d4cb44d2927e58dbc12c9f513fdf3c06b76b82d69e0f52b4e4a5cf4b9d4e4592

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 23:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WinMFC.exe
Size 3.1MB
Sample260701-269hssfx2m
SHA256 d4cb44d2927e58dbc12c9f513fdf3c06b76b82d69e0f52b4e4a5cf4b9d4e4592
MD5 589096c6028c57516115bc0d4368d1fb
SHA1 3150a8d1b5a8c6682002ddd0c302c8e6c66bf260
SHA512 689743600499c71e39e10342db807fee6b65ac444dd39aa7960f72ffa7763bbe24ec3d89d3578922c2fdc314e97191a7b9b51e7ac80b0fa9ef05d6b66a39298b
SSDEEP 49152:UJqjxaH2fr5GfJRy/S45Wdfh9tuc+qdMgAB7jAtfTStegmDQUl+FA2O92:pS6WdZ9cc+qdUhjw0egmEWg
TLSH
T127E5CF127AE1D226DA67023DCD7CA6F9626DBC50CFA085DB6388BF7D39301C10A35A57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4416	nvDeviceapp.exe
2628	nvDeviceapp.exe

Loads dropped DLL 2 IoCs

pid	Process
4416	nvDeviceapp.exe
2628	nvDeviceapp.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ifconfig.me

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nvDeviceapp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nvDeviceapp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinMFC.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	nvDeviceapp.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	nvDeviceapp.exe

Modifies registry class 24 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Container.Document\shell\open\ddeexec	WinMFC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Container.Document\shell	WinMFC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Container.Document\shell\printto\ddeexec\ = "[printto(\"%1\",\"%2\",\"%3\",\"%4\")]"	WinMFC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Container.Document\shell\open\command	WinMFC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Container.Document\shell\printto\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WinMFC.exe /ddenoshow"	WinMFC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Container.Document	WinMFC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Container.Document\shell\open	WinMFC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Container.Document\shell\print	WinMFC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Container.Document\shell\print\ddeexec\ = "[print(\"%1\")]"	WinMFC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Container.Document\shell\printto	WinMFC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Container.Document\shell\print\command	WinMFC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.CTR	WinMFC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.CTR\ = "Container.Document"	WinMFC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Container.Document\shell\printto\ddeexec	WinMFC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Container.Document\shell\print\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WinMFC.exe /ddenoshow"	WinMFC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Container.Document\shell\printto\command	WinMFC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.CTR\ShellNew	WinMFC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.CTR\ShellNew\NullFile	WinMFC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Container.Document\DefaultIcon	WinMFC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Container.Document\shell\open\ddeexec\ = "[open(\"%1\")]"	WinMFC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Container.Document\shell\print\ddeexec	WinMFC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Container.Document\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WinMFC.exe /dde"	WinMFC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Container.Document\ = "Contr Document"	WinMFC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Container.Document\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WinMFC.exe,1"	WinMFC.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5728	WinMFC.exe
5728	WinMFC.exe
4416	nvDeviceapp.exe
2628	nvDeviceapp.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5728 wrote to memory of 4416	5728	WinMFC.exe	89
PID 2628 wrote to memory of 5616	2628	nvDeviceapp.exe	93
PID 2628 wrote to memory of 5616	2628	nvDeviceapp.exe	93

C:\Users\Admin\AppData\Local\Temp\WinMFC.exe
"C:\Users\Admin\AppData\Local\Temp\WinMFC.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5728
- C:\Users\Admin\AppData\Local\SmartHelth\nvDeviceapp.exe
  C:\Users\Admin\AppData\Local\SmartHelth\nvDeviceapp.exe setup
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious use of SetWindowsHookEx
  PID:4416

C:\ProgamFiles\Common Files\Cloudata\nvDeviceapp.exe
"C:\ProgamFiles\Common Files\Cloudata\nvDeviceapp.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Windows\SysWOW64\Svchost.exe
  C:\Windows\System32\Svchost.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

coresources.dat

Path C:\Users\Admin\AppData\Local\DeviceSet\coresources.dat
Size 807KB
SHA256 3798bfc2445f3376bffe558d32b6754875353696206df1169de1ed58eacccc67
MD5 2eddd42e5b00e7662e35e28583d0018b
SHA1 82f1622e10877ef841f82101d546cc8aee50e7f3
SHA512 99752e0c041ed59ce010127d8e8ea25592ffb97023d1d4c8622bb40bcc4281bfacdf7d490cc738c4755370e9466ef012539636fc81b55348bb297dbb7965d085
SSDEEP 24576:KDbgF+emzrpY4LWlb52JP7bKQyBqvd38bgb:jOrKCuefKtBCdMbgb
TLSH
T11F051264484EEFB21FC06C1DEDF8C65662998E23C9A1473E8DE7D7C646933C0629493B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

devicecoding.dat

Path C:\Users\Admin\AppData\Local\DeviceSet\devicecoding.dat
Size 619KB
SHA256 2810c9ec50ea489fbee24465bfebc166f31224afe0e20f2084652b387cf5f0bc
MD5 50209071d32cffc1b6f8157f0f095f21
SHA1 863ac67796c94adf0d3a7da17be6377cce82f40b
SHA512 5094ff50333bdf33db1f5a9a9f5fdaed678d48bc6e6946930e43ed80273ce2fbdad066599236781c4dbd507b3b16b49d3cd4fe6d39b52950a6112a0a6954b6a9
SSDEEP 12288:TzYe+KFTgBl2nOEB+WE0H1VkfQWsyGynB3YN8YQ9L+RlwZlLdoZNnvCxd8842m3I:33/UKX+73dK8RFJACasiySQ
TLSH
T16ED401CEB2C8BD829B251512F432B7A6703D23A537A5D084FB964848137E46A7D4DE3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

deviceconfig.dat

Path C:\Users\Admin\AppData\Local\DeviceSet\deviceconfig.dat
Size 266KB
SHA256 2f7f2fc6f6863898f0a479094e2a7021b43b6e8be631a851973d394f792690ac
MD5 d2d77416a22c60b6892e44d00d4c8529
SHA1 856686f96b21bf99fec8224494e81d12e7e46d01
SHA512 c04b4cc1ca86a5d2fdce6887e9079b96ca450cbfde5152388ce91411d9e94c8145b880e384062dae972e828899bb21c35585c1f382fbeb4a9971a66d5603e432
SSDEEP 6144:1k2jy4b3T1yJoGv6xqknUNGcBWtJUCygrJYyQl7Y5dCZ2LE70MRERRcwNoX7CYyx:1k2jy4L5yJh6YknUNDWtJzrJYLNY2Z2f
TLSH
T16644CFDEB2957DD15B284913B83373E9203817A33364E4A9FF925A84227A1566C0DE3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DJCU.dll

Path C:\Users\Admin\AppData\Local\SmartHelth\DJCU.dll
Size 564KB
SHA256 f14ed6112c46e32bc1e9a742425008703b1034d79249ef15e8a9cb9705a5b2ae
MD5 f904f7550b04781c794559d0cc71fec4
SHA1 34f8e7e6f81a453586ff81b4567e9e7ccc66c764
SHA512 df96e555f05278da8b19eb046e1e661eb568e6a8c39c6bb413764c1d369728e604989c378123c72b36cbaf02ce55711736546f15db58a16e2d9d29be6df4fd0a
SSDEEP 12288:Fh7kY5vn6WESEeplVSfLwHEuFx5Cgx6Ij2314aotE8qik+KbqhVK8O:FhkY5vn6WESEeplVSfLadnxg3tot7k+Q
TLSH
T17DC47C113A81C03ED56E0171882AA76A05BEF9A14FB055EBF7D8973E6FF05C25B32613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

codecexpress.dll

Path C:\Users\Admin\AppData\Local\SmartHelth\codecexpress.dll
Size 273KB
SHA256 eb90cf97ce557f7fc23ac39f0a04e2107f6ce097273ea9fa8984b2c358872e16
MD5 31360ec830b454c2e8d9caab9007d3cf
SHA1 313ef7cbf203d42f6a6373f59a61cac1f6f857be
SHA512 9f91bce7276b460a9a70ff6298122ab178b32c699745e1938b97bff9b2ab2e15dee757554a700b780eaf3bcc43f911f210f7a407f05c30632849a8996fb84249
SSDEEP 6144:ifIlnhkf4Vog6/kzHE7TfbeQWoh+cCXOpd4:bC4VoH2kXf9Wo6Xw
TLSH
T1FC545B5A7BA44CA5ED728439C8238945E3B37C614F61DBEF1250432E9F3B7E09939B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nvDeviceapp.exe

Path C:\Users\Admin\AppData\Local\SmartHelth\nvDeviceapp.exe
Size 308KB
SHA256 7163b9d9aa926acb9b35c983571554f6bcd8ee3f672a83eda964e0089b032f60
MD5 89a1c2721c76e5f029212f90e927a504
SHA1 72100b2b132f4b438f99cba16d9aab14a94ebad3
SHA512 cac896476bb62cc05f98dc1f3bee033153f3614e38593475df47a389943716201ddc86030eca6a055df5ba52d3e1fef795bc2647745fcf5eb3ee2d26465deeb7
SSDEEP 6144:cknuA9cCb/e10CkU6FLnXrk6+fPs3BkDw30mP:qCb/s0CkU6FPk6+fPs3yU
TLSH
T16C64291077908432DF67E4F678798278666BBC2067F5CADB7380292E9A3DFE15934207
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4416-22-0x00000000032B0000-0x00000000032F9000-memory.dmp

Download

memory/4416-13-0x0000000010000000-0x00000000100A1000-memory.dmp

Download

memory/4416-32-0x0000000003FE0000-0x00000000040B2000-memory.dmp

Download

memory/5616-64-0x0000000000E00000-0x0000000000E9B000-memory.dmp

Download

memory/5616-65-0x0000000001360000-0x0000000001401000-memory.dmp

Download

memory/5616-72-0x0000000001360000-0x0000000001401000-memory.dmp

Download

memory/5616-74-0x0000000010000000-0x00000000100D2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads