a7ed2289d7a6bc4bd826da5ef32e6f7d87baa473e23813acb47017cc8319f3d2

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 20:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VapoNuker.exe
Size 153KB
Sample261027-znaweafz21
SHA256 a7ed2289d7a6bc4bd826da5ef32e6f7d87baa473e23813acb47017cc8319f3d2
MD5 e873fd51b762827f0d05de86ae036354
SHA1 1baca353f0493773220d274ccce6119f154a2a9d
SHA512 4da3c6107a525c6600343028c170c70fecd0fcf560eed1f99544d8df913a78e57773db04b134521f9188973f3d27a86028c7669b098f7beb603b1bfd16d3f8a5
SSDEEP 1536:MvcuG9i+exkw3p57Pl68x2dK/Nx3ZfNsJfBf748P9QygtqXY0gZ+7tKlm:MnG9yyITh68MdK1BFNuf748FpNH7tmm
TLSH
T184F38E8490734C2CC71E943980F6981269ABF80BBE75E925FBDD64A1DF32D20FE54B94
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings	VapoNuker.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3300	OpenWith.exe
4884	OpenWith.exe

C:\Users\Admin\AppData\Local\Temp\VapoNuker.exe
"C:\Users\Admin\AppData\Local\Temp\VapoNuker.exe"
1⤵
- Modifies registry class
PID:4176

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3300

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VapoNuker.py

Path C:\Users\Admin\AppData\Local\Temp\MasonDrop\VapoNuker.py
Size 31KB
SHA256 848819113389884d314ec8e3529613c4e668652dbbcc153b2d0c72759792f9af
MD5 8e5c4357fe3d8b8877474778be80f7ca
SHA1 d14ba9e90bf38b3d1bd172f11429dfd1da5eff1c
SHA512 6031918b8a2404bacf6b49375298c6bdc1b04d45a3dc3bb97a00b243a40718e7c87dd81914701a76706b0c422cdf8be5133398c6d7754e94e3f35ea110fd18c9
SSDEEP 384:VVrg4Gt97yNkhq39aiOGEaBaVs4X8zRpJuDO:ItJIlCK
TLSH
T1F9E27C9468801C2D8B069C6EC5F658425D9B380BFE98247AF9EC64D0CF36D21FF65F94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

marwan.py

Path C:\Users\Admin\AppData\Local\Temp\MasonDrop\marwan.py
Size 157B
SHA256 eadce058ded4df2835d3a99b18ef6b0cc1d46162b804fc0e6a04685e84dd51fd
MD5 fb9c66d3cd9b12b1f4220eb9bb9c2790
SHA1 2abd96c2d0b1ee05662c74b8446658f0f40427ad
SHA512 2da5f8a6207524c8a3f91825d8f43a2f17092e40096e311465c6076583d7f1de1aa8b93a77bf04c10163139f29c940aaf325a5ea05b480dab859fd4926c79009
TLSH
T1ECC08CEBC90F74528DE0AC4C5AC1A4B8B708080DECE151123922798C02B081283E980D
MD5 SHA1 SHA512 TLSH