51d785ebbe850f179078014125bdc180db5b8f1209e0e61cea2d0dca44d36cef

Analysis

max time kernel
92s
max time network
111s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19/01/2024, 02:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SideLoad4/nvdrsvc.exe
Size

109KB
MD5

a16d7c0d5ca80d16cea88949ae0f5b4b
SHA1

a4c6d9eab106e46953f98008f72150e1e86323d6
SHA256

2669f90ce96af374d13bab2e0e83c46fb8f3576d30f649512d41689188cf3c69
SHA512

668099e5993375a30e2f7e9c92469c767b08e3ae38c12851b075949a1dafc081faffd884a898ce24f118f4ba79d847c8f18139b8461b78e8fa85328e59c1a8a3
SSDEEP

1536:X0lgvuCca+vqMXtmbckNjece2dtPPvRu5sr4CAv:X0luuCcaQ9wfNKCdt35uSr4p

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	nvdrsvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	nvdrsvc.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Install_log	nvdrsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Install_log\NAME1 = "log1.dat"	nvdrsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Install_log\NAME2 = "log2.dat"	nvdrsvc.exe

C:\Users\Admin\AppData\Local\Temp\SideLoad4\nvdrsvc.exe
"C:\Users\Admin\AppData\Local\Temp\SideLoad4\nvdrsvc.exe"
1⤵
- Checks processor information in registry
- Modifies registry class
PID:3732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3732-0-0x0000000000890000-0x0000000000929000-memory.dmp

Filesize
612KB

Download
memory/3732-2-0x0000000003ED0000-0x0000000004221000-memory.dmp

Filesize
3.3MB

Download
memory/3732-3-0x0000000003ED0000-0x0000000004221000-memory.dmp

Filesize
3.3MB

Download
memory/3732-4-0x0000000004C40000-0x0000000005518000-memory.dmp

Filesize
8.8MB

Download
memory/3732-5-0x0000000003ED0000-0x0000000004221000-memory.dmp

Filesize
3.3MB

Download
memory/3732-6-0x0000000003ED0000-0x0000000004221000-memory.dmp

Filesize
3.3MB

Download
memory/3732-7-0x0000000004C40000-0x0000000005518000-memory.dmp

Filesize
8.8MB

Download