Analysis
- user interaction
yes - max time kernel
116s - max time network
116s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
21/08/2026, 16:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NexusEngine.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
26 signatures
150 seconds
Behavioral task
behavioral2
Sample
NexusEngine.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
23 signatures
150 seconds
General
- Target NexusEngine.exe
- Size 37KB
- Sample260821-txxtmstcre
- SHA256 bcc9609fc14bfd25044436640fcff32225bb5a3761ef60c43a2b7c341d6b2cc9
- MD5 655ff4958cb2d2665cccd0c136937c15
- SHA1 129576d652b39cebaad9e73870b23f6ad294761e
- SHA512 4f2df949822b1e95361886bb529dd22836fc908b1e1b85612a4b95421fae9f6133bcd10c56f1215d6e42eb8d6c24c9e84bcb182addc51432842198f0336a38b3
- SSDEEP 768:3lWNsj0K4pYctRrbAz97t3nS3cPyKk2g+I3eDz/:3lWbK4J7Q9AcPlBg+z
- TLSH T10003504557FA4604F2FB7F79AEB695448A37BCB69D32C68E0351504E0672E80DAB0733
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UAC bypass 3 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" NexusEngine.exe - Modifies boot configuration data using bcdedit 1 TTPs 6 IoCs
pid Process 5920 bcdedit.exe 4304 bcdedit.exe 2580 bcdedit.exe 3652 bcdedit.exe 552 bcdedit.exe 3496 bcdedit.exe - Disables use of System Restore points 1 TTPs
- Event Triggered Execution: Image File Execution Options Injection 1 TTPs 20 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FortniteClient-Win64-Shipping_EAC.exe\PerfOptions\IoPriority = "3" NexusEngine.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VALORANT-Win64-Shipping.exe\PerfOptions NexusEngine.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VALORANT-Win64-Shipping.exe\PerfOptions\CpuPriorityClass = "3" NexusEngine.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FortniteClient-Win64-Shipping_EAC.exe NexusEngine.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FortniteClient-Win64-Shipping_EAC.exe\PerfOptions\CpuPriorityClass = "3" NexusEngine.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FortniteClient-Win64-Shipping_BE.exe\PerfOptions NexusEngine.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FortniteClient-Win64-Shipping_BE.exe NexusEngine.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VALORANT-Win64-Shipping.exe NexusEngine.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VALORANT-Win64-Shipping.exe\PerfOptions\IoPriority = "3" NexusEngine.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrss.exe NexusEngine.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrss.exe\PerfOptions\CpuPriorityClass = "3" NexusEngine.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FortniteClient-Win64-Shipping.exe\PerfOptions NexusEngine.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FortniteClient-Win64-Shipping.exe\PerfOptions\IoPriority = "3" NexusEngine.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FortniteClient-Win64-Shipping_EAC.exe\PerfOptions NexusEngine.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FortniteClient-Win64-Shipping_BE.exe\PerfOptions\CpuPriorityClass = "3" NexusEngine.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FortniteClient-Win64-Shipping_BE.exe\PerfOptions\IoPriority = "3" NexusEngine.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrss.exe\PerfOptions NexusEngine.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FortniteClient-Win64-Shipping.exe NexusEngine.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options NexusEngine.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FortniteClient-Win64-Shipping.exe\PerfOptions\CpuPriorityClass = "3" NexusEngine.exe - Boot or Logon Autostart Execution: LSASS Driver 2 TTPs 1 IoCs
Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems.
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\RunAsPPL = "0" NexusEngine.exe - Checks whether UAC is enabled 1 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA NexusEngine.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" NexusEngine.exe - Contacts third-party web service commonly abused for C2 1 TTPs 1 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 13 discord.com - Power Settings 1 TTPs 5 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 5588 powercfg.exe 4552 powercfg.exe 2456 powercfg.exe 5340 powercfg.exe 2880 powercfg.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Logs\DISM\dism.log Dism.exe File opened for modification C:\Windows\Logs\DISM\dism.log dismhost.exe - Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
pid Process 3344 powershell.exe -
pid Process 3440 powershell.exe 3316 powershell.exe 3032 powershell.exe - Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe - Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 5596 ipconfig.exe - Modifies Control Panel 11 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Control Panel\Mouse\MouseThreshold1 = "0" NexusEngine.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Control Panel\Accessibility\StickyKeys\Flags = "506" NexusEngine.exe Set value (int) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Control Panel\Keyboard\KeyboardDelay = "0" NexusEngine.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Control Panel\Mouse\MouseThreshold2 = "0" NexusEngine.exe Set value (data) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Control Panel\Mouse\SmoothMouseXCurve = 00000000000000000000000000000000000000000000000000000000000000000000000000000000 NexusEngine.exe Set value (data) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Control Panel\Mouse\SmoothMouseYCurve = 00000000000000000000000000000000000000000000000000000000000000000000000000000000 NexusEngine.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Control Panel\Desktop\MenuShowDelay = "0" NexusEngine.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Control Panel\Desktop\AutoEndTasks = "1" NexusEngine.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Control Panel\Desktop\WaitToKillAppTimeout = "2000" NexusEngine.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Control Panel\Keyboard\KeyboardSpeed = "31" NexusEngine.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Control Panel\Mouse\MouseSpeed = "0" NexusEngine.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5156 NexusEngine.exe 5156 NexusEngine.exe 5156 NexusEngine.exe 5156 NexusEngine.exe 5156 NexusEngine.exe 5156 NexusEngine.exe 5156 NexusEngine.exe 5156 NexusEngine.exe 5156 NexusEngine.exe 5156 NexusEngine.exe 5156 NexusEngine.exe 5156 NexusEngine.exe 5156 NexusEngine.exe 5156 NexusEngine.exe 5156 NexusEngine.exe 5156 NexusEngine.exe 5156 NexusEngine.exe 5156 NexusEngine.exe 5156 NexusEngine.exe 5156 NexusEngine.exe 5156 NexusEngine.exe 5156 NexusEngine.exe 5156 NexusEngine.exe 5156 NexusEngine.exe 5156 NexusEngine.exe 5156 NexusEngine.exe 5156 NexusEngine.exe 5156 NexusEngine.exe 5156 NexusEngine.exe 5156 NexusEngine.exe 5156 NexusEngine.exe 3440 powershell.exe 3440 powershell.exe 3316 powershell.exe 3316 powershell.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 3344 powershell.exe 3344 powershell.exe 3344 powershell.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 3032 powershell.exe 3032 powershell.exe 3032 powershell.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5156 NexusEngine.exe Token: 33 5156 NexusEngine.exe Token: SeIncBasePriorityPrivilege 5156 NexusEngine.exe Token: 33 5156 NexusEngine.exe Token: SeIncBasePriorityPrivilege 5156 NexusEngine.exe Token: 33 5156 NexusEngine.exe Token: SeIncBasePriorityPrivilege 5156 NexusEngine.exe Token: 33 5156 NexusEngine.exe Token: SeIncBasePriorityPrivilege 5156 NexusEngine.exe Token: 33 5156 NexusEngine.exe Token: SeIncBasePriorityPrivilege 5156 NexusEngine.exe Token: 33 5156 NexusEngine.exe Token: SeIncBasePriorityPrivilege 5156 NexusEngine.exe Token: 33 5156 NexusEngine.exe Token: SeIncBasePriorityPrivilege 5156 NexusEngine.exe Token: 33 5156 NexusEngine.exe Token: SeIncBasePriorityPrivilege 5156 NexusEngine.exe Token: 33 5156 NexusEngine.exe Token: SeIncBasePriorityPrivilege 5156 NexusEngine.exe Token: 33 5156 NexusEngine.exe Token: SeIncBasePriorityPrivilege 5156 NexusEngine.exe Token: 33 5156 NexusEngine.exe Token: SeIncBasePriorityPrivilege 5156 NexusEngine.exe Token: 33 5156 NexusEngine.exe Token: SeIncBasePriorityPrivilege 5156 NexusEngine.exe Token: 33 5156 NexusEngine.exe Token: SeIncBasePriorityPrivilege 5156 NexusEngine.exe Token: 33 5156 NexusEngine.exe Token: SeIncBasePriorityPrivilege 5156 NexusEngine.exe Token: 33 5156 NexusEngine.exe Token: SeIncBasePriorityPrivilege 5156 NexusEngine.exe Token: 33 5156 NexusEngine.exe Token: SeIncBasePriorityPrivilege 5156 NexusEngine.exe Token: 33 5156 NexusEngine.exe Token: SeIncBasePriorityPrivilege 5156 NexusEngine.exe Token: 33 5156 NexusEngine.exe Token: SeIncBasePriorityPrivilege 5156 NexusEngine.exe Token: 33 5156 NexusEngine.exe Token: SeIncBasePriorityPrivilege 5156 NexusEngine.exe Token: 33 5156 NexusEngine.exe Token: SeIncBasePriorityPrivilege 5156 NexusEngine.exe Token: 33 5156 NexusEngine.exe Token: SeIncBasePriorityPrivilege 5156 NexusEngine.exe Token: 33 5156 NexusEngine.exe Token: SeIncBasePriorityPrivilege 5156 NexusEngine.exe Token: 33 5156 NexusEngine.exe Token: SeIncBasePriorityPrivilege 5156 NexusEngine.exe Token: 33 5156 NexusEngine.exe Token: SeIncBasePriorityPrivilege 5156 NexusEngine.exe Token: 33 5156 NexusEngine.exe Token: SeIncBasePriorityPrivilege 5156 NexusEngine.exe Token: 33 5156 NexusEngine.exe Token: SeIncBasePriorityPrivilege 5156 NexusEngine.exe Token: 33 5156 NexusEngine.exe Token: SeIncBasePriorityPrivilege 5156 NexusEngine.exe Token: 33 5156 NexusEngine.exe Token: SeIncBasePriorityPrivilege 5156 NexusEngine.exe Token: 33 5156 NexusEngine.exe Token: SeIncBasePriorityPrivilege 5156 NexusEngine.exe Token: 33 5156 NexusEngine.exe Token: SeIncBasePriorityPrivilege 5156 NexusEngine.exe Token: 33 5156 NexusEngine.exe Token: SeIncBasePriorityPrivilege 5156 NexusEngine.exe Token: 33 5156 NexusEngine.exe - Suspicious use of FindShellTrayWindow 56 IoCs
pid Process 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe - Suspicious use of SendNotifyMessage 56 IoCs
pid Process 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe 5920 taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5920 taskmgr.exe - Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 5156 wrote to memory of 5920 5156 NexusEngine.exe 92 PID 5156 wrote to memory of 4304 5156 NexusEngine.exe 94 PID 5156 wrote to memory of 2580 5156 NexusEngine.exe 96 PID 5156 wrote to memory of 3652 5156 NexusEngine.exe 98 PID 5156 wrote to memory of 5588 5156 NexusEngine.exe 100 PID 5156 wrote to memory of 4552 5156 NexusEngine.exe 102 PID 5156 wrote to memory of 5504 5156 NexusEngine.exe 104 PID 5156 wrote to memory of 5296 5156 NexusEngine.exe 106 PID 5156 wrote to memory of 5596 5156 NexusEngine.exe 108 PID 5156 wrote to memory of 3440 5156 NexusEngine.exe 110 PID 5156 wrote to memory of 2196 5156 NexusEngine.exe 112 PID 2196 wrote to memory of 3052 2196 net.exe 114 PID 5156 wrote to memory of 5904 5156 NexusEngine.exe 115 PID 5904 wrote to memory of 1384 5904 net.exe 117 PID 5156 wrote to memory of 2440 5156 NexusEngine.exe 118 PID 2440 wrote to memory of 2760 2440 net.exe 120 PID 5156 wrote to memory of 5392 5156 NexusEngine.exe 121 PID 5392 wrote to memory of 4472 5392 net.exe 123 PID 5156 wrote to memory of 3776 5156 NexusEngine.exe 124 PID 3776 wrote to memory of 1108 3776 net.exe 126 PID 5156 wrote to memory of 4884 5156 NexusEngine.exe 127 PID 4884 wrote to memory of 4968 4884 net.exe 129 PID 5156 wrote to memory of 1496 5156 NexusEngine.exe 130 PID 1496 wrote to memory of 3320 1496 net.exe 132 PID 5156 wrote to memory of 1388 5156 NexusEngine.exe 133 PID 1388 wrote to memory of 2000 1388 net.exe 135 PID 5156 wrote to memory of 2456 5156 NexusEngine.exe 136 PID 5156 wrote to memory of 5340 5156 NexusEngine.exe 138 PID 5156 wrote to memory of 552 5156 NexusEngine.exe 140 PID 5156 wrote to memory of 2880 5156 NexusEngine.exe 143 PID 5156 wrote to memory of 4696 5156 NexusEngine.exe 145 PID 5156 wrote to memory of 3316 5156 NexusEngine.exe 147 PID 5156 wrote to memory of 2764 5156 NexusEngine.exe 149 PID 2764 wrote to memory of 2632 2764 net.exe 151 PID 5156 wrote to memory of 1904 5156 NexusEngine.exe 152 PID 1904 wrote to memory of 4456 1904 net.exe 154 PID 5156 wrote to memory of 4952 5156 NexusEngine.exe 155 PID 5156 wrote to memory of 4304 5156 NexusEngine.exe 157 PID 4304 wrote to memory of 3368 4304 net.exe 159 PID 5156 wrote to memory of 3496 5156 NexusEngine.exe 160 PID 5156 wrote to memory of 3344 5156 NexusEngine.exe 163 PID 5156 wrote to memory of 876 5156 NexusEngine.exe 165 PID 876 wrote to memory of 1644 876 Dism.exe 167 PID 5156 wrote to memory of 3032 5156 NexusEngine.exe 168 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" NexusEngine.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NexusEngine.exe"C:\Users\Admin\AppData\Local\Temp\NexusEngine.exe"1⤵
- UAC bypass
- Event Triggered Execution: Image File Execution Options Injection
- Boot or Logon Autostart Execution: LSASS Driver
- Checks whether UAC is enabled
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5156 -
C:\Windows\SYSTEM32\bcdedit.exe"bcdedit" /set useplatformclock false2⤵
- Modifies boot configuration data using bcdedit
PID:5920
-
-
C:\Windows\SYSTEM32\bcdedit.exe"bcdedit" /set disabledynamictick yes2⤵
- Modifies boot configuration data using bcdedit
PID:4304
-
-
C:\Windows\SYSTEM32\bcdedit.exe"bcdedit" /set tscsyncpolicy Enhanced2⤵
- Modifies boot configuration data using bcdedit
PID:2580
-
-
C:\Windows\SYSTEM32\bcdedit.exe"bcdedit" /set useplatformtick yes2⤵
- Modifies boot configuration data using bcdedit
PID:3652
-
-
C:\Windows\SYSTEM32\powercfg.exe"powercfg" -duplicatescheme e9a42b02-d5df-448d-aa00-03f14749eb612⤵
- Power Settings
PID:5588
-
-
C:\Windows\SYSTEM32\powercfg.exe"powercfg" /setactive e9a42b02-d5df-448d-aa00-03f14749eb612⤵
- Power Settings
PID:4552
-
-
C:\Windows\SYSTEM32\fsutil.exe"fsutil" behavior set disablelastaccess 12⤵PID:5504
-
-
C:\Windows\SYSTEM32\fsutil.exe"fsutil" behavior set disable8dot3 12⤵PID:5296
-
-
C:\Windows\SYSTEM32\ipconfig.exe"ipconfig" /flushdns2⤵
- Gathers network information
PID:5596
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -NoProfile -Command "Get-AppxPackage -AllUsers *3dbuilder* | Remove-AppxPackage; Get-AppxPackage -AllUsers *solitaire* | Remove-AppxPackage;"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3440
-
-
C:\Windows\SYSTEM32\net.exe"net" stop DiagTrack /y2⤵
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop DiagTrack /y3⤵PID:3052
-
-
-
C:\Windows\SYSTEM32\net.exe"net" stop SysMain /y2⤵
- Suspicious use of WriteProcessMemory
PID:5904 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SysMain /y3⤵PID:1384
-
-
-
C:\Windows\SYSTEM32\net.exe"net" stop WSearch /y2⤵
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop WSearch /y3⤵PID:2760
-
-
-
C:\Windows\SYSTEM32\net.exe"net" stop WerSvc /y2⤵
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop WerSvc /y3⤵PID:4472
-
-
-
C:\Windows\SYSTEM32\net.exe"net" stop WaaSMedicSvc /y2⤵
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop WaaSMedicSvc /y3⤵PID:1108
-
-
-
C:\Windows\SYSTEM32\net.exe"net" stop MapsBroker /y2⤵
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MapsBroker /y3⤵PID:4968
-
-
-
C:\Windows\SYSTEM32\net.exe"net" stop Fax /y2⤵
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Fax /y3⤵PID:3320
-
-
-
C:\Windows\SYSTEM32\net.exe"net" stop Spooler /y2⤵
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Spooler /y3⤵PID:2000
-
-
-
C:\Windows\SYSTEM32\powercfg.exe"powercfg" /SETACVALUEINDEX SCHEME_CURRENT 2a737441-1930-4402-8d77-b2bea5845723 48e6b7a6-50f5-4782-a5d4-53bb8f07e226 02⤵
- Power Settings
PID:2456
-
-
C:\Windows\SYSTEM32\powercfg.exe"powercfg" /setactive SCHEME_CURRENT2⤵
- Power Settings
PID:5340
-
-
C:\Windows\SYSTEM32\bcdedit.exe"bcdedit" /set hypervisorlaunchtype off2⤵
- Modifies boot configuration data using bcdedit
PID:552
-
-
C:\Windows\SYSTEM32\powercfg.exe"powercfg" /h off2⤵
- Power Settings
PID:2880
-
-
C:\Windows\SYSTEM32\netsh.exe"netsh" int tcp set global rss=enabled chimney=enabled2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:4696
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -NoProfile -Command "Get-EventLog -LogName * | ForEach { Clear-EventLog $_.Log }"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3316
-
-
C:\Windows\SYSTEM32\net.exe"net" stop wuauserv /y2⤵
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop wuauserv /y3⤵PID:2632
-
-
-
C:\Windows\SYSTEM32\net.exe"net" start wuauserv2⤵
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start wuauserv3⤵PID:4456
-
-
-
C:\Windows\SYSTEM32\netsh.exe"netsh" int tcp set global autotuninglevel=disabled2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:4952
-
-
C:\Windows\SYSTEM32\net.exe"net" stop FontCache /y2⤵
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop FontCache /y3⤵PID:3368
-
-
-
C:\Windows\SYSTEM32\bcdedit.exe"bcdedit" /set nx AlwaysOff2⤵
- Modifies boot configuration data using bcdedit
PID:3496
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -NoProfile -Command "Get-ChildItem -Path $env:LOCALAPPDATA\D3DSCache -Recurse | Remove-Item -Force -ErrorAction SilentlyContinue"2⤵
- Hide Artifacts: Ignore Process Interrupts
- Suspicious behavior: EnumeratesProcesses
PID:3344
-
-
C:\Windows\SYSTEM32\Dism.exe"Dism.exe" /online /Cleanup-Image /StartComponentCleanup2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Windows\System32\Dism\dismhost.exeC:\Windows\System32\Dism\dismhost.exe {DEDB03A5-4445-4604-B0B9-EB49A7A35B00}3⤵
- Drops file in Windows directory
PID:1644
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "[Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] > $null; $template = [Windows.UI.Notifications.ToastNotificationManager]::GetTemplateContent([Windows.UI.Notifications.ToastTemplateType]::ToastText02); $textNodes = $template.GetElementsByTagName('text'); $textNodes.Item(0).AppendChild($template.CreateTextNode('ALL KERNEL OVERRIDES APPLIED')) > $null; $textNodes.Item(1).AppendChild($template.CreateTextNode('Applied 60/60 tweaks. Input latency and frame times optimized.')) > $null; $toast = [Windows.UI.Notifications.ToastNotification]::new($template); [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier('Nexu Engine').Show($toast);"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3032
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5920
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:2904
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1LSASS Driver
1Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Power Settings
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1LSASS Driver
1Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
1Ignore Process Interrupts
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 2KB
- SHA256 80d100fed2621361fc1b446e1ec762bb3ba080eee05ca84e983ec3486a39db52
- MD5 3d2de91df445ca64fc65d6e60c81cc5e
- SHA1 a25c4567e57b61fd085a572b8870e61aced773f2
- SHA512 ecba4daf6328f4784fc1f392ee3947724ffa013baa2966b773de6ff6eb6b3ced43e3d437a59ca27b076cff102f753530fb80100fa5b6f8719a03998c55eb64f2
- TLSH T14E412C67B3CC8AA7D95414365C9EAD1132F6CF9B405ACED73B85CD1CE01FA848B62294
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 5936a0dce9bb8fd0a90ecb83f6538aedf8e5622c6cf0475dc14d09b88435f54e
- MD5 61b2adc12a0cf78264c0b9d5440f8ae2
- SHA1 b227519ed2a849eddacf406b77c6972c87d81e07
- SHA512 a48cd21f5b86f0e843ba6f01767d51102499ada9755a149a706000d35e2b04d0b9522544c5b075417aa86a6edbc15ff6119c37f94e031db1470dba454bc72197
- TLSH T1D2115733F3CC8624C89A413650CEAC1036B5C7DB509ECE6BBB84D154B43F599DE61260
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1dvov4an.qnc.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Logs\DISM\dism.log
- Size 285KB
- SHA256 77741c1985cb9bb2ff7f4e1d4a99b5213244d6a2557c0cd7ac789cfa04d0c2ed
- MD5 45a09a88c7f0e98231d3da9832bc656a
- SHA1 982a2afeb2a6106ab16ec370394f432381cced0f
- SHA512 24446eb85fa8ff99c0a26ad0f74fc99eee1b64004525db8c8857021cd65b094dad55dfab696c0276cb4db7c53bf8acf8730380c0f5351e914c58dc06cb4feb1b
- SSDEEP 6144:olQpSp9pRfkfQbfbxph3KVCL36pqppyHFn8fsw/DPi78DkZHY0L9yh:vyh
- TLSH T15F54AC1E57AF0DB1A149C40372799AEDA2D6B083A6C8F354772FD22977C15CB8E1F680
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Logs\DISM\dism.log
- Size 287KB
- SHA256 740f4d18a0074d7fdf39346494cac38c6aafd5118a6ecffb6b4b669eb51d4b3f
- MD5 930b60430a807aaf734c164593f12246
- SHA1 928fafbc370475740cc1a7597bce94f784de9fa0
- SHA512 a7fff22a0a8d3fffc8be298fc3075779c039549bc47050f22d81800b9c68f6f6b3200990945214670dde7cc898f6d7a302a377f18db4f44b589996b0a926270f
- SSDEEP 6144:olQpSp9pRfkfQbfbxph3KVCL36pqppyHFn8fsw/DPi78DkZHY0L9yB:vyB
- TLSH T1A554AC1E57AF0DB1A149C40372799AEDA2D6B083A6C8F354772FD22977C15CB8E1F680
- MD5 SHA1 SHA512 SSDEEP TLSH