Resubmissions
30/07/2026, 05:54
260730-gl2bgacf99730/07/2026, 05:48
260730-ghnwzat1fy729/07/2026, 22:56
260729-2wz7dagd437Analysis
- user interaction
yes - max time kernel
149s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 05:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
niggerware.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target niggerware.exe
- Size 8.7MB
- Sample260730-gl2bgacf99
- SHA256 1568f4a8bb6bb6049196ca907943a8881a8d1e507837cb278e0c0b049bcda6e9
- MD5 a1ddbd867ea1c323abc24806f736d6ac
- SHA1 d69237195032d5302fca5598dca53386e478eb87
- SHA512 bbcbfa9b83d3d5c3514a587cd264c3283f9d4ad5956ffbd537137dca4035be0f8dbef4416a6a446d705b33559488053bb798e4a0f42351f42de0eda73c682b04
- SSDEEP 98304:DO0O7bwbr2fE3peheNkQkpkDuRvBK9mEs65csrBKjqrZ6M:Dy3783pceNkQkIuRENs6asrBKjIf
- TLSH T113967B07ECA558E9C4ADD1308A729552BF71BC590B3023D71BA0F6283F76BD0AEB9354
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 2032 niggerware.exe 4572 niggerware.exe - Loads dropped DLL 1 IoCs
pid Process 2860 Taskmgr.exe - Modifies trusted root certificate store through registry 1 TTPs 2 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c61900000001000000100000002fe1f70bb05d7c92335bc5e05b984da6030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f6314000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 niggerware.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c00000001000000040000000010000014000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e81900000001000000100000002fe1f70bb05d7c92335bc5e05b984da66b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 niggerware.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName Taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 Taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A Taskmgr.exe - Modifies system certificate store 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 niggerware.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2860 Taskmgr.exe Token: SeSystemProfilePrivilege 2860 Taskmgr.exe Token: SeCreateGlobalPrivilege 2860 Taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe 2860 Taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2860 Taskmgr.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4232 wrote to memory of 2032 4232 niggerware.exe 90 PID 1824 wrote to memory of 4572 1824 niggerware.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\niggerware.exe"C:\Users\Admin\AppData\Local\Temp\niggerware.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Users\Admin\AppData\Roaming\WindowsUpdate\agent\niggerware.exe"C:\Users\Admin\AppData\Roaming\WindowsUpdate\agent\niggerware.exe"2⤵
- Executes dropped EXE
- Modifies trusted root certificate store through registry
- Modifies system certificate store
PID:2032
-
-
C:\Windows\System32\Taskmgr.exe"C:\Windows\System32\Taskmgr.exe"1⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2860
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:5684
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\niggerware.exe"C:\Users\Admin\AppData\Local\Temp\niggerware.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Users\Admin\AppData\Roaming\WindowsUpdate\agent\niggerware.exe"C:\Users\Admin\AppData\Roaming\WindowsUpdate\agent\niggerware.exe"2⤵
- Executes dropped EXE
PID:4572
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\WindowsUpdate\agent\niggerware.exe
- Size 8.7MB
- SHA256 1568f4a8bb6bb6049196ca907943a8881a8d1e507837cb278e0c0b049bcda6e9
- MD5 a1ddbd867ea1c323abc24806f736d6ac
- SHA1 d69237195032d5302fca5598dca53386e478eb87
- SHA512 bbcbfa9b83d3d5c3514a587cd264c3283f9d4ad5956ffbd537137dca4035be0f8dbef4416a6a446d705b33559488053bb798e4a0f42351f42de0eda73c682b04
- SSDEEP 98304:DO0O7bwbr2fE3peheNkQkpkDuRvBK9mEs65csrBKjqrZ6M:Dy3783pceNkQkIuRENs6asrBKjIf
- TLSH T113967B07ECA558E9C4ADD1308A729552BF71BC590B3023D71BA0F6283F76BD0AEB9354
- MD5 SHA1 SHA512 SSDEEP TLSH