079397f455ea335234985520fc61ce28113dbb039a0bdccb3512d9af4e75bda4

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
899s
max time network
430s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
reFX Nexus Expansion Packs.exe
Size 2.4MB
Sample260729-pgp2mstenc
SHA256 079397f455ea335234985520fc61ce28113dbb039a0bdccb3512d9af4e75bda4
MD5 7727b52b93c1e4003ed9d7074335d519
SHA1 5321e651e1e91207bbc7089d454d09e9dce72793
SHA512 adbca32567f9aae99f49bed0f051087d22afa94e373d3533e45cbd4ec1e2cc937813c673852cabac9ff6b5adfef0667ad67029a57663400a04b2eeca2d56b71b
SSDEEP 49152:uSal82CK8XWdC5MB5gKQnv6wm+notDuaDcGKIGCpehV6BpH:urlPnGK4MLr+otDuafeV6P
TLSH
T199C533B98851DE5AC4E6E931C12A18F9F4D3734C58A1A780A7A0CF7EBDB5603873B54C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Loads dropped DLL 5 IoCs

pid	Process
6104	reFX Nexus Expansion Packs.exe
6104	reFX Nexus Expansion Packs.exe
6104	reFX Nexus Expansion Packs.exe
6104	reFX Nexus Expansion Packs.exe
6104	reFX Nexus Expansion Packs.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reFX Nexus Expansion Packs.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Control Panel\Colors	reFX Nexus Expansion Packs.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	reFX Nexus Expansion Packs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	reFX Nexus Expansion Packs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	reFX Nexus Expansion Packs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	reFX Nexus Expansion Packs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	reFX Nexus Expansion Packs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	reFX Nexus Expansion Packs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	reFX Nexus Expansion Packs.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
6104	reFX Nexus Expansion Packs.exe
6104	reFX Nexus Expansion Packs.exe
6104	reFX Nexus Expansion Packs.exe

C:\Users\Admin\AppData\Local\Temp\reFX Nexus Expansion Packs.exe
"C:\Users\Admin\AppData\Local\Temp\reFX Nexus Expansion Packs.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6104

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2012

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

NSIS_SkinCrafter_Plugin.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw39F3.tmp\NSIS_SkinCrafter_Plugin.dll
Size 4.1MB
SHA256 7b812a2ea93b9ba362121ec2792a4f91b5045f6d6ad24ac7e33b60d1d1fce8df
MD5 065d72e70e51716c36a21a5d2cae29d7
SHA1 3cb08f1730009ed107ce71e727a5184b0477ec46
SHA512 29066cddb5fbd4c30c03bdf07386b0d88b294703e7406ad9a941d52172feb37984fe7269ca989406ed362f366abf2de4a51bd0d9ca74e81aa75a11fd2b8e23c0
SSDEEP 49152:8E40K2L1Pjf2AKWmFcLulMZ9HbqRhdrftIxrCNRrGnsbpOVlQWMkVsW44If8a:8E40Kg9frmFcqlMZ4vpHfOVlQnzW4p
TLSH
T1F916AF02B286D4F5C66322702A2EB336A3F9EE2547345A473BD9BE1C5B31543A637317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SkinCrafter.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw39F3.tmp\SkinCrafter.dll
Size 424KB
SHA256 2b3c11d9563af56f7eea83a9428cb95fadc7f6630eaefcff348981ebadda5d67
MD5 400cb1276ccebd004e091fb2101666fd
SHA1 f3507472836ac1be602f98a287120609be36fa3c
SHA512 3feb707da778926c4aae36a7808d8f8b4b178a4058dac3126a7f93fc3dea3b310cf8100960492100bd36aed17de105bfe8fe56505f1bb3a051ea18367cac3548
SSDEEP 12288:rKNVoKAh/eWHqv6n9ZJ8RfKLQEXiRgha4Y:r6oKAh/eWHqv6nDJufKLQ2iRghah
TLSH
T1FB944B01F9A740F5DE0A2930252A777AA27C9BD98B3DEFC3676CEE6E1D321C24035516
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw39F3.tmp\nsDialogs.dll
Size 8KB
SHA256 8396244efbea72ea690620d15dadfad677c9b8437bed449975c70fb226b7bb58
MD5 4dbb58b475546533ee3362138666dfa0
SHA1 4c8cab333d53601258a19654fd03ff193a29796e
SHA512 e83e8dd948bda25842986ae91e3a0e1b574d3fa0971f0af6b0388c618b2dd549a72b6c93062f3fc9804ecd370724bcb06bb8cd86c05c2a0bb99ba68170ecf3cf
SSDEEP 96:rk51aBOZ5dPhwMPFkzN2ZfyGE1xoR0roHpYkUZ/L/m:rkmifFkzQZftEI0roJxUZ/S
TLSH
T154F1F87A37C454F7C7EA02B42916267793BCD531237360269A3BA78A7A90F0BEE15341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/6104-12-0x00000000024D0000-0x0000000002540000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads