a09f11bf0c9f6bb3fe83fc2c4df358d5e1632b5587810090aee3522e950eea34

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/09/2026, 17:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Vapo Nuker.exe
Size 61KB
Sample260926-v32v8axt5m
SHA256 a09f11bf0c9f6bb3fe83fc2c4df358d5e1632b5587810090aee3522e950eea34
MD5 dc5d5b95809f8647f1af1248198d1ad9
SHA1 f854f5463a3ee7a2f08ac56f7c5fd8028e79cc2d
SHA512 7a60f01b4be64f514a0cb12d843343642d2db5e4e76d571873f750016924436d8cba5913fecce0b1e592851fe19810ca6c7dba557f86068e269446902f880ed1
SSDEEP 384:JvDGekgo+8nYti6PGd3LIuttERwEmkcIwatX9q75yRr4qQeVPg4Gt97yNkhq39aA:JvieknuGd66ETcIw6I75e4qQ9tJIlCm
TLSH
T19853865565410C1DCB06887DC5F699725AA73C0BBE48213AF9ECA8A2EF31D20FF64F94
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings	Vapo Nuker.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4828	OpenWith.exe

C:\Users\Admin\AppData\Local\Temp\Vapo Nuker.exe
"C:\Users\Admin\AppData\Local\Temp\Vapo Nuker.exe"
1⤵
- Modifies registry class
PID:1364

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VapoNuker.py

Path C:\Users\Admin\AppData\Local\Temp\MasonDrop\VapoNuker.py
Size 31KB
SHA256 4ba084a779895d45a325c7257a37c855d98cf29de992029199e2f0a56813e45e
MD5 fba7c1474fef173c1135380918decda7
SHA1 35b604685636519ea253b8a0098355c729b8d0a1
SHA512 af5123e5ca9f731d765c30fc5fc111798f879d302129f5728a9c13bd11a35ae22c9d3b99b15cffdf48dd321903b29a07b996c57167e11d21740ac0cb9e2bc00d
SSDEEP 384:VVPg4Gt97yNkhq39aiOGEaBaVs4X8zRpJuDO:EtJIlCK
TLSH
T149E27C9468801C2D8B069C6EC5F658425D9B380BFE98247AF9EC64D0CF36D21FF65FA4
MD5 SHA1 SHA512 SSDEEP TLSH