Analysis
- user interaction
yes - max time kernel
20s - max time network
14s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
27/10/2026, 20:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
VapoNuker.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
VapoNuker.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target VapoNuker.exe
- Size 153KB
- Sample261027-znaweafz21
- SHA256 a7ed2289d7a6bc4bd826da5ef32e6f7d87baa473e23813acb47017cc8319f3d2
- MD5 e873fd51b762827f0d05de86ae036354
- SHA1 1baca353f0493773220d274ccce6119f154a2a9d
- SHA512 4da3c6107a525c6600343028c170c70fecd0fcf560eed1f99544d8df913a78e57773db04b134521f9188973f3d27a86028c7669b098f7beb603b1bfd16d3f8a5
- SSDEEP 1536:MvcuG9i+exkw3p57Pl68x2dK/Nx3ZfNsJfBf748P9QygtqXY0gZ+7tKlm:MnG9yyITh68MdK1BFNuf748FpNH7tmm
- TLSH T184F38E8490734C2CC71E943980F6981269ABF80BBE75E925FBDD64A1DF32D20FE54B94
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings VapoNuker.exe Key created \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings OpenWith.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4528 OpenWith.exe - Suspicious use of SetWindowsHookEx 62 IoCs
pid Process 3680 OpenWith.exe 4528 OpenWith.exe 4528 OpenWith.exe 4528 OpenWith.exe 4528 OpenWith.exe 4528 OpenWith.exe 4528 OpenWith.exe 4528 OpenWith.exe 4528 OpenWith.exe 4528 OpenWith.exe 4528 OpenWith.exe 4528 OpenWith.exe 4528 OpenWith.exe 4528 OpenWith.exe 4528 OpenWith.exe 4528 OpenWith.exe 4528 OpenWith.exe 4528 OpenWith.exe 4528 OpenWith.exe 4528 OpenWith.exe 4528 OpenWith.exe 4528 OpenWith.exe 4528 OpenWith.exe 4528 OpenWith.exe 4528 OpenWith.exe 4528 OpenWith.exe 4528 OpenWith.exe 4528 OpenWith.exe 4528 OpenWith.exe 4528 OpenWith.exe 4528 OpenWith.exe 4528 OpenWith.exe 4528 OpenWith.exe 4528 OpenWith.exe 4528 OpenWith.exe 4528 OpenWith.exe 4528 OpenWith.exe 4528 OpenWith.exe 4528 OpenWith.exe 4528 OpenWith.exe 4528 OpenWith.exe 4528 OpenWith.exe 4528 OpenWith.exe 4528 OpenWith.exe 4528 OpenWith.exe 4528 OpenWith.exe 4528 OpenWith.exe 4528 OpenWith.exe 4528 OpenWith.exe 4528 OpenWith.exe 4528 OpenWith.exe 4528 OpenWith.exe 4528 OpenWith.exe 4528 OpenWith.exe 4528 OpenWith.exe 4528 OpenWith.exe 4528 OpenWith.exe 4528 OpenWith.exe 4528 OpenWith.exe 4528 OpenWith.exe 4528 OpenWith.exe 4528 OpenWith.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\VapoNuker.exe"C:\Users\Admin\AppData\Local\Temp\VapoNuker.exe"1⤵
- Modifies registry class
PID:1180
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3680
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4528