cee7b047466f8c764709bc7beb7a184e6304d810094c4d186635cc2e63d5f97f

Analysis

user interaction
yes
max time kernel
150s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/10/2026, 18:14

Target
cracked by dwmxs.exe
Size 2.4MB
Sample261017-wvprcsbv8x
SHA256 cee7b047466f8c764709bc7beb7a184e6304d810094c4d186635cc2e63d5f97f
MD5 3b55d74de76d813565ad7f77dc284dca
SHA1 d3fb16ca439a007c56ef8cf83e6e7f1f4a5e878f
SHA512 228133c56e456a887c5b90f0763f553f60ce522e9f7909d92cbcda4dca59228d328a78c17c5231e6ae24bf0c86ea61c8aebb0f9afc42f84c57295eaf0c37cf66
SSDEEP 24576:rDpdL9ct1j364899MZFuz56i+D4/MS0Wv2g95be7fWSeFUg+2fXwaTA6gJ5BCXD9:XwDj+IxG7iayhXUvX7TAx0O8I9ZUXo
TLSH
T171B5BE4563AE4AACC056A038D5929A07D6F33C440737DFDB13D04D951BAF2D0BAFA6CA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Sets service image path in registry 3 TTPs 2 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

Registry Run Keys / Startup Folder

Modify Registry

Windows Service

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\nogw2xx9\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\8va068kc\\nogw2xx9.sys"	cracked by dwmxs.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\qwmnnh8b\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\8va068kc\\qwmnnh8b.sys"	cracked by dwmxs.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

Windows Command Shell

pid	Process
3228	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

System Network Configuration Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cracked by dwmxs.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cracked by dwmxs.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
2072	cracked by dwmxs.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	2072	cracked by dwmxs.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 3228	2072	cracked by dwmxs.exe	91

C:\Users\Admin\AppData\Local\Temp\cracked by dwmxs.exe
"C:\Users\Admin\AppData\Local\Temp\cracked by dwmxs.exe"
1⤵
- Sets service image path in registry
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:3228