59dd29982f9644046b726452978de2dbed11d12c4c5a7eb22e4ad52d7951c16d

Resubmissions

18/05/2026, 12:42

260518-pxc21scw9w9

07/05/2026, 10:20

260507-mdfmpabw219

Analysis

max time kernel
29s
max time network
31s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
07/05/2026, 10:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NBB.exe
Size 145KB
Sample260507-mdfmpabw21
SHA256 59dd29982f9644046b726452978de2dbed11d12c4c5a7eb22e4ad52d7951c16d
MD5 7bb88ef9a32ba352e0c130fbc441c81e
SHA1 82b48a56249b81f039168c6bf206e997a4c35e40
SHA512 bb0a8795af7e90d3d1182296f0f59362cfd89051e6d86cf50d92cd34492a5b8d8ed9f7c89bb2fd32dd803f15d242649932dd9e02812a122e12e7facabb2a3bfc
SSDEEP 3072:Yf/eCmTWXbwDwNGfURw91mN7fH/6Hm5ZzckbdA:iuTWXbqw0fUG91ezH/6HmVbd
TLSH
T1E4E35A53E3A32033F56A4A383461160B19711C773068EE2AAACB799E673BFF45C31D59
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution impact persistence ransomware

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 3 IoCs

pid	Process
4336	bcdedit.exe
3092	bcdedit.exe
808	bcdedit.exe

Deletes backup catalog 3 TTPs 1 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
1376	wbadmin.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2672	powershell.exe

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\NBL_Sys_3287\Desktop\desktop.ini	NBB.exe
File created	C:\Users\Admin\AppData\Local\Temp\NBL_Sys_3287\Documents\desktop.ini	NBB.exe
File created	C:\Users\Admin\AppData\Local\Temp\NBL_Sys_3287\Downloads\desktop.ini	NBB.exe
File created	C:\Users\Admin\AppData\Local\Temp\NBL_Sys_3287\Pictures\desktop.ini	NBB.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	ReAgentc.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
1080	tasklist.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\locked.png"	NBB.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Connections Discovery 1 TTPs 2 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
1072	cmd.exe
5024	NETSTAT.EXE

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	vds.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
772	WMIC.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5024	NETSTAT.EXE
768	ipconfig.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
1844	vssadmin.exe

Modifies Control Panel 2 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Control Panel\Desktop\WallpaperStyle = "2"	NBB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Control Panel\Desktop\TileWallpaper = "0"	NBB.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1080	tasklist.exe
1080	tasklist.exe
2672	powershell.exe
2672	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2528	NBB.exe
Token: SeIncreaseQuotaPrivilege	772	WMIC.exe
Token: SeSecurityPrivilege	772	WMIC.exe
Token: SeTakeOwnershipPrivilege	772	WMIC.exe
Token: SeLoadDriverPrivilege	772	WMIC.exe
Token: SeSystemProfilePrivilege	772	WMIC.exe
Token: SeSystemtimePrivilege	772	WMIC.exe
Token: SeProfSingleProcessPrivilege	772	WMIC.exe
Token: SeIncBasePriorityPrivilege	772	WMIC.exe
Token: SeCreatePagefilePrivilege	772	WMIC.exe
Token: SeBackupPrivilege	772	WMIC.exe
Token: SeRestorePrivilege	772	WMIC.exe
Token: SeShutdownPrivilege	772	WMIC.exe
Token: SeDebugPrivilege	772	WMIC.exe
Token: SeSystemEnvironmentPrivilege	772	WMIC.exe
Token: SeRemoteShutdownPrivilege	772	WMIC.exe
Token: SeUndockPrivilege	772	WMIC.exe
Token: SeManageVolumePrivilege	772	WMIC.exe
Token: 33	772	WMIC.exe
Token: 34	772	WMIC.exe
Token: 35	772	WMIC.exe
Token: 36	772	WMIC.exe
Token: SeIncreaseQuotaPrivilege	772	WMIC.exe
Token: SeSecurityPrivilege	772	WMIC.exe
Token: SeTakeOwnershipPrivilege	772	WMIC.exe
Token: SeLoadDriverPrivilege	772	WMIC.exe
Token: SeSystemProfilePrivilege	772	WMIC.exe
Token: SeSystemtimePrivilege	772	WMIC.exe
Token: SeProfSingleProcessPrivilege	772	WMIC.exe
Token: SeIncBasePriorityPrivilege	772	WMIC.exe
Token: SeCreatePagefilePrivilege	772	WMIC.exe
Token: SeBackupPrivilege	772	WMIC.exe
Token: SeRestorePrivilege	772	WMIC.exe
Token: SeShutdownPrivilege	772	WMIC.exe
Token: SeDebugPrivilege	772	WMIC.exe
Token: SeSystemEnvironmentPrivilege	772	WMIC.exe
Token: SeRemoteShutdownPrivilege	772	WMIC.exe
Token: SeUndockPrivilege	772	WMIC.exe
Token: SeManageVolumePrivilege	772	WMIC.exe
Token: 33	772	WMIC.exe
Token: 34	772	WMIC.exe
Token: 35	772	WMIC.exe
Token: 36	772	WMIC.exe
Token: SeDebugPrivilege	5024	NETSTAT.EXE
Token: SeDebugPrivilege	1080	tasklist.exe
Token: SeDebugPrivilege	5568	whoami.exe
Token: SeDebugPrivilege	5568	whoami.exe
Token: SeDebugPrivilege	5568	whoami.exe
Token: SeDebugPrivilege	5568	whoami.exe
Token: SeDebugPrivilege	5568	whoami.exe
Token: SeDebugPrivilege	5568	whoami.exe
Token: SeDebugPrivilege	5568	whoami.exe
Token: SeDebugPrivilege	5568	whoami.exe
Token: SeDebugPrivilege	5568	whoami.exe
Token: SeDebugPrivilege	5568	whoami.exe
Token: SeDebugPrivilege	5568	whoami.exe
Token: SeDebugPrivilege	5568	whoami.exe
Token: SeDebugPrivilege	5568	whoami.exe
Token: SeDebugPrivilege	5568	whoami.exe
Token: SeDebugPrivilege	5568	whoami.exe
Token: SeDebugPrivilege	5568	whoami.exe
Token: SeDebugPrivilege	5568	whoami.exe
Token: SeDebugPrivilege	5568	whoami.exe
Token: SeDebugPrivilege	5568	whoami.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 2536	2528	NBB.exe	79
PID 2536 wrote to memory of 772	2536	cmd.exe	81
PID 2528 wrote to memory of 5068	2528	NBB.exe	83
PID 5068 wrote to memory of 4276	5068	cmd.exe	85
PID 2528 wrote to memory of 1072	2528	NBB.exe	86
PID 1072 wrote to memory of 5024	1072	cmd.exe	88
PID 2528 wrote to memory of 5716	2528	NBB.exe	89
PID 5716 wrote to memory of 1080	5716	cmd.exe	91
PID 2528 wrote to memory of 5300	2528	NBB.exe	92
PID 5300 wrote to memory of 5568	5300	cmd.exe	94
PID 2528 wrote to memory of 6092	2528	NBB.exe	95
PID 6092 wrote to memory of 768	6092	cmd.exe	97
PID 2528 wrote to memory of 448	2528	NBB.exe	98
PID 2528 wrote to memory of 2208	2528	NBB.exe	100
PID 2528 wrote to memory of 3264	2528	NBB.exe	102
PID 2528 wrote to memory of 3700	2528	NBB.exe	104
PID 2528 wrote to memory of 1644	2528	NBB.exe	106
PID 448 wrote to memory of 1844	448	cmd.exe	108
PID 2208 wrote to memory of 4628	2208	cmd.exe	109
PID 2528 wrote to memory of 2460	2528	NBB.exe	110
PID 3264 wrote to memory of 3092	3264	cmd.exe	113
PID 2460 wrote to memory of 4336	2460	cmd.exe	114
PID 3700 wrote to memory of 1376	3700	cmd.exe	115
PID 1644 wrote to memory of 2672	1644	cmd.exe	117
PID 3264 wrote to memory of 808	3264	cmd.exe	118

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\NBB.exe
"C:\Users\Admin\AppData\Local\Temp\NBB.exe"
1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c wmic path win32_VideoController get name
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2536
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    - Suspicious use of AdjustPrivilegeToken
    PID:772
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c cmdkey /list
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5068
- - C:\Windows\system32\cmdkey.exe
    cmdkey /list
    3⤵
    PID:4276
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c netstat -ano
  2⤵
  - System Network Connections Discovery
  - Suspicious use of WriteProcessMemory
  PID:1072
- - C:\Windows\system32\NETSTAT.EXE
    netstat -ano
    3⤵
    - System Network Connections Discovery
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:5024
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c tasklist /v
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5716
- - C:\Windows\system32\tasklist.exe
    tasklist /v
    3⤵
    - Enumerates processes with tasklist
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1080
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c whoami /all
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5300
- - C:\Windows\system32\whoami.exe
    whoami /all
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5568
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ipconfig /all
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6092
- - C:\Windows\system32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:768
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:448
- - C:\Windows\system32\vssadmin.exe
    vssadmin.exe delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:1844
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reagentc.exe /disable
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2208
- - C:\Windows\system32\ReAgentc.exe
    reagentc.exe /disable
    3⤵
    - Drops file in System32 directory
    - Drops file in Windows directory
    PID:4628
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3264
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3092
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:808
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c wbadmin delete catalog -quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3700
- - C:\Windows\system32\wbadmin.exe
    wbadmin delete catalog -quiet
    3⤵
    - Deletes backup catalog
    PID:1376
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -Command "Set-Service -Name WerSvc -StartupType Disabled"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1644
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Set-Service -Name WerSvc -StartupType Disabled"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2672
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /deletevalue {current} safeboot
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2460
- - C:\Windows\system32\bcdedit.exe
    bcdedit /deletevalue {current} safeboot
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4336

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:1260

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:3356

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:2968

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:4324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_qblwbly5.mfw.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qblwbly5.mfw.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2528-0-0x0000000000D40000-0x0000000000D6A000-memory.dmp

Download

memory/2528-1-0x000000001BB40000-0x000000001BB50000-memory.dmp

Download

memory/2528-2-0x0000000002F80000-0x0000000002F8A000-memory.dmp

Download

memory/2528-116-0x0000000002FD0000-0x0000000002FE2000-memory.dmp

Download

memory/2528-232-0x0000000002F40000-0x0000000002F4C000-memory.dmp

Download

memory/2528-233-0x0000000003000000-0x0000000003012000-memory.dmp

Download

memory/2528-251-0x000000001BB40000-0x000000001BB50000-memory.dmp

Download

memory/2672-242-0x000002260F4E0000-0x000002260F502000-memory.dmp

Download

memory/2672-249-0x000002260F370000-0x000002260F37C000-memory.dmp

Download

memory/2672-250-0x000002260F410000-0x000002260F422000-memory.dmp

Download