32f80f04d936215e00017d445f93489ddedb001a346c9ca04cdbbbd76c96b154 | Triage

Analysis

max time kernel
122s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27-06-2024 22:23

Sharing

Report Analysis Logs

General

Target

Pack de Optimizacion by bask1ngg/11. NVIDIA O AMD/NVIDIA/nvidia.cmd
Size

804B
MD5

41f014d298c76925f718e0b2241e2db6
SHA1

6a83ae335cddffc067089b4a19fa3066deb9f01b
SHA256

789f1621fd24496497312457afc8d9a60c2feaf33ee99c6428afe6aed701b523
SHA512

6ad3a2d8e2d3b4e483b7ec46e3c6267914a93c3c5e697caee57d39124b1bf79e713695a435a33cff079fbca1fbffba63adc5356e86a12900ae7ad3e19e654cc2

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 216 wrote to memory of 3348	216	cmd.exe	reg.exe
PID 216 wrote to memory of 3348	216	cmd.exe	reg.exe
PID 216 wrote to memory of 1492	216	cmd.exe	reg.exe
PID 216 wrote to memory of 1492	216	cmd.exe	reg.exe
PID 216 wrote to memory of 3912	216	cmd.exe	reg.exe
PID 216 wrote to memory of 3912	216	cmd.exe	reg.exe
PID 216 wrote to memory of 2800	216	cmd.exe	reg.exe
PID 216 wrote to memory of 2800	216	cmd.exe	reg.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Pack de Optimizacion by bask1ngg\11. NVIDIA O AMD\NVIDIA\nvidia.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:216

C:\Windows\system32\reg.exe
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nvlddmkm" /v "DisablePreemption" /t REG_DWORD /d 1 /f
2⤵
PID:3348

C:\Windows\system32\reg.exe
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nvlddmkm" /v "DisableCudaContextPreemption" /t REG_DWORD /d 1 /f
2⤵
PID:1492

C:\Windows\system32\reg.exe
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nvlddmkm" /v "DisableWriteCombining" /t REG_DWORD /d 1 /f
2⤵
PID:3912

C:\Windows\system32\reg.exe
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nvlddmkm" /v "BuffersInFlight" /t REG_DWORD /d 4096 /f
2⤵
PID:2800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1280,i,1697479186275492802,18058102846092193784,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:8
1⤵
PID:3692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads