cd3e007902bcc034389de8feae33b38f85460275ec36c1896adf40ab4b79c675

Analysis

max time kernel
150s
max time network
119s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 01:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
nxwitness-client-6.1.2.42921-windows_x64.exe
Size 232.6MB
Sample260803-bessvszycs
SHA256 cd3e007902bcc034389de8feae33b38f85460275ec36c1896adf40ab4b79c675
MD5 87c7736bfb056387389ae180a7359483
SHA1 39825239f6bced3b95a463129c15787617a7b5b6
SHA512 222f2a4332e7037b636d2e763cc4c37b3ac39aa68e60a8ad33caf9b8bd57246e1c96311110e447e4e55adf079b4897ab0b4101ed92a0a1b1be3bc415aba78dff
SSDEEP 6291456:vF927pz0WeMxQiy+YCV2jyhxuIkJlE1uEVQ/WsEhKIhrX:tI7pz062ibYCVQybuLlPEVQtZIhrX
TLSH
T1D4C833015528EF77CD24A930E37022BCE7393626069B0969D65CFAE596772CF32B2DC1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 1 IoCs

pid	Process
428	nxwitness-client-6.1.2.42921-windows_x64.exe

Loads dropped DLL 1 IoCs

pid	Process
428	nxwitness-client-6.1.2.42921-windows_x64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nxwitness-client-6.1.2.42921-windows_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nxwitness-client-6.1.2.42921-windows_x64.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3312 wrote to memory of 428	3312	nxwitness-client-6.1.2.42921-windows_x64.exe	88

C:\Users\Admin\AppData\Local\Temp\nxwitness-client-6.1.2.42921-windows_x64.exe
"C:\Users\Admin\AppData\Local\Temp\nxwitness-client-6.1.2.42921-windows_x64.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3312
- C:\Windows\Temp\{E31F3836-1A7F-4242-93CB-BAD76EA5F30D}\.cr\nxwitness-client-6.1.2.42921-windows_x64.exe
  "C:\Windows\Temp\{E31F3836-1A7F-4242-93CB-BAD76EA5F30D}\.cr\nxwitness-client-6.1.2.42921-windows_x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\nxwitness-client-6.1.2.42921-windows_x64.exe" -burn.filehandle.attached=748 -burn.filehandle.self=752
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

installer_bg.png

Path C:\Windows\Temp\{AF6CD8A2-9A4A-4267-B27D-80F2366558E4}\.ba\installer_bg.png
Size 37KB
SHA256 fb31933db9d3d9344058582233f388efb68620fbd79463f882f83526fad088f4
MD5 9f124524d4fdebb29d35d721a973fa38
SHA1 c7fb30ef75c96e1c02f0a0d598bb52235a45e747
SHA512 b74e4b81b0b60c40143e664277b36c38032876172c1e02211facfe267e24bb7b25b5605e4b123269b267b9ef23564a2ac0c4451a82c6526384c2619b906297b4
SSDEEP 768:GTjGC024eAU+nrGaEeAdP9YSimFxWYmlyEiKwzhMgIoJxTpXxo+R1/Nx+X:GTjb2U+nrGa0dPx84AGMgI8xTpXj1/NA
TLSH
T12003E020AEB5F8DD86E4B43EE3B12AF19305952BE090C145D9F04D0A2DA1952FDDDE3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo-102x102.png

Path C:\Windows\Temp\{AF6CD8A2-9A4A-4267-B27D-80F2366558E4}\.ba\logo-102x102.png
Size 3KB
SHA256 aa31348a1b4e84ddc31bdf0f451809e36b115b406f189d1fe28ca0e83bd23ea1
MD5 4d1d01ab3b10ef40c33ba0194105ba77
SHA1 fe30c9e43e94ee0d4c3586ce24c077334dbac648
SHA512 5b1b06d99974127ab31115e10ccf43dafeacb0d3de0e3e0f28c3be9ceb9850fa9c6845586167ad4275395305623d0d64a54b57588b2b04a18b753d4bcd193c97
TLSH
T1EF616CD7925DA95356BF8BB306A508387AA215433772A6C0449B30BF4216E247B74FA0
MD5 SHA1 SHA512 TLSH

Submit Download

logo-64x64.png

Path C:\Windows\Temp\{AF6CD8A2-9A4A-4267-B27D-80F2366558E4}\.ba\logo-64x64.png
Size 1KB
SHA256 3f171f9d2ff0944141ad2e3fbaac4969f041b4d724d5e57577092c26dfc0d0d2
MD5 76f41c75bf97d967255a144b5086db99
SHA1 04fa045086c099295b220c516abafd1de320a134
SHA512 a884996f1e2e39e53ea067247d1e6450eadba2d2e4f9143d1837ea934c3364487086c6130d2ba0c35d3511846cc9cfcf6fb581fe0b7df408ec44d020e9f6148b
TLSH
T1F7410CECBB243B947188BB2C549BE4E2CCE2668C002987D8B1B1784783E628531DD1E3
MD5 SHA1 SHA512 TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{AF6CD8A2-9A4A-4267-B27D-80F2366558E4}\.ba\wixstdba.dll
Size 205KB
SHA256 b7de0a0ca3a94738747abd708e30ba1f9638a8c8b7d8173c76d4f39fae3d9346
MD5 87c8a7ea44e8ee0d9358e25b7dcd397d
SHA1 0e2021be823fee499175d2c0d68346d15c02a376
SHA512 98b5bbe5bb3ec331a0025e3da209296050b2f695be5a4b90b5c939f8fbbaada6dd93483eba779c10151546c2798aab5282fa619a55ec0cf04f56a03795a0a3f5
SSDEEP 3072:tEIwsGi6eTe5uBR3SupIu+ieZpKamkOLCaQuEsSyhssS2KPjbfkd4qhgTrm9b3EJ:tEZdi6e93SuDeTKZxQfsRy26BqbUHF
TLSH
T18524AE12F5D0907AEBFB1930593AA6206DBDB9200FA0C9CE53486D2B6E705C1DB36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nxwitness-client-6.1.2.42921-windows_x64.exe

Path C:\Windows\Temp\{E31F3836-1A7F-4242-93CB-BAD76EA5F30D}\.cr\nxwitness-client-6.1.2.42921-windows_x64.exe
Size 923KB
SHA256 49ba47553b1634563d2db468bb124dd0dd82e33b303d5700cb10c0c50fe3349c
MD5 2211debe8d9d504345679b65f0bebc16
SHA1 2be1822b4c99e274a8f1cb16484b050dd621c8ff
SHA512 112bf41bff3b9247be7122fb8fad02589953e1cba8f63dc8d1d811e4204949b63e194716fef47f056fbcb3fd6d55ea555455e13f9182d00b0bc0814760a99d17
SSDEEP 12288:+3mgqnIZuYfCYqFet4CovkM7fknEINBwPyjFhsHr/jWl:+3WnIZuMCxezot7fM4PyXBl
TLSH
T176152B201010C572DFE5163276B84730E93CBF2197EF82AE95E6BA48EA79C9C25F31D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads