Analysis
- max time kernel
169s - max time network
176s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
20/10/2022, 14:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2b96337625a7a97b460571de821d5679b3135ae6d3a4af32cbfd36b4e27c692f.exe
Resource
win7-20220812-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2b96337625a7a97b460571de821d5679b3135ae6d3a4af32cbfd36b4e27c692f.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2b96337625a7a97b460571de821d5679b3135ae6d3a4af32cbfd36b4e27c692f.exe
- Size 105KB
- Sample221020-rpn6eshdf4
- SHA256 2b96337625a7a97b460571de821d5679b3135ae6d3a4af32cbfd36b4e27c692f
- MD5 8106447e73abbe4944596416270a89c0
- SHA1 dd4330947efb3e6a65eeadd068b9b99da89e4b20
- SHA512 406cad6b0e8ef2c0485f9bd5e24018a09ef696b1b7f9574f5e12ae15f4c9fc4c0bc116235ffdca18c7113fd39a201d14393d1656dd4a743bb6a987e06f541cd9
- SSDEEP 3072:LS8BCfoDaXJhW31TxytKFwlkoPByPbyFfF:LPB6H4VxyoUwzmF
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5020 NvdUpd.exe - Loads dropped DLL 3 IoCs
pid Process 3876 2b96337625a7a97b460571de821d5679b3135ae6d3a4af32cbfd36b4e27c692f.exe 3876 2b96337625a7a97b460571de821d5679b3135ae6d3a4af32cbfd36b4e27c692f.exe 3876 2b96337625a7a97b460571de821d5679b3135ae6d3a4af32cbfd36b4e27c692f.exe - Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\NVIDIA Corporation\Updates\NvdUpd.exe 2b96337625a7a97b460571de821d5679b3135ae6d3a4af32cbfd36b4e27c692f.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies data under HKEY_USERS 7 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\NVIDIA Corporation\Global NvdUpd.exe Key created \REGISTRY\USER\.DEFAULT\Software\NVIDIA Corporation\Global\nvUpdSrv NvdUpd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\NVIDIA Corporation\Global\nvUpdSrv\value = "15150326" NvdUpd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\NVIDIA Corporation\Global\nvUpdSrv\GUID = "1ee5d4e4-e3c3-4c1a-9345-9d40143fc4b9" NvdUpd.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\NVIDIA Corporation\Global\nvUpdSrv NvdUpd.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE NvdUpd.exe Key created \REGISTRY\USER\.DEFAULT\Software\NVIDIA Corporation NvdUpd.exe - Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeBackupPrivilege 5020 NvdUpd.exe Token: SeBackupPrivilege 5020 NvdUpd.exe Token: SeBackupPrivilege 5020 NvdUpd.exe Token: SeBackupPrivilege 5020 NvdUpd.exe Token: SeBackupPrivilege 5020 NvdUpd.exe Token: SeBackupPrivilege 5020 NvdUpd.exe Token: SeBackupPrivilege 5020 NvdUpd.exe Token: SeBackupPrivilege 5020 NvdUpd.exe Token: SeBackupPrivilege 5020 NvdUpd.exe Token: SeBackupPrivilege 5020 NvdUpd.exe Token: SeBackupPrivilege 5020 NvdUpd.exe Token: SeBackupPrivilege 5020 NvdUpd.exe Token: SeBackupPrivilege 5020 NvdUpd.exe Token: SeBackupPrivilege 5020 NvdUpd.exe Token: SeBackupPrivilege 5020 NvdUpd.exe Token: SeBackupPrivilege 5020 NvdUpd.exe Token: SeBackupPrivilege 5020 NvdUpd.exe Token: SeBackupPrivilege 5020 NvdUpd.exe Token: SeBackupPrivilege 5020 NvdUpd.exe Token: SeBackupPrivilege 5020 NvdUpd.exe Token: SeBackupPrivilege 5020 NvdUpd.exe Token: SeBackupPrivilege 5020 NvdUpd.exe Token: SeBackupPrivilege 5020 NvdUpd.exe Token: SeBackupPrivilege 5020 NvdUpd.exe Token: SeBackupPrivilege 5020 NvdUpd.exe Token: SeBackupPrivilege 5020 NvdUpd.exe Token: SeBackupPrivilege 5020 NvdUpd.exe Token: SeBackupPrivilege 5020 NvdUpd.exe Token: SeBackupPrivilege 5020 NvdUpd.exe Token: SeBackupPrivilege 5020 NvdUpd.exe Token: SeBackupPrivilege 5020 NvdUpd.exe Token: SeBackupPrivilege 5020 NvdUpd.exe Token: SeBackupPrivilege 5020 NvdUpd.exe Token: SeBackupPrivilege 5020 NvdUpd.exe Token: SeBackupPrivilege 5020 NvdUpd.exe Token: SeBackupPrivilege 5020 NvdUpd.exe Token: SeBackupPrivilege 5020 NvdUpd.exe Token: SeBackupPrivilege 5020 NvdUpd.exe Token: SeBackupPrivilege 5020 NvdUpd.exe Token: SeBackupPrivilege 5020 NvdUpd.exe Token: SeBackupPrivilege 5020 NvdUpd.exe Token: SeBackupPrivilege 5020 NvdUpd.exe Token: SeBackupPrivilege 5020 NvdUpd.exe Token: SeBackupPrivilege 5020 NvdUpd.exe Token: SeBackupPrivilege 5020 NvdUpd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b96337625a7a97b460571de821d5679b3135ae6d3a4af32cbfd36b4e27c692f.exe"C:\Users\Admin\AppData\Local\Temp\2b96337625a7a97b460571de821d5679b3135ae6d3a4af32cbfd36b4e27c692f.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
PID:3876
-
C:\Program Files (x86)\NVIDIA Corporation\Updates\NvdUpd.exe"C:\Program Files (x86)\NVIDIA Corporation\Updates\NvdUpd.exe"1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5020
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\NVIDIA Corporation\Updates\NvdUpd.exe
- Size 97KB
- SHA256 2272a283a09b2938c23ac3ca7be2b62943fd017c2afe6f92562dd1745b4e58ec
- MD5 1ee0c7f62b4ae8eb843f9d4de1e5ded4
- SHA1 e4857a5c4d4e397e709c4c1771a3054a3e2c58e3
- SHA512 e26f0bc77c8ccaf9cb54273c8887a019db2c2cef277b5488016989b7978a7d7ebe19c56977d8f97e84cf467c7af349f8945588620597cf79815f9442c5e50e15
- SSDEEP 1536:RAYP8FRgrfa7qqjmOgTlsC6JoFVnVkXwb9we3zdUDSEeZ5T1osxQ0Uj9V9pqwnZt:9PKS3qj8Tl4ornRqqV9xMpHZOI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\NVIDIA Corporation\Updates\NvdUpd.exe
- Size 97KB
- SHA256 2272a283a09b2938c23ac3ca7be2b62943fd017c2afe6f92562dd1745b4e58ec
- MD5 1ee0c7f62b4ae8eb843f9d4de1e5ded4
- SHA1 e4857a5c4d4e397e709c4c1771a3054a3e2c58e3
- SHA512 e26f0bc77c8ccaf9cb54273c8887a019db2c2cef277b5488016989b7978a7d7ebe19c56977d8f97e84cf467c7af349f8945588620597cf79815f9442c5e50e15
- SSDEEP 1536:RAYP8FRgrfa7qqjmOgTlsC6JoFVnVkXwb9we3zdUDSEeZ5T1osxQ0Uj9V9pqwnZt:9PKS3qj8Tl4ornRqqV9xMpHZOI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nstD0F3.tmp\System.dll
- Size 11KB
- SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- MD5 c17103ae9072a06da581dec998343fc1
- SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nstD0F3.tmp\UserInfo.dll
- Size 4KB
- SHA256 564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5
- MD5 7579ade7ae1747a31960a228ce02e666
- SHA1 8ec8571a296737e819dcf86353a43fcf8ec63351
- SHA512 a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nstD0F3.tmp\UserInfo.dll
- Size 4KB
- SHA256 564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5
- MD5 7579ade7ae1747a31960a228ce02e666
- SHA1 8ec8571a296737e819dcf86353a43fcf8ec63351
- SHA512 a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b
- MD5 SHA1 SHA512