB.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	ReAgentc.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
4404	tasklist.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\locked.png"	NBB.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Connections Discovery 1 TTPs 2 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
4500	cmd.exe
3544	NETSTAT.EXE

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	vds.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4572	WMIC.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3544	NETSTAT.EXE
3812	ipconfig.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
1344	vssadmin.exe

Modifies Control Panel 2 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Control Panel\Desktop\WallpaperStyle = "2"	NBB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Control Panel\Desktop\TileWallpaper = "0"	NBB.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
4404	tasklist.exe
4404	tasklist.exe
3944	powershell.exe
3944	powershell.exe
3944	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4484	NBB.exe
Token: SeIncreaseQuotaPrivilege	4572	WMIC.exe
Token: SeSecurityPrivilege	4572	WMIC.exe
Token: SeTakeOwnershipPrivilege	4572	WMIC.exe
Token: SeLoadDriverPrivilege	4572	WMIC.exe
Token: SeSystemProfilePrivilege	4572	WMIC.exe
Token: SeSystemtimePrivilege	4572	WMIC.exe
Token: SeProfSingleProcessPrivilege	4572	WMIC.exe
Token: SeIncBasePriorityPrivilege	4572	WMIC.exe
Token: SeCreatePagefilePrivilege	4572	WMIC.exe
Token: SeBackupPrivilege	4572	WMIC.exe
Token: SeRestorePrivilege	4572	WMIC.exe
Token: SeShutdownPrivilege	4572	WMIC.exe
Token: SeDebugPrivilege	4572	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4572	WMIC.exe
Token: SeRemoteShutdownPrivilege	4572	WMIC.exe
Token: SeUndockPrivilege	4572	WMIC.exe
Token: SeManageVolumePrivilege	4572	WMIC.exe
Token: 33	4572	WMIC.exe
Token: 34	4572	WMIC.exe
Token: 35	4572	WMIC.exe
Token: 36	4572	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4572	WMIC.exe
Token: SeSecurityPrivilege	4572	WMIC.exe
Token: SeTakeOwnershipPrivilege	4572	WMIC.exe
Token: SeLoadDriverPrivilege	4572	WMIC.exe
Token: SeSystemProfilePrivilege	4572	WMIC.exe
Token: SeSystemtimePrivilege	4572	WMIC.exe
Token: SeProfSingleProcessPrivilege	4572	WMIC.exe
Token: SeIncBasePriorityPrivilege	4572	WMIC.exe
Token: SeCreatePagefilePrivilege	4572	WMIC.exe
Token: SeBackupPrivilege	4572	WMIC.exe
Token: SeRestorePrivilege	4572	WMIC.exe
Token: SeShutdownPrivilege	4572	WMIC.exe
Token: SeDebugPrivilege	4572	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4572	WMIC.exe
Token: SeRemoteShutdownPrivilege	4572	WMIC.exe
Token: SeUndockPrivilege	4572	WMIC.exe
Token: SeManageVolumePrivilege	4572	WMIC.exe
Token: 33	4572	WMIC.exe
Token: 34	4572	WMIC.exe
Token: 35	4572	WMIC.exe
Token: 36	4572	WMIC.exe
Token: SeDebugPrivilege	3544	NETSTAT.EXE
Token: SeDebugPrivilege	4404	tasklist.exe
Token: SeDebugPrivilege	2204	whoami.exe
Token: SeDebugPrivilege	2204	whoami.exe
Token: SeDebugPrivilege	2204	whoami.exe
Token: SeDebugPrivilege	2204	whoami.exe
Token: SeDebugPrivilege	2204	whoami.exe
Token: SeDebugPrivilege	2204	whoami.exe
Token: SeDebugPrivilege	2204	whoami.exe
Token: SeDebugPrivilege	2204	whoami.exe
Token: SeDebugPrivilege	2204	whoami.exe
Token: SeDebugPrivilege	2204	whoami.exe
Token: SeDebugPrivilege	2204	whoami.exe
Token: SeDebugPrivilege	2204	whoami.exe
Token: SeDebugPrivilege	2204	whoami.exe
Token: SeDebugPrivilege	2204	whoami.exe
Token: SeDebugPrivilege	2204	whoami.exe
Token: SeDebugPrivilege	2204	whoami.exe
Token: SeDebugPrivilege	2204	whoami.exe
Token: SeDebugPrivilege	2204	whoami.exe
Token: SeDebugPrivilege	2204	whoami.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4484 wrote to memory of 1316	4484	NBB.exe	86
PID 1316 wrote to memory of 4572	1316	cmd.exe	88
PID 4484 wrote to memory of 4300	4484	NBB.exe	90
PID 4300 wrote to memory of 3860	4300	cmd.exe	92
PID 4484 wrote to memory of 4500	4484	NBB.exe	93
PID 4500 wrote to memory of 3544	4500	cmd.exe	95
PID 4484 wrote to memory of 4932	4484	NBB.exe	96
PID 4932 wrote to memory of 4404	4932	cmd.exe	98
PID 4484 wrote to memory of 2100	4484	NBB.exe	99
PID 2100 wrote to memory of 2204	2100	cmd.exe	101
PID 4484 wrote to memory of 4816	4484	NBB.exe	102
PID 4816 wrote to memory of 3812	4816	cmd.exe	104
PID 4484 wrote to memory of 700	4484	NBB.exe	111
PID 4484 wrote to memory of 1136	4484	NBB.exe	113
PID 4484 wrote to memory of 2592	4484	NBB.exe	115
PID 4484 wrote to memory of 4568	4484	NBB.exe	117
PID 4484 wrote to memory of 3444	4484	NBB.exe	119
PID 4484 wrote to memory of 1932	4484	NBB.exe	121
PID 700 wrote to memory of 1344	700	cmd.exe	122
PID 1136 wrote to memory of 3384	1136	cmd.exe	125
PID 3444 wrote to memory of 3944	3444	cmd.exe	126
PID 2592 wrote to memory of 1888	2592	cmd.exe	127
PID 1932 wrote to memory of 2960	1932	cmd.exe	128
PID 4568 wrote to memory of 2160	4568	cmd.exe	129
PID 2592 wrote to memory of 640	2592	cmd.exe	131

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\NBB.exe
"C:\Users\Admin\AppData\Local\Temp\NBB.exe"
1⤵
- Checks computer location settings
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4484
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c wmic path win32_VideoController get name
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1316
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    - Suspicious use of AdjustPrivilegeToken
    PID:4572
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c cmdkey /list
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4300
- - C:\Windows\system32\cmdkey.exe
    cmdkey /list
    3⤵
    PID:3860
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netstat -ano
  2⤵
  - System Network Connections Discovery
  - Suspicious use of WriteProcessMemory
  PID:4500
- - C:\Windows\system32\NETSTAT.EXE
    netstat -ano
    3⤵
    - System Network Connections Discovery
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:3544
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c tasklist /v
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4932
- - C:\Windows\system32\tasklist.exe
    tasklist /v
    3⤵
    - Enumerates processes with tasklist
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4404
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c whoami /all
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2100
- - C:\Windows\system32\whoami.exe
    whoami /all
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2204
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ipconfig /all
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4816
- - C:\Windows\system32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:3812
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:700
- - C:\Windows\system32\vssadmin.exe
    vssadmin.exe delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:1344
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reagentc.exe /disable
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1136
- - C:\Windows\system32\ReAgentc.exe
    reagentc.exe /disable
    3⤵
    - Drops file in System32 directory
    - Drops file in Windows directory
    PID:3384
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2592
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1888
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:640
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c wbadmin delete catalog -quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4568
- - C:\Windows\system32\wbadmin.exe
    wbadmin delete catalog -quiet
    3⤵
    - Deletes backup catalog
    PID:2160
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-Service -Name WerSvc -StartupType Disabled"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3444
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Set-Service -Name WerSvc -StartupType Disabled"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3944
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {current} safeboot
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1932
- - C:\Windows\system32\bcdedit.exe
    bcdedit /deletevalue {current} safeboot
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2960

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:1996

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:3476

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:1852

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_sfsv422b.4va.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sfsv422b.4va.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3944-263-0x00000248950E0000-0x0000024895102000-memory.dmp

Download

memory/3944-266-0x0000024894BD0000-0x0000024894BDC000-memory.dmp

Download

memory/4484-0-0x0000000000CD0000-0x0000000000CFA000-memory.dmp

Download

memory/4484-1-0x000000001BAC0000-0x000000001BAD0000-memory.dmp

Download

memory/4484-2-0x00000000014C0000-0x00000000014CA000-memory.dmp

Download

memory/4484-124-0x0000000001510000-0x0000000001522000-memory.dmp

Download

memory/4484-248-0x0000000001280000-0x000000000128C000-memory.dmp

Download

memory/4484-249-0x000000001BAC0000-0x000000001BAD0000-memory.dmp

Download