093d56ace5fd9d185dfa1d3eb48365b765b32e248b182358893ddae73402e0bc

Analysis

user interaction
yes
max time kernel
2s
max time network
23s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 11:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bin/Debug/MatrixVirus.exe
Size 622KB
Sample260812-nvpscstsds
SHA256 093d56ace5fd9d185dfa1d3eb48365b765b32e248b182358893ddae73402e0bc
MD5 c724a2e6fd6469c7e7724c49ef32b26c
SHA1 69ccd29c16bbabc331499c506b214b73c06bf09d
SHA512 a45c8ff381fa1e7662e3296fc343dcfc8a1d9bfc9a54bbe95da29abd0ab1a04ffe00c47ecd8a6379e8871080f2f253ee55f2ebeb86cee40c76f1388bd0088efa
SSDEEP 12288:ts6WC8NrwXwIkGJM5mo3Ax1xOWkkkcAbCkQPmjrDwHbAK09wmuyGYgnmU/KFQkf:9m3WwFbgkdu93zCp
TLSH
T10DD448343DEA502AB273EF698BE4789ADA6FB7733703645D1061038A4B23A41DED153D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

bootkit discovery execution persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MatrixVirus.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2732	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MatrixVirus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\7-Zip.tar\shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.amv	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.dct	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.ini\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.it	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mmf	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpga	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.odc	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.settingcontent-ms\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.dib\OpenWithProgids	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.dvr-ms	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mp4v\OpenWithProgIds	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.srw\ShellEx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.tdl\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.TS\ShellEx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.xlsx\PersistentHandler	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\7-Zip.tgz\shell\open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.eyb\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.idq	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mv\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.UDL	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.hlp	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.3gp\OpenWithProgIds	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.fon	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.grp	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.hxd	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.ini	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.pothtml	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.sbr\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdx\OpenWithProgids	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.rgs	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.s	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.s3m	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.tar\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.tsv	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.vsdm\ShellEx\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.vssscc	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.c	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.drf	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.hta	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mapimail	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.bzip2	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.aiff\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\PropertySheetHandlers\{3EA48300-8CF6-101B-84FB-666CCB9BCD32}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.3g2	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.arw\ShellEx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.css\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.gif\OpenWithProgids	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mmf\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.group	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.avi\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.ex_\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.k25	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpa	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.ost	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.pptx\ShellEx\{8895b1c6-b41f-4c1c-a562-0d564250836f}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.tgz\OpenWithProgids	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.asf\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.heif	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mkv	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.ms-windows-store-license	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mv	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.sch\PersistentHandler	reg.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: 33	3932	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3932	AUDIODG.EXE
Token: SeDebugPrivilege	3632	MatrixVirus.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3632 wrote to memory of 2732	3632	MatrixVirus.exe	89
PID 2732 wrote to memory of 5860	2732	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\bin\Debug\MatrixVirus.exe
"C:\Users\Admin\AppData\Local\Temp\bin\Debug\MatrixVirus.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3632
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg delete HKCR /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Windows\SysWOW64\reg.exe
    reg delete HKCR /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:5860

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004A8 0x00000000000004E0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3632-0-0x0000000074FA2000-0x0000000074FA3000-memory.dmp

Download

memory/3632-1-0x0000000000F70000-0x0000000001012000-memory.dmp

Download

memory/3632-2-0x0000000005B90000-0x0000000005C22000-memory.dmp

Download

memory/3632-3-0x00000000063C0000-0x000000000697A000-memory.dmp

Download

memory/3632-4-0x0000000074F90000-0x000000007574C000-memory.dmp

Download

memory/3632-8-0x0000000008130000-0x000000000813A000-memory.dmp

Download

memory/3632-9-0x0000000074FA2000-0x0000000074FA3000-memory.dmp

Download

memory/3632-10-0x0000000074F90000-0x000000007574C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads