Analysis
- user interaction
yes - max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/10/2026, 22:11
Static task
static1
Behavioral task
behavioral1
Sample
NexusTools.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
NexusTools.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target NexusTools.exe
- Size 785KB
- Sample261029-13y28ace89
- SHA256 eaac64c113ebaba1fae924ad1b6239a44c8806bf2b85d8dc11a27ad65a981cc1
- MD5 bca6478b230b6920fe79b97a3066e835
- SHA1 f61e771c53c63f35f5a2b416c260c74d29329adf
- SHA512 463f16b737768ac2bb285efc09e69781132e95c234e2eab37eb98be797606e45d1dbb38df3a6ef55144f4f7e1b08a213768e915b7d967b8c90bd03b216a07ff7
- SSDEEP 12288:/AstffLBk3Q45wU0/St0Z4j9lAx5ylTxEIyTXnxYV:4s9uQ45oyj9lE5yFuTXmV
- TLSH T1CB058E6A66AC01F8E0B7D17989964907F7B27845137197CF43A087AB2F276E05F7E320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 16 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID ShellHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 ShellHost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID ShellHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 ShellHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 ShellHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 ShellHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 ShellHost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID ShellHost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID ShellHost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID ShellHost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID ShellHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 ShellHost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID ShellHost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID ShellHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 ShellHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 ShellHost.exe - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-696679853-3915825385-3233721679-1000\{A204FFE5-F5F2-4293-AEAD-C44C29032484} ShellHost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-696679853-3915825385-3233721679-1000\{CA68D5EF-E8E2-44FE-B933-36C16052010F} ShellHost.exe - Suspicious behavior: LoadsDriver 14 IoCs
pid Process 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 816 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found - Suspicious use of AdjustPrivilegeToken 18 IoCs
description pid Process Token: SeShutdownPrivilege 4272 ShellHost.exe Token: SeCreatePagefilePrivilege 4272 ShellHost.exe Token: SeShutdownPrivilege 4272 ShellHost.exe Token: SeCreatePagefilePrivilege 4272 ShellHost.exe Token: SeShutdownPrivilege 4272 ShellHost.exe Token: SeCreatePagefilePrivilege 4272 ShellHost.exe Token: SeShutdownPrivilege 4272 ShellHost.exe Token: SeCreatePagefilePrivilege 4272 ShellHost.exe Token: SeShutdownPrivilege 3720 ShellHost.exe Token: SeCreatePagefilePrivilege 3720 ShellHost.exe Token: SeShutdownPrivilege 3720 ShellHost.exe Token: SeCreatePagefilePrivilege 3720 ShellHost.exe Token: SeShutdownPrivilege 3720 ShellHost.exe Token: SeCreatePagefilePrivilege 3720 ShellHost.exe Token: SeShutdownPrivilege 3720 ShellHost.exe Token: SeCreatePagefilePrivilege 3720 ShellHost.exe Token: SeShutdownPrivilege 3720 ShellHost.exe Token: SeCreatePagefilePrivilege 3720 ShellHost.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4272 ShellHost.exe 3720 ShellHost.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4272 ShellHost.exe 3720 ShellHost.exe 6120 ShellHost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NexusTools.exe"C:\Users\Admin\AppData\Local\Temp\NexusTools.exe"1⤵PID:6124
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵PID:720
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x0000000000000484 0x00000000000004CC1⤵PID:4640
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc1⤵PID:3552
-
C:\Windows\System32\ShellHost.exe"C:\Windows\System32\ShellHost.exe"1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4272
-
C:\Windows\System32\ShellHost.exe"C:\Windows\System32\ShellHost.exe"1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3720
-
C:\Windows\System32\ShellHost.exe"C:\Windows\System32\ShellHost.exe"1⤵
- Suspicious use of SetWindowsHookEx
PID:6120