cf142ce8f75b5bd050b78fda1428b6f1133bc03e7fd8062b714075f8fc89acfb

General

Target

cf142ce8f75b5bd050b78fda1428b6f1133bc03e7fd8062b714075f8fc89acfb.exe
Size

206KB
MD5

a0d50ed9adc55fc525612c4bd7c095e0
SHA1

8080a991dc36a0903abdde8b3983623713d5dd40
SHA256

cf142ce8f75b5bd050b78fda1428b6f1133bc03e7fd8062b714075f8fc89acfb
SHA512

4dafa49ebe98194fbed4d9330e1991d4aafe8d307e1e0d7d58cad4d6a5b57ec53468400fedb3830cade9307b95216be046d6a820535c28883f3035131c684087
SSDEEP

6144:7PB6ExrxVVReXtS84GHnYAPX2THY7vClZdtQ6aN:rX5TKezjSCTHe

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2044	NvdUpd.exe
1736	NvdUpd.exe

Loads dropped DLL 3 IoCs

pid	Process
1384	cf142ce8f75b5bd050b78fda1428b6f1133bc03e7fd8062b714075f8fc89acfb.exe
1384	cf142ce8f75b5bd050b78fda1428b6f1133bc03e7fd8062b714075f8fc89acfb.exe
1384	cf142ce8f75b5bd050b78fda1428b6f1133bc03e7fd8062b714075f8fc89acfb.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\NvUpdSrv = "C:\\Users\\Admin\\AppData\\Local\\NVIDIA Corporation\\Updates\\NvdUpd.exe"	cf142ce8f75b5bd050b78fda1428b6f1133bc03e7fd8062b714075f8fc89acfb.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run	cf142ce8f75b5bd050b78fda1428b6f1133bc03e7fd8062b714075f8fc89acfb.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2044 set thread context of 1736	2044	NvdUpd.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2044	NvdUpd.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2044	NvdUpd.exe
2044	NvdUpd.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 2044	1384	cf142ce8f75b5bd050b78fda1428b6f1133bc03e7fd8062b714075f8fc89acfb.exe	28
PID 1384 wrote to memory of 2044	1384	cf142ce8f75b5bd050b78fda1428b6f1133bc03e7fd8062b714075f8fc89acfb.exe	28
PID 1384 wrote to memory of 2044	1384	cf142ce8f75b5bd050b78fda1428b6f1133bc03e7fd8062b714075f8fc89acfb.exe	28
PID 1384 wrote to memory of 2044	1384	cf142ce8f75b5bd050b78fda1428b6f1133bc03e7fd8062b714075f8fc89acfb.exe	28
PID 2044 wrote to memory of 1736	2044	NvdUpd.exe	29
PID 2044 wrote to memory of 1736	2044	NvdUpd.exe	29
PID 2044 wrote to memory of 1736	2044	NvdUpd.exe	29
PID 2044 wrote to memory of 1736	2044	NvdUpd.exe	29
PID 2044 wrote to memory of 1736	2044	NvdUpd.exe	29
PID 2044 wrote to memory of 1736	2044	NvdUpd.exe	29
PID 2044 wrote to memory of 1736	2044	NvdUpd.exe	29
PID 2044 wrote to memory of 1736	2044	NvdUpd.exe	29
PID 2044 wrote to memory of 1736	2044	NvdUpd.exe	29
PID 2044 wrote to memory of 1736	2044	NvdUpd.exe	29

C:\Users\Admin\AppData\Local\Temp\cf142ce8f75b5bd050b78fda1428b6f1133bc03e7fd8062b714075f8fc89acfb.exe
"C:\Users\Admin\AppData\Local\Temp\cf142ce8f75b5bd050b78fda1428b6f1133bc03e7fd8062b714075f8fc89acfb.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Users\Admin\AppData\Local\NVIDIA Corporation\Updates\NvdUpd.exe
  "C:\Users\Admin\AppData\Local\NVIDIA Corporation\Updates\NvdUpd.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2044
- - C:\Users\Admin\AppData\Local\NVIDIA Corporation\Updates\NvdUpd.exe
    "C:\Users\Admin\AppData\Local\NVIDIA Corporation\Updates\NvdUpd.exe"
    3⤵
    - Executes dropped EXE
    PID:1736

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\NVIDIA Corporation\Updates\NvdUpd.exe

Filesize
278KB

MD5
2829716e6844d8d3b872da497ab3126b

SHA1
ecc3dd6f1a5abd3f35a1219cd3f2bec480c8d0b8

SHA256
6bbf048fdecf70f89058fd0fca76d57557a03f80155025c7f2069663eed94369

SHA512
6c1b37f59b9d02b8a67f4793420b84eddd0e16f110cc6e8702bbb921f036b593ca9cc61543d47ab68398b32ba520b81b3d0e84ef5de1263f73889ea41b427764

Download Submit
C:\Users\Admin\AppData\Local\NVIDIA Corporation\Updates\NvdUpd.exe

Filesize
278KB

MD5
2829716e6844d8d3b872da497ab3126b

SHA1
ecc3dd6f1a5abd3f35a1219cd3f2bec480c8d0b8

SHA256
6bbf048fdecf70f89058fd0fca76d57557a03f80155025c7f2069663eed94369

SHA512
6c1b37f59b9d02b8a67f4793420b84eddd0e16f110cc6e8702bbb921f036b593ca9cc61543d47ab68398b32ba520b81b3d0e84ef5de1263f73889ea41b427764

Download Submit
C:\Users\Admin\AppData\Local\NVIDIA Corporation\Updates\NvdUpd.exe

Filesize
278KB

MD5
2829716e6844d8d3b872da497ab3126b

SHA1
ecc3dd6f1a5abd3f35a1219cd3f2bec480c8d0b8

SHA256
6bbf048fdecf70f89058fd0fca76d57557a03f80155025c7f2069663eed94369

SHA512
6c1b37f59b9d02b8a67f4793420b84eddd0e16f110cc6e8702bbb921f036b593ca9cc61543d47ab68398b32ba520b81b3d0e84ef5de1263f73889ea41b427764

Download Submit
\Users\Admin\AppData\Local\NVIDIA Corporation\Updates\NvdUpd.exe

Filesize
278KB

MD5
2829716e6844d8d3b872da497ab3126b

SHA1
ecc3dd6f1a5abd3f35a1219cd3f2bec480c8d0b8

SHA256
6bbf048fdecf70f89058fd0fca76d57557a03f80155025c7f2069663eed94369

SHA512
6c1b37f59b9d02b8a67f4793420b84eddd0e16f110cc6e8702bbb921f036b593ca9cc61543d47ab68398b32ba520b81b3d0e84ef5de1263f73889ea41b427764

Download Submit
\Users\Admin\AppData\Local\NVIDIA Corporation\Updates\NvdUpd.exe

Filesize
278KB

MD5
2829716e6844d8d3b872da497ab3126b

SHA1
ecc3dd6f1a5abd3f35a1219cd3f2bec480c8d0b8

SHA256
6bbf048fdecf70f89058fd0fca76d57557a03f80155025c7f2069663eed94369

SHA512
6c1b37f59b9d02b8a67f4793420b84eddd0e16f110cc6e8702bbb921f036b593ca9cc61543d47ab68398b32ba520b81b3d0e84ef5de1263f73889ea41b427764

Download Submit
\Users\Admin\AppData\Local\Temp\nsy1AC4.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
memory/1384-54-0x0000000076DC1000-0x0000000076DC3000-memory.dmp

Filesize
8KB

Download
memory/1736-64-0x0000000000400000-0x00000000036C8000-memory.dmp

Filesize
50.8MB

Download
memory/1736-62-0x00000000001B0000-0x00000000002AA000-memory.dmp

Filesize
1000KB

Download
memory/1736-65-0x0000000000400000-0x00000000036C8000-memory.dmp

Filesize
50.8MB

Download
memory/1736-68-0x0000000000400000-0x00000000036C8000-memory.dmp

Filesize
50.8MB

Download
memory/1736-69-0x0000000000400000-0x00000000036C8000-memory.dmp

Filesize
50.8MB

Download
memory/1736-71-0x0000000000400000-0x00000000036C8000-memory.dmp

Filesize
50.8MB

Download
memory/1736-75-0x0000000000400000-0x00000000036C8000-memory.dmp

Filesize
50.8MB

Download
memory/1736-76-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1736-78-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2044-67-0x0000000000240000-0x0000000000244000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing