Analysis
-
max time kernel
149s -
max time network
136s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
12-05-2024 18:26
General
-
Target
Nvidia.exe
-
Size
2.6MB
-
MD5
87610f8f3d48edf25d48c4c0ba2b3486
-
SHA1
ab7498abd8626c968c84167ef1c1c503faace1fe
-
SHA256
e387c084d5c3b62413743e912ee10776564e7c55ba1dc801990b312b88b61efe
-
SHA512
73840a477b360fb1ab2061087838618a748f8b24560d289d563b4ba4b1b905f62686f4bca2c2e236007be1bc5931711c0d162b1c0f3ade009861e004116ddfe1
-
SSDEEP
49152:O+8l/s9Yf5u4uT/s9YEQtQRTMYIMi7ztf33cSywWyFoEgn9u65:OtVsGobzsG1tQRjdih8rwcV5
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 3 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Modifies registry class 64 IoCs
-
Suspicious behavior: MapViewOfSection 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 7 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Nvidia.exe"C:\Users\Admin\AppData\Local\Temp\Nvidia.exe"1⤵
- Checks computer location settings
- Drops startup file
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32B
MD59d1dbba4e07a974c1e48b392c2f0a547
SHA1de7bc6fad636f2c0ef05eaffd11cdd80e1dfff6a
SHA2569a28a5156fa625019430a736832c0f71a95d46c4fcb15e96823e0b75f643282a
SHA512b34a9ff0aeb22c3bb05372cacdc3f2aad75d71b44d38b16199f1b47ccb155eacb9ee65aac9699281a050efa071584a553a65f553cd2c88771b02b92b7ed54895
-
Filesize
48B
MD551e927798e7e847fb99600aefd637c36
SHA19508d80609ebd755f7526958737f1f83554878fa
SHA256cf31c876d297a0d88985350c70a811307916ea073579d3f5dc8461371d8b9ce7
SHA512194856309824ba309a1b7430fc0ccaacb7bec550f6a94a2a373d4f952ccb0fa7e2b9ec8871cf1f86f3fe1e31bf7ccba6e3e5c6467c4fb19ee866aee6079bccf8
-
Filesize
8KB
MD54606823c227712fc8c72525986c97eef
SHA1b57d65978a2d0b9bcb62d5853daa08b8f900e944
SHA2563d31df6410e8cb5de4bf7b991d35e3c8580e9a0e3f620a136b4f4af5e6717f3c
SHA5120b8d6e191d2ee335023031f507e7879ad93cf8dba19a523c2605da1a4382c53bbf4c5a3b3dba0b172c65a8be5eda5354d946c48f625ae5647d96090babdffcc7
-
Filesize
8KB
MD5df828f6625e03cd633e3d9c23c7e3caa
SHA1ed042a9ca7a412b14e4a08b3807168537efe148d
SHA25638dcbd8606733fa19b90607f9e6899330796add064dc4d985380b47bda798725
SHA5129245c03edc18c81e23eba6ccc480b3297f3992283d1802c81df3b0fe6e30c271329ae87ad408c19f0ddccd3d86f140e9c1c75c24ac7e545c7cd77e36a4d0c939
-
Filesize
264KB
MD5ada28a7b5f7c84e1fe8f5aae724646c3
SHA1d417c48d78319851fbec5b16576753cd894d94c9
SHA256593784531a64016ab2cff812025f0c16f62dab48288bd1e834110cf87c048fbc
SHA512d38e2074a550b3276bb9c189866d29f54ce2af239c65878b5cf5088dffd41680228c2e4dd7342811c1994955c5ae4a8d5cd41773db93cb50b4d967e75e9f80dc
-
Filesize
8KB
MD5a4a5f6ad7f84dc6f5d1ef686ae4b9ffc
SHA152951c9ca6e83adda145ef4bbbb6167573cc2c64
SHA256ec75132b8ebf7b484f7eb0b16c2f8a1e6241848b429fcf947824021412f17dcc
SHA5121101ad386d5720a2b8c0b7bfb139dc19f0c704b7a83150b16befc7294aa946f84d68e5e09f4c7778990f7ab1c782b47026736815a3bef3980ee84c5e52b3cead
-
Filesize
74KB
MD5d4fc49dc14f63895d997fa4940f24378
SHA13efb1437a7c5e46034147cbbc8db017c69d02c31
SHA256853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1
SHA512cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a
-
Filesize
8KB
MD594fd674109030cf32260e09a3dd37174
SHA1579122471173314c9c29db0f473241f4e3c14fec
SHA25658659a2657aed1204ba54eddadf85fa02245ccfe171fc412e7d2fb9ab4a55507
SHA5127faad2cba44b7c522f6da6f265d01e5b3f267d94962e4a1a84f7164b5284c795062935553b7f1494b660c5190377821e2e8cf8c46c076beb64e7275447e9d656
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
512KB
MD540cfc3c507c563f225f33da1a695c17d
SHA1d0ad16708c0a37485f6e87303ed0b4f0f2e09473
SHA256ca110d03906136a72d130592f1e50b35e30760bf394c4b9d7001216cfe24ddb5
SHA5125c01c09c240a2441b7963fa7be3fdaf8b9a3a95c8026222bf8ebd4641f37aa976e9410b8c5339de60cfa63ec6cbb4714053d7069bed034fd38fc4b5cce00e902
-
Filesize
218KB
MD513e8857c11c103c86af5a010ba171f66
SHA1dd8f6ee3cd8b1ac01c480e0843c323805c3cf2ae
SHA2568b69fd5d6b540b3080b438f3cf0d42f3266654e786ce7dc5e85855d309e962ac
SHA5128454d4a02c15e12428628aaf9df2f5ec48d261e692a8b4f2e7e81d83c3acd6921bfb2d3ebc76f78f124fd0065852af348bec56a91e7ba9c54525615d6b7804b0
-
Filesize
16B
MD5fba9ae2333b5034a1873be16f40535d6
SHA129a23be331f4aa1ac8dc0ac410403ac4d46b8082
SHA25676a34026b795981c8a72c870d499bae062fa2227c4f50c444b6de6f8ff872fe3
SHA512762328a121c3d823a75a636d7a58841ff5d553cdd5421a9c8678d9bb64bc122bffcc8d523694e98fd9fa777a477ad02ce1b3b168f8c7c163cc687b2916cf2892
-
Filesize
48KB
MD587efaef028928228d5fec30df288eb07
SHA19b41d462f8324f926b9441511cab361b060a93cc
SHA256653c33eb6bab1f6beda9b6c775326b14fb967cac8a51710c97af8e43dd638274
SHA512de938315591bab492b5faf079b394b3a8ccc2839313a3ee73d34b5e0625a25377c06b02bff9cfe5d2b14d0c6e86432a4b0d84a8304a8b54abc13982ce7009c85
-
Filesize
9KB
MD5b38d3abcc3a30f095eaecfdd9f62e033
SHA1f9960cb04896c229fdf6438efa51b4afd98f526f
SHA256579374af17d7b9f972e9efcb761e0a8f88ef6d44dce53d56d0512d16c4728b9d
SHA51246968c3951daa569dfecf75ba95a6694d525cbbd1883070189896ab270bb561cb2d00d7d38168405da1f78695f95cc481d28bcbff74be53d9a89822a09595768
-
Filesize
5.1MB
-
Filesize
9.9MB
-
Filesize
1.8MB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
2.6MB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
1024KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB