Analysis
- max time kernel
149s - max time network
122s - platform
windows7_x64 - resource
win7-20240508-en - resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system - submitted
12/05/2024, 18:26
Behavioral task
behavioral1
Sample
Nvidia.exe
Resource
win10-20240404-en
windows10-1703-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
Nvidia.exe
Resource
win7-20240508-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral3
Sample
Nvidia.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral4
Sample
Nvidia.exe
Resource
win11-20240508-en
windows11-21h2-x64
17 signatures
150 seconds
General
- Target Nvidia.exe
- Size 2.6MB
- Sample240512-w3ftesdb55
- SHA256 e387c084d5c3b62413743e912ee10776564e7c55ba1dc801990b312b88b61efe
- MD5 87610f8f3d48edf25d48c4c0ba2b3486
- SHA1 ab7498abd8626c968c84167ef1c1c503faace1fe
- SHA512 73840a477b360fb1ab2061087838618a748f8b24560d289d563b4ba4b1b905f62686f4bca2c2e236007be1bc5931711c0d162b1c0f3ade009861e004116ddfe1
- SSDEEP 49152:O+8l/s9Yf5u4uT/s9YEQtQRTMYIMi7ztf33cSywWyFoEgn9u65:OtVsGobzsG1tQRjdih8rwcV5
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detect ZGRat V1 1 IoCs
resource yara_rule behavioral2/memory/2060-1-0x0000000000B20000-0x0000000000DC4000-memory.dmp family_zgrat_v1 - .NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule behavioral2/memory/2060-1-0x0000000000B20000-0x0000000000DC4000-memory.dmp net_reactor - Drops startup file 3 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\T4bzBg0leXAM700i.exe Nvidia.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\T4bzBg0leXAM700i.exe Nvidia.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.CashRansomware Nvidia.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 7 icanhazip.com 9 ip-api.com 5 api.ipify.org 6 api.ipify.org - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Cash.img" Nvidia.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\mshwLatin.dll.CashRansomware Nvidia.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\ShapeCollector.exe.mui.CashRansomware Nvidia.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipTsf.dll.mui.CashRansomware Nvidia.exe File opened for modification C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui.CashRansomware Nvidia.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkWatson.exe.mui.CashRansomware Nvidia.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mshwLatin.dll.mui.CashRansomware Nvidia.exe File opened for modification C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui.CashRansomware Nvidia.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi.CashRansomware Nvidia.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.htm.CashRansomware Nvidia.exe File opened for modification C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui.CashRansomware Nvidia.exe File opened for modification C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui.CashRansomware Nvidia.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers.xml.CashRansomware Nvidia.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\tipresx.dll.mui.CashRansomware Nvidia.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.jpg.CashRansomware Nvidia.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_2.emf.CashRansomware Nvidia.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipskor.xml.CashRansomware Nvidia.exe File opened for modification C:\Program Files\Common Files\System\ado\msadox.dll.CashRansomware Nvidia.exe File opened for modification C:\Program Files\Common Files\System\msadc\handler.reg.CashRansomware Nvidia.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui.CashRansomware Nvidia.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrfrash.dat.CashRansomware Nvidia.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsfin.xml.CashRansomware Nvidia.exe File opened for modification C:\Program Files\Common Files\System\msadc\msadcer.dll.CashRansomware Nvidia.exe File opened for modification C:\Program Files\Common Files\System\msadc\msdaremr.dll.CashRansomware Nvidia.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\msoshext.dll.CashRansomware Nvidia.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSCommon.dll.CashRansomware Nvidia.exe File opened for modification C:\Program Files\Common Files\System\ado\adovbs.inc.CashRansomware Nvidia.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipschs.xml.CashRansomware Nvidia.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\TabIpsps.dll.CashRansomware Nvidia.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm.CashRansomware Nvidia.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui.CashRansomware Nvidia.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\IpsMigrationPlugin.dll.CashRansomware Nvidia.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg.CashRansomware Nvidia.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\ShadesOfBlue.jpg.CashRansomware Nvidia.exe File opened for modification C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui.CashRansomware Nvidia.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL.CashRansomware Nvidia.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe.CashRansomware Nvidia.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\tipresx.dll.mui.CashRansomware Nvidia.exe File opened for modification C:\Program Files\Common Files\System\msadc\msadco.dll.CashRansomware Nvidia.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\tipskins.dll.CashRansomware Nvidia.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipBand.dll.mui.CashRansomware Nvidia.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\it-IT\MSTTSLoc.dll.mui.CashRansomware Nvidia.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe.CashRansomware Nvidia.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InkObj.dll.mui.CashRansomware Nvidia.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipBand.dll.mui.CashRansomware Nvidia.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipBand.dll.mui.CashRansomware Nvidia.exe File opened for modification C:\Program Files\Common Files\System\msadc\msadcs.dll.CashRansomware Nvidia.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\journal.dll.CashRansomware Nvidia.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IpsMigrationPlugin.dll.mui.CashRansomware Nvidia.exe File opened for modification C:\Program Files\Common Files\System\msadc\adcvbs.inc.CashRansomware Nvidia.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll.CashRansomware Nvidia.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\FlickLearningWizard.exe.mui.CashRansomware Nvidia.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(cm).wmf.CashRansomware Nvidia.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.htm.CashRansomware Nvidia.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.jpg.CashRansomware Nvidia.exe File opened for modification C:\Program Files\Common Files\System\ado\msado21.tlb.CashRansomware Nvidia.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\msinfo32.exe.mui.CashRansomware Nvidia.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\tabskb.dll.CashRansomware Nvidia.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tabskb.dll.mui.CashRansomware Nvidia.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad.xml.CashRansomware Nvidia.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InkWatson.exe.mui.CashRansomware Nvidia.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\mshwLatin.dll.mui.CashRansomware Nvidia.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsdan.xml.CashRansomware Nvidia.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.CashRansomware Nvidia.exe File opened for modification C:\Program Files\Common Files\System\ado\msado15.dll.CashRansomware Nvidia.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2060 Nvidia.exe Token: SeBackupPrivilege 1580 vssvc.exe Token: SeRestorePrivilege 1580 vssvc.exe Token: SeAuditPrivilege 1580 vssvc.exe - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Nvidia.exe"C:\Users\Admin\AppData\Local\Temp\Nvidia.exe"1⤵
- Drops startup file
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2060
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1580
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\CURRENT.CashRansomware
- Size 32B
- SHA256 528c061c92e8a6ae9c505f05ed2334bcca6a8dc4bea14713eb560b7f3b313a96
- MD5 fc492be84544517c2ffe7836fd892d94
- SHA1 ce975f864ca581189d7003d9a18ae1d4865d054d
- SHA512 f4bc1255c16bacbd85db3cfeab24cbbce61fc65b248786e43f941e1f345d89f833882f4e97812f2076960bca1a07513a732f8ad6b5d81a01cd41ba6dc7f6cb90
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_2.CashRansomware
- Size 8KB
- SHA256 b306c325208d92f228447359a77821ecaf68a442286bd6a0392b6447ac3f7fd6
- MD5 f3ded7a32da3c95f5ed220eb5bddd838
- SHA1 8f4902ecd5f888b112c445040ea4ea683df48999
- SHA512 642d270fdb41bda69bd8786ad68e2278c95b28e2add3daa62a425118c11a7a11af40ec47d2c7c114204e28a01941ef7719593f3a4724cde5b86d52f3a4b33900
- SSDEEP 192:o1yLtzroCsBM4ytvd3j558+RQTsp5i1H1LPfBOSNfm8N5q9O:oy4Css4+RQBVzNfm8HB
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\YR1SPOMQ\desktop.ini.CashRansomware
- Size 80B
- SHA256 5b90dcd2881810067d6370b13adb1eac0bb5551bfb81d2dfef28bca609cf6d77
- MD5 b0742fd0f97b8138452e411d834a2e59
- SHA1 c416eca81508c39aa92da1e9e16dfc559ab924e0
- SHA512 bdd8f386ffacaa805e458a64b01a7d9e263f2066ecae11bd943d64ad9a25884817a289d91121c3734a4a8a3671b80672371a67b23cc49024242339dd91d50bc9
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\MSNBC News~.feed-ms.CashRansomware
- Size 28KB
- SHA256 e70801d13627e9f53092eb1cb28b3c9f99207f763cf89b0ff22eba6af910237e
- MD5 28d720423f593aebe417204397791f84
- SHA1 96eab42b1155e1a06dd6c930e9ae6fe405aac59d
- SHA512 a38f46d476855941a57534444be224f1f9c66b5e3edeb264ea4645db92162075377bbc01c01753481f39f1fb11bed8fd3a1bc65d53e7b295fe8d862cb8079807
- SSDEEP 768:wEKg1UgtaKZ3NaEGZBOYIuYDG33mTv9ISb6Sdm17yzdmVHq6NJBNu:wE3/aKXGZB604R2rIzUVj3B8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IEDownloadHistory\container.dat.CashRansomware
- Size 16B
- SHA256 bcf19f885c224b85008d478b6e4a997d80c6d508845452181b37b0b000a98835
- MD5 91a77a112c726520a089bb5c9262cc26
- SHA1 9f4083de089c93adfa4db0f358e5df082e17fb52
- SHA512 b77515aae382f9d2ea70ab4e41ae1ceea7574d07f6a13d359cc89f8a2b2109d786b98a66d7d4185bd97813146663f00b2c81b3ff96c676cb9bf0272d390ddc4c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ox017b3g.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.CashRansomware
- Size 48KB
- SHA256 18e9a35109a500e483f2173ee3d65359ad8566bdf69fd1be3fbca32308174bf4
- MD5 0b7905f5b42b95b64f5403297d1d7b4a
- SHA1 516f4feefeda44c822440fe848c1a7a3d0b03cf6
- SHA512 d5bde0b0b1dacb7fc8e239665b4eec032f3450804f5771bf54c2f9e996f9573c434af07240067e0210f10ebfe7d2c07e59d777fae77c956859775a4652f9edd7
- SSDEEP 1536:63Kuw29DWlmnUq/WltiyMDFo7ako9jl+NoJfj:Iw29hnFmIO7akwjlMoRj
- MD5 SHA1 SHA512 SSDEEP