Analysis
- user interaction
yes - max time kernel
249s - max time network
252s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
03/08/2026, 09:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
run.zip
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
22 signatures
900 seconds
Errors
Reason
Machine shutdown
General
- Target run.zip
- Size 11.8MB
- Sample260803-lddmnatbme
- SHA256 31b176c08f7b51ad35a492f8d87aec48bee5c4f2bf1245b5213957bd7bb719ff
- MD5 d2a4699aae435afd548ec97237f00f21
- SHA1 dddc7841c28ca3316d09734600869e01a996e646
- SHA512 26c2186b37e1d9502f32efd67e7b435b599c3c036f9eb3acb54ed0c5f7df31f1ae6670c882bd136d3dfd201437f42d9556bea0d24ebdeee7399bca0c1ac9cfaf
- SSDEEP 196608:2V1luDAQC7zGXKxKK2GDH9JAnsZyTuyxoft+m2g+ikEdFo6fLSk:2roDAQnI92GSqq98eVEdP9
- TLSH T181C633ACD4613EAF69FE3E0C78A0C06035837D9F0E72EDA6B2945D86546C4B91B78C17
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
flow pid Process 46 3856 nfregdrv.exe - Executes dropped EXE 4 IoCs
pid Process 3856 nfregdrv.exe 2240 nfregdrv.exe 3036 nfregdrv.exe 2252 nfregdrv.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Program Files\\NoPing\\nfregdrv.exe" nfregdrv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Program Files\\NoPing\\nfregdrv.exe" nfregdrv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Program Files\\NoPing\\nfregdrv.exe" nfregdrv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Program Files\\NoPing\\nfregdrv.exe" nfregdrv.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
pid Process 3856 nfregdrv.exe 3856 nfregdrv.exe 2240 nfregdrv.exe 2240 nfregdrv.exe 3036 nfregdrv.exe 3036 nfregdrv.exe 2252 nfregdrv.exe 2252 nfregdrv.exe - Drops file in Program Files directory 7 IoCs
description ioc Process File created C:\Program Files\NoPing\clrhost.dll nfregdrv.exe File created C:\Program Files\NoPing\clrhost.dll nfregdrv.exe File created C:\Program Files\NoPing\nfregdrv.exe cmd.exe File opened for modification C:\Program Files\NoPing\nfregdrv.exe cmd.exe File created C:\Program Files\NoPing\clrhost.dll cmd.exe File opened for modification C:\Program Files\NoPing\clrhost.dll cmd.exe File opened for modification C:\Program Files\NoPing\clrhost.dll attrib.exe - Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3128 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DllHost.exe - System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 4884 attrib.exe - Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Delays execution with timeout.exe 1 IoCs
pid Process 4728 timeout.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000\Software\Microsoft\Internet Explorer\TypedURLs taskmgr.exe - Modifies data under HKEY_USERS 15 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "191" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe - Modifies registry class 5 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 3856 nfregdrv.exe 3856 nfregdrv.exe 2240 nfregdrv.exe 2240 nfregdrv.exe 3036 nfregdrv.exe 3036 nfregdrv.exe 3856 nfregdrv.exe 3856 nfregdrv.exe 3856 nfregdrv.exe 3856 nfregdrv.exe 3856 nfregdrv.exe 3856 nfregdrv.exe 3856 nfregdrv.exe 3856 nfregdrv.exe 3856 nfregdrv.exe 3856 nfregdrv.exe 3856 nfregdrv.exe 3856 nfregdrv.exe 3856 nfregdrv.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2304 osk.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5056 taskmgr.exe Token: SeSystemProfilePrivilege 5056 taskmgr.exe Token: SeCreateGlobalPrivilege 5056 taskmgr.exe Token: 33 5056 taskmgr.exe Token: SeIncBasePriorityPrivilege 5056 taskmgr.exe Token: SeDebugPrivilege 3856 nfregdrv.exe Token: SeTakeOwnershipPrivilege 3856 nfregdrv.exe Token: SeBackupPrivilege 3856 nfregdrv.exe Token: SeRestorePrivilege 3856 nfregdrv.exe Token: SeSecurityPrivilege 3856 nfregdrv.exe Token: SeLoadDriverPrivilege 3856 nfregdrv.exe Token: SeDebugPrivilege 3856 nfregdrv.exe Token: SeTakeOwnershipPrivilege 3856 nfregdrv.exe Token: SeBackupPrivilege 3856 nfregdrv.exe Token: SeRestorePrivilege 3856 nfregdrv.exe Token: SeSecurityPrivilege 3856 nfregdrv.exe Token: SeLoadDriverPrivilege 3856 nfregdrv.exe Token: SeDebugPrivilege 3856 nfregdrv.exe Token: SeTakeOwnershipPrivilege 3856 nfregdrv.exe Token: SeBackupPrivilege 3856 nfregdrv.exe Token: SeRestorePrivilege 3856 nfregdrv.exe Token: SeSecurityPrivilege 3856 nfregdrv.exe Token: SeLoadDriverPrivilege 3856 nfregdrv.exe Token: SeDebugPrivilege 2240 nfregdrv.exe Token: SeTakeOwnershipPrivilege 2240 nfregdrv.exe Token: SeBackupPrivilege 2240 nfregdrv.exe Token: SeRestorePrivilege 2240 nfregdrv.exe Token: SeSecurityPrivilege 2240 nfregdrv.exe Token: SeLoadDriverPrivilege 2240 nfregdrv.exe Token: SeDebugPrivilege 2240 nfregdrv.exe Token: SeTakeOwnershipPrivilege 2240 nfregdrv.exe Token: SeBackupPrivilege 2240 nfregdrv.exe Token: SeRestorePrivilege 2240 nfregdrv.exe Token: SeSecurityPrivilege 2240 nfregdrv.exe Token: SeLoadDriverPrivilege 2240 nfregdrv.exe Token: SeDebugPrivilege 2240 nfregdrv.exe Token: SeTakeOwnershipPrivilege 2240 nfregdrv.exe Token: SeBackupPrivilege 2240 nfregdrv.exe Token: SeRestorePrivilege 2240 nfregdrv.exe Token: SeSecurityPrivilege 2240 nfregdrv.exe Token: SeLoadDriverPrivilege 2240 nfregdrv.exe Token: SeDebugPrivilege 3036 nfregdrv.exe Token: SeTakeOwnershipPrivilege 3036 nfregdrv.exe Token: SeBackupPrivilege 3036 nfregdrv.exe Token: SeRestorePrivilege 3036 nfregdrv.exe Token: SeSecurityPrivilege 3036 nfregdrv.exe Token: SeLoadDriverPrivilege 3036 nfregdrv.exe Token: SeDebugPrivilege 3036 nfregdrv.exe Token: SeTakeOwnershipPrivilege 3036 nfregdrv.exe Token: SeBackupPrivilege 3036 nfregdrv.exe Token: SeRestorePrivilege 3036 nfregdrv.exe Token: SeSecurityPrivilege 3036 nfregdrv.exe Token: SeLoadDriverPrivilege 3036 nfregdrv.exe Token: SeDebugPrivilege 3036 nfregdrv.exe Token: SeTakeOwnershipPrivilege 3036 nfregdrv.exe Token: SeBackupPrivilege 3036 nfregdrv.exe Token: SeRestorePrivilege 3036 nfregdrv.exe Token: SeSecurityPrivilege 3036 nfregdrv.exe Token: SeLoadDriverPrivilege 3036 nfregdrv.exe Token: SeDebugPrivilege 4620 taskmgr.exe Token: SeSystemProfilePrivilege 4620 taskmgr.exe Token: SeCreateGlobalPrivilege 4620 taskmgr.exe Token: 33 4620 taskmgr.exe Token: SeIncBasePriorityPrivilege 4620 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 2304 osk.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe 5056 taskmgr.exe - Suspicious use of SetWindowsHookEx 59 IoCs
pid Process 2304 osk.exe 2304 osk.exe 2304 osk.exe 2304 osk.exe 2304 osk.exe 2304 osk.exe 2304 osk.exe 2304 osk.exe 2304 osk.exe 2304 osk.exe 2304 osk.exe 2304 osk.exe 2304 osk.exe 2304 osk.exe 2304 osk.exe 2304 osk.exe 2304 osk.exe 2304 osk.exe 2304 osk.exe 2304 osk.exe 2304 osk.exe 2304 osk.exe 2304 osk.exe 2304 osk.exe 2304 osk.exe 2304 osk.exe 2304 osk.exe 2304 osk.exe 2304 osk.exe 2304 osk.exe 2304 osk.exe 2304 osk.exe 2304 osk.exe 2304 osk.exe 2304 osk.exe 2304 osk.exe 2304 osk.exe 2304 osk.exe 2304 osk.exe 2304 osk.exe 2304 osk.exe 2304 osk.exe 2304 osk.exe 2304 osk.exe 2304 osk.exe 2304 osk.exe 2304 osk.exe 2304 osk.exe 2304 osk.exe 2304 osk.exe 2304 osk.exe 2304 osk.exe 2304 osk.exe 2304 osk.exe 2304 osk.exe 2304 osk.exe 2304 osk.exe 2304 osk.exe 676 LogonUI.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3128 wrote to memory of 4884 3128 cmd.exe 97 PID 3128 wrote to memory of 4728 3128 cmd.exe 98 PID 3128 wrote to memory of 3856 3128 cmd.exe 104 - Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 4884 attrib.exe
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\run.zip1⤵PID:1860
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5056
-
C:\Windows\system32\osk.exe"C:\Windows\system32\osk.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2304
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2008
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{60A90A2F-858D-42AF-8929-82BE9D99E8A1}1⤵
- System Location Discovery: System Language Discovery
PID:4172
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Documents\run\run.bat"1⤵
- Drops file in Program Files directory
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Windows\system32\attrib.exeattrib +R "C:\Program Files\NoPing\clrhost.dll"2⤵
- Drops file in Program Files directory
- System Network Configuration Discovery: Internet Connection Discovery
- Views/modifies file attributes
PID:4884
-
-
C:\Windows\system32\timeout.exetimeout /t 20 /nobreak2⤵
- Delays execution with timeout.exe
PID:4728
-
-
C:\Program Files\NoPing\nfregdrv.exe"C:\Program Files\NoPing\nfregdrv.exe"2⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3856
-
-
C:\Program Files\NoPing\nfregdrv.exe"C:\Program Files\NoPing\nfregdrv.exe"1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2240
-
C:\Program Files\NoPing\nfregdrv.exe"C:\Program Files\NoPing\nfregdrv.exe"1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3036
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x16c 0x3201⤵PID:2516
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4620
-
C:\Program Files\NoPing\nfregdrv.exe"C:\Program Files\NoPing\nfregdrv.exe"1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
PID:2252
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa39ee855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:676
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\NoPing\nfregdrv.exe
- Size 3.6MB
- SHA256 01a9ccff60dbdf2dce2a6304f01c51ab32b03029fb4648394fb715bc1dc2ce5b
- MD5 de7218aed3ac1635468ee8f3a3b45b9c
- SHA1 c49f1acd0593546d0aaac5de23e92ff6c82c03e8
- SHA512 d46da180eaec6f33ecf6b44f1067c0e5bfc1655d53174467155aa5a32169b741ad93f6f01debe81cc9c863bdbe1ca21420bf595bd4c7cd39a3e40ee6dddb2535
- SSDEEP 98304:P9pu81M/MJaxGER+fOAq2Z+HK3aBJWhrGgLA7MCrOc:Pn1M/MJzERaOA++NLvLc
- TLSH T13B0623AF5BCB2EF0D01ECF74C94971ACB06D3B968AA1DC15B7CD190E4E9222ADD31251
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\70825F0EABF2526E540CA0F7C268D189
- Size 310B
- SHA256 b5713cf6ed28ea6a6ac0d6cf8fc6075aed6b73c3c35fca7fd475265276e36421
- MD5 d197016fd7ab4d1139ae1a7f9417d8f4
- SHA1 9edd6e6dce084092fe7390574a1a49df91da612e
- SHA512 c9ae104d99902f5b221458c6e8ffbac3ec7f15ff17bb3b85f138c9810b44c04915fac2c2ae91e296a5dcfe974041b0969c7a9bdb63b36b71ae1b8ecb67cdd8d8
- TLSH T1B4E0CD89956DB34256B0D201F864C84B2CF8C882265FF4446944CF5114E7B98E5823CE
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
- Size 1KB
- SHA256 63b14543360f5e89942ea8d5113526e64fbc71c1207328f0136b3a495d921dd0
- MD5 adac67e1d2da2d706db151c2db316b2d
- SHA1 5f6e301d23e33132209707945d0e740d5bcb8996
- SHA512 9371b62ac25c6ea8fb6fca19ac47b873ced9b3d0cb45ce4de5ea974b93c12684c65aa23c7d83331c77502853258a08dff73ce5e3fb6170bd3ab1c5b3283a86a9
- TLSH T1DE31AD4EA2153027D5427F72D8CEBE83CEB1364667CAD46B18046E4229AAFC25FC80C9
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
- Size 528B
- SHA256 d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c
- MD5 047f3e9d21d6b325d592b1959e4362e6
- SHA1 5aeef5f985171cd69da397fd039854e44ebecdd2
- SHA512 4523896ed4a03afafd2075d8c8947236d34fe1da2c246a3f90c2be2a5c151c18bc58a6cde5a209abb8e06e80f662e24d0149640b3e98e8a872bfa8a04ef592a4
- TLSH T147F0500990082252C855FF55DFD6AC97DC76336136E595036D458E410C12F96AF950F5
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\70825F0EABF2526E540CA0F7C268D189
- Size 192B
- SHA256 4a51f8182a782b4726abc6dce1dd9544a925cf7b2a1e882cbf4cab8967c71314
- MD5 bb37f36ff2daa3ecf0532ab8fa8a5a7c
- SHA1 def8521454af1c62cdb1c6e1c0f61b3442031908
- SHA512 5087efb5edf0a721b8650e55b988f4419e6799ff5ef61b6b828dab86336d0700b78c3a4d64557582e291f615149ebfb366d1c307cc2e142009a9cae83c787d10
- TLSH T1DDC08C1032B152B8E50A463E98A286030BFAF698C291C30A2B700318B20A6551C31E00
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
- Size 174B
- SHA256 d3d8d9722a32c1c09b938e48767d3cbf84009111bb714011f7b47c9169b578b1
- MD5 9c07ff3c259330a742e5e64315af8452
- SHA1 f99f17837e31a76335dc9b713e16fa283ccaad63
- SHA512 2e64637d26a0489ffb7d97aef41dcb6856d264b0dca03ff9ce87117b8059ab14d5749d30a4e540f1855d3d233fb16291137c3ee67c7d81a0507fcc37ecf0608c
- TLSH T1E8C09B0437B54555F1304E7F1653571647FAE605CD4183541F705359D61DB425CF5D06
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
- Size 170B
- SHA256 d40655a0cef2de0e9aa4ade18197df3fe225a4b6945ae31c7871b3ca0b7f1dbd
- MD5 8885bf7524561cb2ba3eb32529b4d8ba
- SHA1 3653b5dd460091fb814caedcb3e0ab1752f4cf10
- SHA512 3f09ddc5d84d890a2cc86d8c7a709e05fa9ecd49c7dac4bb601a3c0f406cb90d6b9dac92a2c53991d119e63eea3f70b36fafd0fc49e2cef7fce873ad08ff6bdd
- TLSH T13EC09B1473654715F10D153E79D51B0417F54105F5C6C3054B7811348518A4418B1D05
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
- Size 64KB
- SHA256 b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a
- MD5 d2fb266b97caff2086bf0fa74eddb6b2
- SHA1 2f0061ce9c51b5b4fbab76b37fc6a540be7f805d
- SHA512 c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8
- SSDEEP 3:mnlllGlll/l/lXp9ZjrPBY06llSl/gX/ZP:mll0dPBY0O0uXJ
- TLSH T1D053019562930667C852033848CB0BA63A7A9619979345A282A49270D8A9B6584A2299
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
- Size 4B
- SHA256 7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
- MD5 f49655f856acb8884cc0ace29216f511
- SHA1 cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
- SHA512 599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
- Size 944B
- SHA256 878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d
- MD5 6bd369f7c74a28194c991ed1404da30f
- SHA1 0f8e3f8ab822c9374409fe399b6bfe5d68cbd643
- SHA512 8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93
- TLSH T18811924A3AC71DB8F37A6D71006991242202B2275CC2D61C4AC4C6A98B35618E476FA8
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\XJVSZ7E8\clrhost[1].dll
- Size 8.6MB
- SHA256 a6a4dccc4efe71ae5cb3af4ccb3a99faa246334148a8b02d8662e8241ad6bd0a
- MD5 756d21f0542f6a037214f42be278d367
- SHA1 77260db6a983bb4594fccc5b9c3c2b62f83dac21
- SHA512 20a4e4f300086578c8a204e7f93a9e02acf4d3c03d1ece6e2faea58ebb53ff1c96e41ed7018ec912f7c40937929b8598d2e535e701544491680771011efcdba8
- SSDEEP 196608:B8SL7Uba+ED7odkLaHtv6j4zaDUorkjzCFjOL:m6oba+9caawIxKCFjO
- TLSH T1579633CDB98503A6C463FFB858F28DBFB111FB8565214D0B7A8993401C37A352AB79C9
- MD5 SHA1 SHA512 SSDEEP TLSH