b23e799c9f2221859988082bdab0ebee4fccab4b83d9aac4ac1ae53ab19b7a73

Analysis

user interaction
yes
max time kernel
149s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/07/2026, 10:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
nox_setup_v7.0.5.9_full_intl.exe
Size 754.3MB
Sample260702-mc6sgset8k
SHA256 b23e799c9f2221859988082bdab0ebee4fccab4b83d9aac4ac1ae53ab19b7a73
MD5 e48da59c31e8cb59cb83a052a69dd394
SHA1 3163921997c850f0e73c050e85338e34c5244c5c
SHA512 822eb6776c66a5d273bfde81cf093e10ce71fac49ba1e4b586cc78c97e50947d1f1a629cc4151a5d635cc1eace27acfc55225412eb87f94b29ad176433e05fb7
SSDEEP 12582912:LHfnFcdlknp4CDGbPF3X+VYwwuyzsBdSN9LFHKixFcl5S8+wR6qzixQZ562Yd/SJ:LfnKLk+6G9+Vzw1HK2cbS7YsU5HYd9tU
TLSH
T138893302B7C29472D6D202759AE5D33BAE6976214335D0D3ABF0266B0F315D2E73E389
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
2280	CheckGLVersion.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nox_setup_v7.0.5.9_full_intl.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	mspaint.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	nox_setup_v7.0.5.9_full_intl.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 5c0000000100000004000000000800000f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000004348a0e9444c78cb265e058d5e8944b4d84f9662bd26db257f8934a443c7016114000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd97f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d701030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	nox_setup_v7.0.5.9_full_intl.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2528	vlc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4800	mspaint.exe
4800	mspaint.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2528	vlc.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
2528	vlc.exe
2528	vlc.exe
2528	vlc.exe
2528	vlc.exe
2528	vlc.exe
2528	vlc.exe
2528	vlc.exe
2528	vlc.exe
2528	vlc.exe
2528	vlc.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
2528	vlc.exe
2528	vlc.exe
2528	vlc.exe
2528	vlc.exe
2528	vlc.exe
2528	vlc.exe
2528	vlc.exe
2528	vlc.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4800	mspaint.exe
3396	OpenWith.exe
2528	vlc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 2280	4564	nox_setup_v7.0.5.9_full_intl.exe	86

C:\Users\Admin\AppData\Local\Temp\nox_setup_v7.0.5.9_full_intl.exe
"C:\Users\Admin\AppData\Local\Temp\nox_setup_v7.0.5.9_full_intl.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Users\Admin\AppData\Local\Nox\CheckGLVersion.exe
  "C:\Users\Admin\AppData\Local\Nox\CheckGLVersion.exe "
  2⤵
  - Executes dropped EXE
  PID:2280

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\SkipEnter.jfif" /ForceBootstrapPaint3D
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4800

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
1⤵
- Drops file in System32 directory
PID:4656

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3396

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\RedoImport.mov"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CheckGLVersion.exe

Path C:\Users\Admin\AppData\Local\Nox\CheckGLVersion.exe
Size 60KB
SHA256 15868cd72d0acff143b6101772190428927781334bbf6218465ed526544d76b6
MD5 ac0f922fd1f2bbd56d96f602ae44e28c
SHA1 e18b6cd5b630f65148342699048c21cc9f111187
SHA512 222e7e29d5829bccfdb5d49ac48d5359be7abd985eedb53aba5a514cc67ccfb6c4288108d008da5244ea9901dc29ae6d28092fa3a2002fa63b69cf87eb440989
SSDEEP 1536:fogSah2rmTcsrRd4TcF6lPsXA2IzliDP3rO9T50u:wXNrmTcGgcFe0XbIzliDP3re50u
TLSH
T1DA536B4A23A504F5E5638734C8F29A16E7B2F8531379834F476883A69F93382AD3D735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NOX9566.tmp

Path C:\Users\Admin\AppData\Local\Temp\NOX9566.tmp
Size 2KB
SHA256 dfd55944df560ef7d1d9bb058f03e0d80e53a9d4eca0461cd67077da25f680c0
MD5 f529dd5c9109598721d753efaf306acd
SHA1 69aacdef7ebb9a1f974b659c8831a59107538dcc
SHA512 689d35f0ca1889e52e55dbd50d5ae646ad8b52ad78cd76159a96508b7a4837c6d0a632584a462b4bfcd4676e7fbb62ac78d4b839874b5ed05ff36416dbe0c514
TLSH
T16E41403FEB49133626F103ABF50B28A1BB16145C432719EF949E5508330B26C17BF5E5
MD5 SHA1 SHA512 TLSH

Submit Download

NOX95A7.tmp

Path C:\Users\Admin\AppData\Local\Temp\NOX95A7.tmp
Size 14KB
SHA256 a1e348fd9ebf170ee6864f960c010fa89de32d992c6bd52c3960e7231ba04b74
MD5 90d2edf41c693375a6246787ab76987f
SHA1 874d1df6f6fecbf714881134283af3005a1de431
SHA512 41f5028f4c0a41686ab77cd09770bfa38294d599bbc26db9c2591592f93f9c935ef0d0ab8b1a7a7fd83aac74f859a36b169d5ab59f484652f09a0f854cd3d4f3
SSDEEP 192:HGTkEc+NTJS0Hi1gjaTuEnWmUOIR7zKbEWvQQPiBkR8UWZZfVPxko2i6R:mLpHiukuESOIhzuEWHaBaFqVSi+
TLSH
T1D3527DC3C90A2B2DE53C5DF51CFCE2AE2A06573D242DB059A588FE836A5047F505CBC6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2528-94-0x00007FF9DA180000-0x00007FF9DA436000-memory.dmp

Download

memory/2528-93-0x00007FF9EE2F0000-0x00007FF9EE324000-memory.dmp

Download

memory/2528-92-0x00007FF6E23D0000-0x00007FF6E24C8000-memory.dmp

Download

memory/4656-74-0x0000018239520000-0x0000018239521000-memory.dmp

Download

memory/4656-76-0x0000018239520000-0x0000018239521000-memory.dmp

Download

memory/4656-78-0x00000182395B0000-0x00000182395B1000-memory.dmp

Download

memory/4656-77-0x00000182395B0000-0x00000182395B1000-memory.dmp

Download

memory/4656-79-0x00000182395C0000-0x00000182395C1000-memory.dmp

Download

memory/4656-80-0x00000182395C0000-0x00000182395C1000-memory.dmp

Download

memory/4656-72-0x00000182394A0000-0x00000182394A1000-memory.dmp

Download

memory/4656-65-0x0000018228960000-0x0000018228970000-memory.dmp

Download

memory/4656-61-0x00000182281B0000-0x00000182281C0000-memory.dmp

Download