c80313c8471808b0a7c97b3768f518776b7fe394f0ff303efc310f1f40815dd3

Analysis

max time kernel
127s
max time network
228s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 18:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Autodesk AutoCAD v2024.3 (x64) + Crack [New 2024].exe
Size 1016.3MB
Sample260802-wrfdhsvsgv
SHA256 c80313c8471808b0a7c97b3768f518776b7fe394f0ff303efc310f1f40815dd3
MD5 0a8a54db1bbebff84c17c6785c30acd1
SHA1 20717d5309834c2b2387d9180dd4ae2df8a24ebd
SHA512 b1a35f871f67c69acadb103862c87c194aac8d32b6d68e030b88e70262614f1e4e0d592a18a15ce0040f02ad1708eb9ef34727944969b40bfa818697a7f69393
SSDEEP 25165824:EXA62PCmJV+kPZKWSvPYfURuUgB/fpsH4Jj6+XS3TZK0zKe6NO6:EW5v+kPZyvP5RuUgRfOH4tTXKIwKbM6
TLSH
T1CBB9330E56C122AAF7E81BBBAC55E8C3790D63DADCC2D984B5C25FE2746DBF41093421
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery installer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3176	starter.exe

Loads dropped DLL 8 IoCs

pid	Process
52	Autodesk AutoCAD v2024.3 (x64) + Crack [New 2024].exe
52	Autodesk AutoCAD v2024.3 (x64) + Crack [New 2024].exe
52	Autodesk AutoCAD v2024.3 (x64) + Crack [New 2024].exe
52	Autodesk AutoCAD v2024.3 (x64) + Crack [New 2024].exe
3176	starter.exe
3176	starter.exe
3176	starter.exe
3176	starter.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Autodesk AutoCAD v2024.3 (x64) + Crack [New 2024].exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	starter.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral2/files/0x000d00000001c450-37.dat	nsis_installer_1
behavioral2/files/0x000d00000001c450-37.dat	nsis_installer_2

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{A7C445D5-EA77-4832-9FC8-7F8B1450D5AA}	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4844	OpenWith.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 52 wrote to memory of 3176	52	Autodesk AutoCAD v2024.3 (x64) + Crack [New 2024].exe	90

C:\Users\Admin\AppData\Local\Temp\Autodesk AutoCAD v2024.3 (x64) + Crack [New 2024].exe
"C:\Users\Admin\AppData\Local\Temp\Autodesk AutoCAD v2024.3 (x64) + Crack [New 2024].exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:52
- C:\Users\Admin\AppData\Local\Temp\nsx9378.tmp\starter.exe
  "C:\Users\Admin\AppData\Local\Temp\nsx9378.tmp\starter.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3176

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:928

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4844

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:5424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 1KB
SHA256 63b14543360f5e89942ea8d5113526e64fbc71c1207328f0136b3a495d921dd0
MD5 adac67e1d2da2d706db151c2db316b2d
SHA1 5f6e301d23e33132209707945d0e740d5bcb8996
SHA512 9371b62ac25c6ea8fb6fca19ac47b873ced9b3d0cb45ce4de5ea974b93c12684c65aa23c7d83331c77502853258a08dff73ce5e3fb6170bd3ab1c5b3283a86a9
TLSH
T1DE31AD4EA2153027D5427F72D8CEBE83CEB1364667CAD46B18046E4229AAFC25FC80C9
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
Size 528B
SHA256 d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c
MD5 047f3e9d21d6b325d592b1959e4362e6
SHA1 5aeef5f985171cd69da397fd039854e44ebecdd2
SHA512 4523896ed4a03afafd2075d8c8947236d34fe1da2c246a3f90c2be2a5c151c18bc58a6cde5a209abb8e06e80f662e24d0149640b3e98e8a872bfa8a04ef592a4
TLSH
T147F0500990082252C855FF55DFD6AC97DC76336136E595036D458E410C12F96AF950F5
MD5 SHA1 SHA512 TLSH

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 174B
SHA256 acbf52e6f971c217e752ef762744bbfc8a53450c25067d290a98a6b113db12aa
MD5 3349c1e5d7f14392eb789ef093fe4158
SHA1 04e1f622e26f6446cdae99170f99e23920ef7058
SHA512 ac4e393c1da4fcf4d4f6f151a2672deb12341128712d257110704a87895205d131ca560c6605768a30ac2399879e3bbfd124619d4dc10afd7e798bb2de9a6ce3
TLSH
T13AC09B1437B54556F1304D7F1693631147FAE605CD4183544F705259C51DF435CF5D06
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
Size 170B
SHA256 2fa44a90716e962422b7582f95f5cf91a5159bcfc17d24c569de0f1c0385d8d4
MD5 044409a843afe9d704da8c495d29ab19
SHA1 1037c1e82b6f130385b4eba2125f46b6dbb31a1a
SHA512 bd6cd6c4bfd8ed82d04367eee65c43d7014f37788f98476c383801c77e834c4f4f9032753555c792f06c792a7d1ad9ec20e22f423e1d46cd3ab605467ce67c5c
TLSH
T1D4C09224B3B9471AF24E613E79E61A041BBA830AF6CAC3048BB815398928A410CB2D09
MD5 SHA1 SHA512 TLSH

Submit Download

inetc.dll

Path C:\Users\Admin\AppData\Local\Temp\nsiDFE4.tmp\inetc.dll
Size 22KB
SHA256 89e24e4124b607f3f98e4df508c4ddd2701d8f7fcf1dc6e2aba11d56c97c0c5a
MD5 cab75d596adf6bac4ba6a8374dd71de9
SHA1 fb90d4f13331d0c9275fa815937a4ff22ead6fa3
SHA512 510786599289c8793526969cfe0a96e049436d40809c1c351642b2c67d5fb2394cb20887010727a5da35c52a20c5557ad940967053b1b59ad91ca1307208c391
SSDEEP 384:PWc7V9H6MVsnCPFN4DC5/kdhdj/ouVj19L0d10Ac9khYLMkIX0+GbyeEaI2sJ:PWqTH/V7tHSWutp
TLSH
T19BA2E6124A600AF7E3B90534B0AB37530769EE72646565D786F32AC93874393FF36722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INetC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx9378.tmp\INetC.dll
Size 25KB
SHA256 85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9
MD5 40d7eca32b2f4d29db98715dd45bfac5
SHA1 124df3f617f562e46095776454e1c0c7bb791cc7
SHA512 5fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d
SSDEEP 384:pjj9e9dE95XD+iTx58Y5oMM3O9MEoLr1VcQZ/ZwcSyekMRlZ4L4:dAvE90GuY2tO93oLrJRM7Z4E
TLSH
T1F0B2F99257EA179AF7BAAB3478B9E762497FBC211821CCCF5533068D1872241ED30727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NSISdl.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx9378.tmp\NSISdl.dll
Size 15KB
SHA256 aab28914794a1cdda4561e9f2af3e006dbed220d9d6bfe049b56d0cb9b783648
MD5 05f72d6a944e701217ef2eb2cc13e0ee
SHA1 fac99c39150ae484e4b3e0af2f4be86bb1835dde
SHA512 c87e783fc169ef01ac0d3ce29fbfbf349a2e22329df9203a1443cc2caebbe7f8282c0754740289ecca534951cb7e574bafef9ccbaa0da7c287109920ec9573eb
SSDEEP 384:hRy180+1ygVaLfKgcIno1gEBWZwCUKihb:hRy180+HSegEBWyQih
TLSH
T185623C46AA2084F1DBA2167034D33E3A67F18E751A2484C247F35D4FAE16317B37A986
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx9378.tmp\System.dll
Size 12KB
SHA256 9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706
MD5 4add245d4ba34b04f213409bfe504c07
SHA1 ef756d6581d70e87d58cc4982e3f4d18e0ea5b09
SHA512 1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d
SSDEEP 192:VjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZv0QPi:B/Qlt7wiij/lMRv/9V4bvr
TLSH
T188426C1297B089F2F551493419667F2A6FBEAC5D27F405A3CFE304C63D212DBA879243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx9378.tmp\nsDialogs.dll
Size 9KB
SHA256 4b7d17da290f41ebe244827cc295ce7e580da2f7e9f7cc3efc1abc6898e3c9ed
MD5 1d8f01a83ddd259bc339902c1d33c8f1
SHA1 9f7806af462c94c39e2ec6cc9c7ad05c44eba04e
SHA512 28bf647374b4b500a0f3dbced70c2b256f93940e2b39160512e6e486ac31d1d90945acecef578f61b0a501f27c7106b6ffc3deab2ec3bfb3d9af24c9449a1567
SSDEEP 96:o4Ev02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YsNqkzfFc:o4EvCu5e81785qHFcU0PuAw0uyGIFc
TLSH
T12A120992E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

starter.exe

Path C:\Users\Admin\AppData\Local\Temp\nsx9378.tmp\starter.exe
Size 10.9MB
SHA256 c21fbd78f62e71fb88e29cc1ee619e393210c2b2a5268bc96f2090051cedd51e
MD5 08b30db5a8cde3551e063527aee7a24c
SHA1 3a2728276c86508f5f13bb0c5ac0c72e691e5b0a
SHA512 d5504391c1b57092cfd35882b7d8b601e80de56c9ed6a4af79733f3d37bca2ff51e16f234e74caff381e5f245c34a1098109611dd0739b212e36ac8b2a43e367
SSDEEP 196608:iIcbzPh++6Bd+e4jSFLNrKYKeLmwXVTJWLtWgkzSNNdfSiZ+PPqCbBbmd:i5YoSdN4eLvUAgkzSpTZiPlBbc
TLSH
T1FDB633EB5327015EC99B05771EF22366B05463F3C6E15DE7C2AEC6AB1B3A2E2134051E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads