8248b3e32bbb61067f5bfe7eddccadb9430b6307c4f19165673cd1d23a77d6a7

General

Target

8248b3e32bbb61067f5bfe7eddccadb9430b6307c4f19165673cd1d23a77d6a7.exe
Size

220KB
MD5

5399eb5fa84fe42b59d49b8b29721110
SHA1

acc8311ee4004e631df4faec7ff712fa5bdfca23
SHA256

8248b3e32bbb61067f5bfe7eddccadb9430b6307c4f19165673cd1d23a77d6a7
SHA512

84662b940018032c47beff54e3cb58be7c765f873af6049f6da3e2effa85e28a01525bd8322a7ed8ff9173c7fbb990b4e40b09f1e8915912512fdd38ce9a0a7c
SSDEEP

3072:hmWJLZk28YUL4qx9RIHgil3UuhSa3U3dDpd6Oy+MIrnj3JnNKY:sWfkL15x9SHVe1jb5

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

8248b3e32bbb61067f5bfe7eddccadb9430b6307c4f19165673cd1d23a77d6a7.exenuviv.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	8248b3e32bbb61067f5bfe7eddccadb9430b6307c4f19165673cd1d23a77d6a7.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	nuviv.exe

Executes dropped EXE 1 IoCs

Processes:

nuviv.exe

pid process

1524 nuviv.exe

pid	process
1524	nuviv.exe

Loads dropped DLL 2 IoCs

Processes:

8248b3e32bbb61067f5bfe7eddccadb9430b6307c4f19165673cd1d23a77d6a7.exe

pid	process
892	8248b3e32bbb61067f5bfe7eddccadb9430b6307c4f19165673cd1d23a77d6a7.exe
892	8248b3e32bbb61067f5bfe7eddccadb9430b6307c4f19165673cd1d23a77d6a7.exe

Adds Run key to start application 2 TTPs 29 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

nuviv.exe8248b3e32bbb61067f5bfe7eddccadb9430b6307c4f19165673cd1d23a77d6a7.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuviv = "C:\\Users\\Admin\\nuviv.exe /d"	nuviv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuviv = "C:\\Users\\Admin\\nuviv.exe /w"	nuviv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuviv = "C:\\Users\\Admin\\nuviv.exe /x"	nuviv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuviv = "C:\\Users\\Admin\\nuviv.exe /s"	nuviv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuviv = "C:\\Users\\Admin\\nuviv.exe /h"	nuviv.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\	8248b3e32bbb61067f5bfe7eddccadb9430b6307c4f19165673cd1d23a77d6a7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuviv = "C:\\Users\\Admin\\nuviv.exe /i"	nuviv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuviv = "C:\\Users\\Admin\\nuviv.exe /j"	nuviv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuviv = "C:\\Users\\Admin\\nuviv.exe /a"	nuviv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuviv = "C:\\Users\\Admin\\nuviv.exe /q"	nuviv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuviv = "C:\\Users\\Admin\\nuviv.exe /c"	nuviv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuviv = "C:\\Users\\Admin\\nuviv.exe /r"	8248b3e32bbb61067f5bfe7eddccadb9430b6307c4f19165673cd1d23a77d6a7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuviv = "C:\\Users\\Admin\\nuviv.exe /r"	nuviv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuviv = "C:\\Users\\Admin\\nuviv.exe /v"	nuviv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuviv = "C:\\Users\\Admin\\nuviv.exe /m"	nuviv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuviv = "C:\\Users\\Admin\\nuviv.exe /e"	nuviv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuviv = "C:\\Users\\Admin\\nuviv.exe /g"	nuviv.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\	nuviv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuviv = "C:\\Users\\Admin\\nuviv.exe /b"	nuviv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuviv = "C:\\Users\\Admin\\nuviv.exe /t"	nuviv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuviv = "C:\\Users\\Admin\\nuviv.exe /u"	nuviv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuviv = "C:\\Users\\Admin\\nuviv.exe /l"	nuviv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuviv = "C:\\Users\\Admin\\nuviv.exe /p"	nuviv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuviv = "C:\\Users\\Admin\\nuviv.exe /n"	nuviv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuviv = "C:\\Users\\Admin\\nuviv.exe /k"	nuviv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuviv = "C:\\Users\\Admin\\nuviv.exe /z"	nuviv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuviv = "C:\\Users\\Admin\\nuviv.exe /f"	nuviv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuviv = "C:\\Users\\Admin\\nuviv.exe /o"	nuviv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuviv = "C:\\Users\\Admin\\nuviv.exe /y"	nuviv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

8248b3e32bbb61067f5bfe7eddccadb9430b6307c4f19165673cd1d23a77d6a7.exenuviv.exe

pid	process
892	8248b3e32bbb61067f5bfe7eddccadb9430b6307c4f19165673cd1d23a77d6a7.exe
1524	nuviv.exe
1524	nuviv.exe
1524	nuviv.exe
1524	nuviv.exe
1524	nuviv.exe
1524	nuviv.exe
1524	nuviv.exe
1524	nuviv.exe
1524	nuviv.exe
1524	nuviv.exe
1524	nuviv.exe
1524	nuviv.exe
1524	nuviv.exe
1524	nuviv.exe
1524	nuviv.exe
1524	nuviv.exe
1524	nuviv.exe
1524	nuviv.exe
1524	nuviv.exe
1524	nuviv.exe
1524	nuviv.exe
1524	nuviv.exe
1524	nuviv.exe
1524	nuviv.exe
1524	nuviv.exe
1524	nuviv.exe
1524	nuviv.exe
1524	nuviv.exe
1524	nuviv.exe
1524	nuviv.exe
1524	nuviv.exe
1524	nuviv.exe
1524	nuviv.exe
1524	nuviv.exe
1524	nuviv.exe
1524	nuviv.exe
1524	nuviv.exe
1524	nuviv.exe
1524	nuviv.exe
1524	nuviv.exe
1524	nuviv.exe
1524	nuviv.exe
1524	nuviv.exe
1524	nuviv.exe
1524	nuviv.exe
1524	nuviv.exe
1524	nuviv.exe
1524	nuviv.exe
1524	nuviv.exe
1524	nuviv.exe
1524	nuviv.exe
1524	nuviv.exe
1524	nuviv.exe
1524	nuviv.exe
1524	nuviv.exe
1524	nuviv.exe
1524	nuviv.exe
1524	nuviv.exe
1524	nuviv.exe
1524	nuviv.exe
1524	nuviv.exe
1524	nuviv.exe
1524	nuviv.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

8248b3e32bbb61067f5bfe7eddccadb9430b6307c4f19165673cd1d23a77d6a7.exenuviv.exe

pid process

892 8248b3e32bbb61067f5bfe7eddccadb9430b6307c4f19165673cd1d23a77d6a7.exe
1524 nuviv.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

8248b3e32bbb61067f5bfe7eddccadb9430b6307c4f19165673cd1d23a77d6a7.exe

description	pid	process	target process
PID 892 wrote to memory of 1524	892	8248b3e32bbb61067f5bfe7eddccadb9430b6307c4f19165673cd1d23a77d6a7.exe	nuviv.exe
PID 892 wrote to memory of 1524	892	8248b3e32bbb61067f5bfe7eddccadb9430b6307c4f19165673cd1d23a77d6a7.exe	nuviv.exe
PID 892 wrote to memory of 1524	892	8248b3e32bbb61067f5bfe7eddccadb9430b6307c4f19165673cd1d23a77d6a7.exe	nuviv.exe
PID 892 wrote to memory of 1524	892	8248b3e32bbb61067f5bfe7eddccadb9430b6307c4f19165673cd1d23a77d6a7.exe	nuviv.exe

C:\Users\Admin\AppData\Local\Temp\8248b3e32bbb61067f5bfe7eddccadb9430b6307c4f19165673cd1d23a77d6a7.exe
"C:\Users\Admin\AppData\Local\Temp\8248b3e32bbb61067f5bfe7eddccadb9430b6307c4f19165673cd1d23a77d6a7.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:892

C:\Users\Admin\nuviv.exe
"C:\Users\Admin\nuviv.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1524

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

1

T1158

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\nuviv.exe
Filesize
220KB

MD5
326b67a242e62d8534c47a1de7fb8df1

SHA1
b6c3552e6033afff4bb2f396dceb53ab64585592

SHA256
9161ff448a6a2ec35ca8ec69683f2c6ce9cc28e5fb2b2e0e863dedf826909aee

SHA512
dc54315646525f6c49557f2f0ba2d01d5fbfb268e503724eb44641bad9898aa79e7699ade14c0d1ef0746648c012065c64b8341b0fac3faed60b695e7d04014c

Download Submit
C:\Users\Admin\nuviv.exe
Filesize
220KB

MD5
326b67a242e62d8534c47a1de7fb8df1

SHA1
b6c3552e6033afff4bb2f396dceb53ab64585592

SHA256
9161ff448a6a2ec35ca8ec69683f2c6ce9cc28e5fb2b2e0e863dedf826909aee

SHA512
dc54315646525f6c49557f2f0ba2d01d5fbfb268e503724eb44641bad9898aa79e7699ade14c0d1ef0746648c012065c64b8341b0fac3faed60b695e7d04014c

Download Submit
\Users\Admin\nuviv.exe
Filesize
220KB

MD5
326b67a242e62d8534c47a1de7fb8df1

SHA1
b6c3552e6033afff4bb2f396dceb53ab64585592

SHA256
9161ff448a6a2ec35ca8ec69683f2c6ce9cc28e5fb2b2e0e863dedf826909aee

SHA512
dc54315646525f6c49557f2f0ba2d01d5fbfb268e503724eb44641bad9898aa79e7699ade14c0d1ef0746648c012065c64b8341b0fac3faed60b695e7d04014c

Download Submit
\Users\Admin\nuviv.exe
Filesize
220KB

MD5
326b67a242e62d8534c47a1de7fb8df1

SHA1
b6c3552e6033afff4bb2f396dceb53ab64585592

SHA256
9161ff448a6a2ec35ca8ec69683f2c6ce9cc28e5fb2b2e0e863dedf826909aee

SHA512
dc54315646525f6c49557f2f0ba2d01d5fbfb268e503724eb44641bad9898aa79e7699ade14c0d1ef0746648c012065c64b8341b0fac3faed60b695e7d04014c

Download Submit
memory/892-56-0x0000000075521000-0x0000000075523000-memory.dmp

Filesize
8KB

Download
memory/1524-59-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads