ea5c7c8f12429a6cb8b4b57ac2f1460754e502e418e975bd5d70ace8a1af800b

Analysis

max time kernel
148s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/11/2026, 17:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Nudge\install.cmd
Size 208B
Sample261113-wezxdset7w
SHA256 ea5c7c8f12429a6cb8b4b57ac2f1460754e502e418e975bd5d70ace8a1af800b
MD5 6ba0d4e294b7b5a2dc24567314e45dc0
SHA1 62693a8abb32e7b37c8a01f8946b1db811f0402b
SHA512 c6e6e3886846fe415c25f55aa9c9ac61d53e81e64ac44684f5528d945ef232155e3dc9a6194dd26a27ad36762e779a879f5eff9a5a3d0ab99120e9cf5d303fb1
TLSH
T1C4D023253030174435F78C517A76E158EC5D10DBA7454D52F17341352E4E360D39D0C9
MD5 SHA1 SHA512 TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1092	powershell.exe
4024	powershell.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Nudge.lnk	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
2248	Nudge.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\Nudge = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Nudge\\Nudge.exe\""	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4948	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Nudge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Nudge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4024	powershell.exe
4024	powershell.exe
2248	Nudge.exe
2248	Nudge.exe
2248	Nudge.exe
2248	Nudge.exe
2248	Nudge.exe
1092	powershell.exe
1092	powershell.exe
1092	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4024	powershell.exe
Token: SeIncreaseQuotaPrivilege	4024	powershell.exe
Token: SeSecurityPrivilege	4024	powershell.exe
Token: SeTakeOwnershipPrivilege	4024	powershell.exe
Token: SeLoadDriverPrivilege	4024	powershell.exe
Token: SeSystemProfilePrivilege	4024	powershell.exe
Token: SeSystemtimePrivilege	4024	powershell.exe
Token: SeProfSingleProcessPrivilege	4024	powershell.exe
Token: SeIncBasePriorityPrivilege	4024	powershell.exe
Token: SeCreatePagefilePrivilege	4024	powershell.exe
Token: SeBackupPrivilege	4024	powershell.exe
Token: SeRestorePrivilege	4024	powershell.exe
Token: SeShutdownPrivilege	4024	powershell.exe
Token: SeDebugPrivilege	4024	powershell.exe
Token: SeSystemEnvironmentPrivilege	4024	powershell.exe
Token: SeRemoteShutdownPrivilege	4024	powershell.exe
Token: SeUndockPrivilege	4024	powershell.exe
Token: SeManageVolumePrivilege	4024	powershell.exe
Token: 33	4024	powershell.exe
Token: 34	4024	powershell.exe
Token: 35	4024	powershell.exe
Token: 36	4024	powershell.exe
Token: SeIncreaseQuotaPrivilege	4024	powershell.exe
Token: SeSecurityPrivilege	4024	powershell.exe
Token: SeTakeOwnershipPrivilege	4024	powershell.exe
Token: SeLoadDriverPrivilege	4024	powershell.exe
Token: SeSystemProfilePrivilege	4024	powershell.exe
Token: SeSystemtimePrivilege	4024	powershell.exe
Token: SeProfSingleProcessPrivilege	4024	powershell.exe
Token: SeIncBasePriorityPrivilege	4024	powershell.exe
Token: SeCreatePagefilePrivilege	4024	powershell.exe
Token: SeBackupPrivilege	4024	powershell.exe
Token: SeRestorePrivilege	4024	powershell.exe
Token: SeShutdownPrivilege	4024	powershell.exe
Token: SeDebugPrivilege	4024	powershell.exe
Token: SeSystemEnvironmentPrivilege	4024	powershell.exe
Token: SeRemoteShutdownPrivilege	4024	powershell.exe
Token: SeUndockPrivilege	4024	powershell.exe
Token: SeManageVolumePrivilege	4024	powershell.exe
Token: 33	4024	powershell.exe
Token: 34	4024	powershell.exe
Token: 35	4024	powershell.exe
Token: 36	4024	powershell.exe
Token: SeIncreaseQuotaPrivilege	4024	powershell.exe
Token: SeSecurityPrivilege	4024	powershell.exe
Token: SeTakeOwnershipPrivilege	4024	powershell.exe
Token: SeLoadDriverPrivilege	4024	powershell.exe
Token: SeSystemProfilePrivilege	4024	powershell.exe
Token: SeSystemtimePrivilege	4024	powershell.exe
Token: SeProfSingleProcessPrivilege	4024	powershell.exe
Token: SeIncBasePriorityPrivilege	4024	powershell.exe
Token: SeCreatePagefilePrivilege	4024	powershell.exe
Token: SeBackupPrivilege	4024	powershell.exe
Token: SeRestorePrivilege	4024	powershell.exe
Token: SeShutdownPrivilege	4024	powershell.exe
Token: SeDebugPrivilege	4024	powershell.exe
Token: SeSystemEnvironmentPrivilege	4024	powershell.exe
Token: SeRemoteShutdownPrivilege	4024	powershell.exe
Token: SeUndockPrivilege	4024	powershell.exe
Token: SeManageVolumePrivilege	4024	powershell.exe
Token: 33	4024	powershell.exe
Token: 34	4024	powershell.exe
Token: 35	4024	powershell.exe
Token: 36	4024	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1092	powershell.exe
1092	powershell.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1092	powershell.exe
1092	powershell.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4948 wrote to memory of 4372	4948	cmd.exe	88
PID 4948 wrote to memory of 4024	4948	cmd.exe	90
PID 4024 wrote to memory of 2832	4024	powershell.exe	92
PID 2832 wrote to memory of 472	2832	csc.exe	93
PID 2248 wrote to memory of 1092	2248	Nudge.exe	97
PID 1092 wrote to memory of 2464	1092	powershell.exe	99
PID 2464 wrote to memory of 2440	2464	csc.exe	100

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Nudge\install.cmd"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:4372
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\Nudge\tools\install.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Creates a file in the Startup directory
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4024
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /nologo /target:winexe /win32icon:C:\Users\Admin\AppData\Local\Temp\Nudge\assets\nudge.ico /r:System.Management.dll /out:C:\Users\Admin\AppData\Local\Temp\Nudge\Nudge.exe C:\Users\Admin\AppData\Local\Temp\Nudge\tools\launcher.cs
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2832
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC78C.tmp" "c:\Users\Admin\AppData\Local\Temp\Nudge\CSCA43760149A66439C9C21484C69D59FFE.TMP"
      4⤵
      PID:472

C:\Users\Admin\AppData\Local\Temp\Nudge\Nudge.exe
"C:\Users\Admin\AppData\Local\Temp\Nudge\Nudge.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NoLogo -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\Nudge\tray.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1092
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gflxcjjk\gflxcjjk.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2464
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD9FB.tmp" "c:\Users\Admin\AppData\Local\Temp\gflxcjjk\CSCCFC6B5575BC4340818D33C79AE4E19.TMP"
      4⤵
      PID:2440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Nudge.exe

Path C:\Users\Admin\AppData\Local\Temp\Nudge\Nudge.exe
Size 111KB
SHA256 6961f548afa6a458d690f18500d9b5ad563285436de6f9ee4d0360e791c64654
MD5 1a70cf2bb4053cabefeddfe234f71859
SHA1 e609a2b24a315e509215d4443e18798adffed6e1
SHA512 4ffacab2b28be04228498240977044e3a23f2e826dbc1bccfb645243b73e015dcafca978562afede4936e5aea521cddecdbb65428c44913ef28ace75323a28a6
SSDEEP 384:g1puQhx5nn+MFpVR2z8OwGwvQoasxJNmA0+VL8iwHE0HPqPzcqRtFWW4uGZDacnU:gDuI+u6o/
TLSH
T1D2B382E8A6CCC76CECF64F3D87710F0121B9CC99D6550EA91969B65D09B7983F4E0222
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RESC78C.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESC78C.tmp
Size 107KB
SHA256 73524a915b18e2761c85a9d4bf27476cfa772e48ca5899c4a5caa81af3dacba9
MD5 3b44cd634a27a72fcb230af2a6d93d72
SHA1 d157ad69040f8a7432e50bd97c7d6c4c785b3f4a
SHA512 4f833a82a9a553fd3d4704a5044d63235ba0ec4cc835c6e39714c46088f12d3cdc8f5eacdc44736adb8ecbb3fa115a5024217b7b8d6f1d383a5da9f7822ceebf
SSDEEP 384:0Un+MFpVR2z8OwGwvQoasxJNmA0+VL8iwHE0HPqPzcqRtFWW4uGZDacnWEo/R:R+u6o/R
TLSH
T1A7B352ECA6CCC76CECB24E3E87310F0165A9CC98D6480FB51965B65E19B78C3F4E4262
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RESD9FB.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESD9FB.tmp
Size 1KB
SHA256 40a10fdbedc844734dca79cd31c6d917974f7a52b8fcfbb8bf25f265e5e38e46
MD5 10f463145d8e9d4aaccf00d3df272a35
SHA1 fe4a144f3a2e7e623160adbc6d6ea3eb8e27b428
SHA512 b26239602490b1b7198fe6c8802589f08c0d8874b3886627c08d87c861bac2c5610e72481af170e9cfa9cf179fa07d585659dd0333f2c57410af0c49b7d393b0
TLSH
T16D21DA0493E9470FF077473279F7071FA274FD64EFA2935A898042292C11544EEE0B72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_gsrlm0ge.0n2.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gsrlm0ge.0n2.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

gflxcjjk.dll

Path C:\Users\Admin\AppData\Local\Temp\gflxcjjk\gflxcjjk.dll
Size 5KB
SHA256 43d0ddec30a39123ca3eaf3d1a295cae7a09c65503c552d1a1d6b9a612b75145
MD5 5febadec83e6cda5c6bb2458108f7d5b
SHA1 8de84d23cd0d20a4c110dc39a8b9eb3ba01f76ba
SHA512 0cf8dd4d5778e5f099e47df9531a8216f69c23931182d448e3f090e3a44c655207bfa5dacb5ca2aea5f09d50f6e5a0779b486ee57d3dd182a4307ff2107c0fa0
SSDEEP 96:2+kck50Gt2qJoXXZWklbfK4Y4xxcXdt9zbFK:rrKnkgkRK4Y4gt9zw
TLSH
T1D3B1940397858A2BD8BB4731E8F303125778ED049A63E34F1D94527EADA62445C32AA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCA43760149A66439C9C21484C69D59FFE.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\Nudge\CSCA43760149A66439C9C21484C69D59FFE.TMP
Size 106KB
SHA256 120e02fe2f3322ea16d908654e6d4c4c19f3a6459105eec312990c77d8424042
MD5 a0e87f187735a72bdbb4c35ac7ad67c5
SHA1 971291742bc8e7c567e691566abf0b322b3e8220
SHA512 310bf7dcb8944efc741cda2678ec187404f23cf00b7cfd6ef92191c375f03d6b0e56aed3485ecf3584beaeef89c9d3ab82812fea6d57d229e1c0cb5eb3e0d78b
SSDEEP 384:DK+rFpCR2C8OPGwvQoHsxJNmA0+VL8iwHE0HPqPzcqRtFWg4uGZDacnWEo/j:DCu6o/j
TLSH
T1FCB342ECA6CCC77CEDB24F3E87310F1164A98C98D6490EB51965B65E19B78C3F0E4262
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCCFC6B5575BC4340818D33C79AE4E19.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\gflxcjjk\CSCCFC6B5575BC4340818D33C79AE4E19.TMP
Size 652B
SHA256 effc5f038355f34d6ea88348af475ca2e51579e79e1111d0e1984c8beac39dca
MD5 1bd323d9b1679dd4ee9a5656bfdba6ec
SHA1 ad0363942ee370d7da3744e6c6eef43837c6c1ed
SHA512 143c577a2f6e7d12d59ff61b4accdb7d6f12492c4e35941858cc1d9cac959920277d3c5832d77a8453075fbb1d5a377e92e4940016c833253cb35332d5aa4373
TLSH
T1F8F05E49A3F8120EF4F74B31BDF64363A5A8BC64DE32A3ED5844131968749108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

gflxcjjk.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\gflxcjjk\gflxcjjk.0.cs
Size 1KB
SHA256 7c13aad2cebcd336ed07bbb3e90f592e5d9da85e8fe8150fa8b975c8575c3223
MD5 059e6021e5284e53ee27e8bfd3bec1dc
SHA1 816285bb1318fb8881b4150c4418cf35a2e36ebc
SHA512 b4d11405353786a76f8e861a08a086712d940048345db41644cb0a98144d45ee2269000fe8e0cd2c7b62c9e94d4e4e761749775a4e17e65e62b66aa8f929545d
TLSH
T18C414820913BEE3149BBC419DD55C7ABF36B106437B318A446ACD3254F0E05D91FDA9D
MD5 SHA1 SHA512 TLSH

Submit Download

gflxcjjk.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\gflxcjjk\gflxcjjk.cmdline
Size 494B
SHA256 219fd790ca235082c14ee0407bee54e48d5bdf2d4192db5e4734a67b2869de78
MD5 54068a6a7b682b6cecebddbc51038437
SHA1 7491937a7c5c6c13df1743426ed647977885fe26
SHA512 0787629c95fa6441328e02d0708414b59f8216f417436272d12cdf404a7fdf76965ffb87ad4b1c157cf82329a2437ed9c981d9fb3ec895d7576269080e02b628
TLSH
T12CF0977A422BC2BB45EE200715AECAACE273039B34497F546540891DE4632509BF1BC4
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1092-55-0x0000029CA7760000-0x0000029CA7768000-memory.dmp

Download

memory/1092-59-0x0000029CA7D20000-0x0000029CA7DCE000-memory.dmp

Download

memory/1092-60-0x0000029CA78B0000-0x0000029CA78BE000-memory.dmp

Download

memory/2248-39-0x0000000000270000-0x0000000000292000-memory.dmp

Download

memory/4024-11-0x00007FFAFD7A0000-0x00007FFAFE144000-memory.dmp

Download

memory/4024-34-0x00007FFAFD7A0000-0x00007FFAFE144000-memory.dmp

Download

memory/4024-19-0x000001EA7DC10000-0x000001EA7DC34000-memory.dmp

Download

memory/4024-18-0x000001EA7DC10000-0x000001EA7DC3A000-memory.dmp

Download

memory/4024-20-0x00007FFAFD7A0000-0x00007FFAFE144000-memory.dmp

Download

memory/4024-21-0x00007FFAFD7A0000-0x00007FFAFE144000-memory.dmp

Download

memory/4024-24-0x00007FFAFD7A0000-0x00007FFAFE144000-memory.dmp

Download

memory/4024-14-0x000001EA7DBB0000-0x000001EA7DBCE000-memory.dmp

Download

memory/4024-16-0x000001EA7DE90000-0x000001EA7DF42000-memory.dmp

Download

memory/4024-29-0x00007FFAFD7A0000-0x00007FFAFE144000-memory.dmp

Download

memory/4024-15-0x00007FFAFD7A0000-0x00007FFAFE144000-memory.dmp

Download

memory/4024-17-0x000001EA7DBD0000-0x000001EA7DBDA000-memory.dmp

Download

memory/4024-37-0x000001EA7DC50000-0x000001EA7DC6E000-memory.dmp

Download

memory/4024-0-0x00007FFAFD92F000-0x00007FFAFD930000-memory.dmp

Download

memory/4024-10-0x00007FFAFD7A0000-0x00007FFAFE144000-memory.dmp

Download

memory/4024-9-0x00007FFAFD7A0000-0x00007FFAFE144000-memory.dmp

Download

memory/4024-8-0x00007FFAFD7A0000-0x00007FFAFE144000-memory.dmp

Download

memory/4024-7-0x00007FFAFD7A0000-0x00007FFAFE144000-memory.dmp

Download

memory/4024-6-0x00007FFAFD7A0000-0x00007FFAFE144000-memory.dmp

Download

memory/4024-5-0x00007FFAFD7A0000-0x00007FFAFE144000-memory.dmp

Download

memory/4024-58-0x00007FFAFD7A0000-0x00007FFAFE144000-memory.dmp

Download

memory/4024-4-0x000001EA7DA10000-0x000001EA7DA32000-memory.dmp

Download

memory/4024-1-0x00007FFAFD7A0000-0x00007FFAFE144000-memory.dmp

Download