Analysis
- user interaction
yes - max time kernel
96s - max time network
99s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
22/07/2026, 17:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NexusMods.exe
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
900 seconds
Errors
Reason
Machine shutdown
General
- Target NexusMods.exe
- Size 6.5MB
- Sample260722-vsj8esdn4v
- SHA256 7b02368cf2281d69a6d78dfe52ef00e8ffd3b0cc35f1abd0bde61de8b56e8d03
- MD5 4fc4a97714dd965086fbbd7cf398f72c
- SHA1 9a95dd4532f7e6703e461382c387e25b1cb7c7a7
- SHA512 32748b970c97923d87787a7d28fd3f0127cb2a8406d856a16cdf44cb3d8b1547fab5d6e920d316be735b550d00b1da50d5f819e8d65f8e6113a56dc1c47447b5
- SSDEEP 49152:OQ5wKyD/UzzobuH1twKVR6Se6gawYOzeZqPWLPrXJ+:1xL4
- TLSH T15966086B62DC95A9C15EC13AC1D68AC2EAF3B07D8F33F1E711A11374CA59BC44E3A521
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\taskschd.msc mmc.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Modifies data under HKEY_USERS 15 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "190" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268" LogonUI.exe - Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2654269261-3199571979-4291878722-1000\{BCA20F92-242B-4487-89BD-91D6FCD059CE} NexusMods.exe Key created \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.WindowsTerminal_8wekyb3d8bbwe\StartTerminalOnLoginTask taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings taskmgr.exe - Suspicious behavior: EnumeratesProcesses 27 IoCs
pid Process 3832 NexusMods.exe 3832 NexusMods.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1640 mmc.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: 33 1640 mmc.exe Token: SeIncBasePriorityPrivilege 1640 mmc.exe Token: 33 1640 mmc.exe Token: SeIncBasePriorityPrivilege 1640 mmc.exe Token: 33 1640 mmc.exe Token: SeIncBasePriorityPrivilege 1640 mmc.exe Token: 33 1640 mmc.exe Token: SeIncBasePriorityPrivilege 1640 mmc.exe Token: 33 1640 mmc.exe Token: SeIncBasePriorityPrivilege 1640 mmc.exe Token: 33 1640 mmc.exe Token: SeIncBasePriorityPrivilege 1640 mmc.exe Token: 33 1640 mmc.exe Token: SeIncBasePriorityPrivilege 1640 mmc.exe Token: 33 1640 mmc.exe Token: SeIncBasePriorityPrivilege 1640 mmc.exe Token: 33 1640 mmc.exe Token: SeIncBasePriorityPrivilege 1640 mmc.exe Token: 33 1640 mmc.exe Token: SeIncBasePriorityPrivilege 1640 mmc.exe Token: 33 1640 mmc.exe Token: SeIncBasePriorityPrivilege 1640 mmc.exe Token: 33 1640 mmc.exe Token: SeIncBasePriorityPrivilege 1640 mmc.exe Token: 33 1640 mmc.exe Token: SeIncBasePriorityPrivilege 1640 mmc.exe Token: 33 1640 mmc.exe Token: SeIncBasePriorityPrivilege 1640 mmc.exe Token: 33 1640 mmc.exe Token: SeIncBasePriorityPrivilege 1640 mmc.exe Token: 33 1640 mmc.exe Token: SeIncBasePriorityPrivilege 1640 mmc.exe Token: 33 1640 mmc.exe Token: SeIncBasePriorityPrivilege 1640 mmc.exe Token: 33 1640 mmc.exe Token: SeIncBasePriorityPrivilege 1640 mmc.exe Token: 33 1640 mmc.exe Token: SeIncBasePriorityPrivilege 1640 mmc.exe Token: 33 1640 mmc.exe Token: SeIncBasePriorityPrivilege 1640 mmc.exe Token: 33 1640 mmc.exe Token: SeIncBasePriorityPrivilege 1640 mmc.exe Token: 33 1640 mmc.exe Token: SeIncBasePriorityPrivilege 1640 mmc.exe Token: 33 1640 mmc.exe Token: SeIncBasePriorityPrivilege 1640 mmc.exe Token: 33 1640 mmc.exe Token: SeIncBasePriorityPrivilege 1640 mmc.exe Token: 33 1640 mmc.exe Token: SeIncBasePriorityPrivilege 1640 mmc.exe Token: 33 1640 mmc.exe Token: SeIncBasePriorityPrivilege 1640 mmc.exe Token: 33 1640 mmc.exe Token: SeIncBasePriorityPrivilege 1640 mmc.exe Token: 33 1640 mmc.exe Token: SeIncBasePriorityPrivilege 1640 mmc.exe Token: 33 1640 mmc.exe Token: SeIncBasePriorityPrivilege 1640 mmc.exe Token: 33 1640 mmc.exe Token: SeIncBasePriorityPrivilege 1640 mmc.exe Token: 33 1640 mmc.exe Token: SeIncBasePriorityPrivilege 1640 mmc.exe Token: 33 1640 mmc.exe Token: SeIncBasePriorityPrivilege 1640 mmc.exe - Suspicious use of FindShellTrayWindow 50 IoCs
pid Process 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe - Suspicious use of SendNotifyMessage 50 IoCs
pid Process 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe 1176 taskmgr.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1640 mmc.exe 1640 mmc.exe 4192 LogonUI.exe - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\NexusMods.exe"C:\Users\Admin\AppData\Local\Temp\NexusMods.exe"1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3832
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /s1⤵
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1640
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1176
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4020
-
C:\Windows\System32\olfsaw.exe"C:\Windows\System32\olfsaw.exe"1⤵PID:2996
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa39b9055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4192