c80313c8471808b0a7c97b3768f518776b7fe394f0ff303efc310f1f40815dd3

Analysis

user interaction
yes
max time kernel
155s
max time network
220s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 18:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Autodesk AutoCAD v2024.3 (x64) + Crack [New 2024].exe
Size 1016.3MB
Sample260802-wrfdhsvsgv
SHA256 c80313c8471808b0a7c97b3768f518776b7fe394f0ff303efc310f1f40815dd3
MD5 0a8a54db1bbebff84c17c6785c30acd1
SHA1 20717d5309834c2b2387d9180dd4ae2df8a24ebd
SHA512 b1a35f871f67c69acadb103862c87c194aac8d32b6d68e030b88e70262614f1e4e0d592a18a15ce0040f02ad1708eb9ef34727944969b40bfa818697a7f69393
SSDEEP 25165824:EXA62PCmJV+kPZKWSvPYfURuUgB/fpsH4Jj6+XS3TZK0zKe6NO6:EW5v+kPZyvP5RuUgRfOH4tTXKIwKbM6
TLSH
T1CBB9330E56C122AAF7E81BBBAC55E8C3790D63DADCC2D984B5C25FE2746DBF41093421
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery installer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3904	starter.exe

Loads dropped DLL 6 IoCs

pid	Process
4464	Autodesk AutoCAD v2024.3 (x64) + Crack [New 2024].exe
4464	Autodesk AutoCAD v2024.3 (x64) + Crack [New 2024].exe
4464	Autodesk AutoCAD v2024.3 (x64) + Crack [New 2024].exe
4464	Autodesk AutoCAD v2024.3 (x64) + Crack [New 2024].exe
3904	starter.exe
3904	starter.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Autodesk AutoCAD v2024.3 (x64) + Crack [New 2024].exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	starter.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x00070000000245a3-34.dat	nsis_installer_1
behavioral1/files/0x00070000000245a3-34.dat	nsis_installer_2

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{494D59DF-E232-4F6C-A513-E49EA25A2A60}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{F4049EA3-0D23-4C85-98CB-FB01A22D469A}	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4748	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4748	OpenWith.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4464 wrote to memory of 3904	4464	Autodesk AutoCAD v2024.3 (x64) + Crack [New 2024].exe	90

C:\Users\Admin\AppData\Local\Temp\Autodesk AutoCAD v2024.3 (x64) + Crack [New 2024].exe
"C:\Users\Admin\AppData\Local\Temp\Autodesk AutoCAD v2024.3 (x64) + Crack [New 2024].exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Users\Admin\AppData\Local\Temp\nsx6FC8.tmp\starter.exe
  "C:\Users\Admin\AppData\Local\Temp\nsx6FC8.tmp\starter.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3904

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4748

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:3352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 1KB
SHA256 63b14543360f5e89942ea8d5113526e64fbc71c1207328f0136b3a495d921dd0
MD5 adac67e1d2da2d706db151c2db316b2d
SHA1 5f6e301d23e33132209707945d0e740d5bcb8996
SHA512 9371b62ac25c6ea8fb6fca19ac47b873ced9b3d0cb45ce4de5ea974b93c12684c65aa23c7d83331c77502853258a08dff73ce5e3fb6170bd3ab1c5b3283a86a9
TLSH
T1DE31AD4EA2153027D5427F72D8CEBE83CEB1364667CAD46B18046E4229AAFC25FC80C9
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
Size 528B
SHA256 d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c
MD5 047f3e9d21d6b325d592b1959e4362e6
SHA1 5aeef5f985171cd69da397fd039854e44ebecdd2
SHA512 4523896ed4a03afafd2075d8c8947236d34fe1da2c246a3f90c2be2a5c151c18bc58a6cde5a209abb8e06e80f662e24d0149640b3e98e8a872bfa8a04ef592a4
TLSH
T147F0500990082252C855FF55DFD6AC97DC76336136E595036D458E410C12F96AF950F5
MD5 SHA1 SHA512 TLSH

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 174B
SHA256 552a5f5e8da7f95b0e46e26c58132db115dfe2de9096205d41a932b9a9e2f7aa
MD5 e99df1f5c1a9c99d8fd96a6cce39512d
SHA1 3fac1f052b48251fa7bcf7503e0b465fdfbe6a50
SHA512 f33b0162f2ec7024430981ae4e7447a9620d58a93131f51c7d63b65d9e5e3db4dcb46f598d79e026ec3fbba745e8b4bd34ffe63c9a6d0cd037bfc8cfa7a2def2
TLSH
T15EC04C0537B54155F1304D7F165253114BFEE605CD4183544F606259951DA425CE5D06
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
Size 170B
SHA256 77709d36f372d85c0c4a12ca8d9580fbfea62e43f2cce1caf0c634538d8003d0
MD5 c201ce52b38a2d4eecb642a1f8cb947e
SHA1 a38b050357b930cc0d87db465dfa9c85ce85cc69
SHA512 0e678a7b7a06d3ef3f6f4e6fa8f30a514e573b6c771e9a1d566c96dbe3798db3dc0eb6255440f2ee8d18dfd201f20848c6ee5d5558737521732e125d99e631ff
TLSH
T1CCC09214B3A98B1AF11E613E79E61B041BFB920AF6CAC3044BB815798929A400CB2D0A
MD5 SHA1 SHA512 TLSH

Submit Download

inetc.dll

Path C:\Users\Admin\AppData\Local\Temp\nscC82A.tmp\inetc.dll
Size 22KB
SHA256 89e24e4124b607f3f98e4df508c4ddd2701d8f7fcf1dc6e2aba11d56c97c0c5a
MD5 cab75d596adf6bac4ba6a8374dd71de9
SHA1 fb90d4f13331d0c9275fa815937a4ff22ead6fa3
SHA512 510786599289c8793526969cfe0a96e049436d40809c1c351642b2c67d5fb2394cb20887010727a5da35c52a20c5557ad940967053b1b59ad91ca1307208c391
SSDEEP 384:PWc7V9H6MVsnCPFN4DC5/kdhdj/ouVj19L0d10Ac9khYLMkIX0+GbyeEaI2sJ:PWqTH/V7tHSWutp
TLSH
T19BA2E6124A600AF7E3B90534B0AB37530769EE72646565D786F32AC93874393FF36722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INetC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx6FC8.tmp\INetC.dll
Size 25KB
SHA256 85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9
MD5 40d7eca32b2f4d29db98715dd45bfac5
SHA1 124df3f617f562e46095776454e1c0c7bb791cc7
SHA512 5fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d
SSDEEP 384:pjj9e9dE95XD+iTx58Y5oMM3O9MEoLr1VcQZ/ZwcSyekMRlZ4L4:dAvE90GuY2tO93oLrJRM7Z4E
TLSH
T1F0B2F99257EA179AF7BAAB3478B9E762497FBC211821CCCF5533068D1872241ED30727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NSISdl.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx6FC8.tmp\NSISdl.dll
Size 15KB
SHA256 aab28914794a1cdda4561e9f2af3e006dbed220d9d6bfe049b56d0cb9b783648
MD5 05f72d6a944e701217ef2eb2cc13e0ee
SHA1 fac99c39150ae484e4b3e0af2f4be86bb1835dde
SHA512 c87e783fc169ef01ac0d3ce29fbfbf349a2e22329df9203a1443cc2caebbe7f8282c0754740289ecca534951cb7e574bafef9ccbaa0da7c287109920ec9573eb
SSDEEP 384:hRy180+1ygVaLfKgcIno1gEBWZwCUKihb:hRy180+HSegEBWyQih
TLSH
T185623C46AA2084F1DBA2167034D33E3A67F18E751A2484C247F35D4FAE16317B37A986
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx6FC8.tmp\System.dll
Size 12KB
SHA256 9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706
MD5 4add245d4ba34b04f213409bfe504c07
SHA1 ef756d6581d70e87d58cc4982e3f4d18e0ea5b09
SHA512 1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d
SSDEEP 192:VjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZv0QPi:B/Qlt7wiij/lMRv/9V4bvr
TLSH
T188426C1297B089F2F551493419667F2A6FBEAC5D27F405A3CFE304C63D212DBA879243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx6FC8.tmp\nsDialogs.dll
Size 9KB
SHA256 4b7d17da290f41ebe244827cc295ce7e580da2f7e9f7cc3efc1abc6898e3c9ed
MD5 1d8f01a83ddd259bc339902c1d33c8f1
SHA1 9f7806af462c94c39e2ec6cc9c7ad05c44eba04e
SHA512 28bf647374b4b500a0f3dbced70c2b256f93940e2b39160512e6e486ac31d1d90945acecef578f61b0a501f27c7106b6ffc3deab2ec3bfb3d9af24c9449a1567
SSDEEP 96:o4Ev02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YsNqkzfFc:o4EvCu5e81785qHFcU0PuAw0uyGIFc
TLSH
T12A120992E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

starter.exe

Path C:\Users\Admin\AppData\Local\Temp\nsx6FC8.tmp\starter.exe
Size 10.9MB
SHA256 a3303687c971de07432d23f9b34173a6d4ef7dc92cf95ed2caecb64b20d0e55f
MD5 38b0dcfa13f5a15f4d7b6a33f63fb9e1
SHA1 e91d87401be35d183b16f04770c054e6812e7ca3
SHA512 3dadc9f9fee7aa5d5ef52a1837a0f0071db835e6abcf31c400f4c5595a1601592d86b2d56b903c84ce9332054df8ea781d5e352e77bef399b76f1d2bc9fe9839
SSDEEP 196608:4Thbj2uz7n0ayqgsqlRmTXf9nPrt0t3tV91gj9u/qgoPIOYpJ7jEhLXZk4Vr9Fo6:4Th+CQ9z7kNTutXigYI9pJXi+UxYPpFg
TLSH
T10CB633CB22D5D613E94AAB736E2F05A710E4E3C618939C3A4795BC6B7D3134865FC2E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads