Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/08/2026, 06:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
VAT-N0.20260807142129.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
VAT-N0.20260807142129.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
Behavioral task
behavioral3
Sample
pdfcorE8.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
pdfcorE8.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target VAT-N0.20260807142129.exe
- Size 3.5MB
- Sample260808-gznmjacb45
- SHA256 b869fbddbda07a9b4e511f533b4b7ac2a161cc88dae0519e0e55347c74db94a8
- MD5 c185dbe4fcb5da174009ada3aa4822c3
- SHA1 e8f1f825d79914fe88e9fd40983661f5ed638800
- SHA512 4fdad99da5cf6d3df2befe6505f844bafae4406f3b4e4c5777e767dd29ab0ec477e34fc73392288fd383b4a6900ecb6e8e933508c1c555a5343e1c46a4789af4
- SSDEEP 98304:7yG4M3dIc4WP1RG/w7VoTwvLIBvnR31C5Tfw/Ix6vFdO7:O4+jTxZV1C5bcIx6v/O7
- TLSH T173F58D20BAC08036D97216314DAA7739A6BDFE301B35A1D752543E783930BD26D396BF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: NVDisplay.Container.exe File opened (read-only) \??\R: NVDisplay.Container.exe File opened (read-only) \??\X: NVDisplay.Container.exe File opened (read-only) \??\Y: NVDisplay.Container.exe File opened (read-only) \??\Z: NVDisplay.Container.exe File opened (read-only) \??\B: NVDisplay.Container.exe File opened (read-only) \??\I: NVDisplay.Container.exe File opened (read-only) \??\M: NVDisplay.Container.exe File opened (read-only) \??\N: NVDisplay.Container.exe File opened (read-only) \??\O: NVDisplay.Container.exe File opened (read-only) \??\S: NVDisplay.Container.exe File opened (read-only) \??\T: NVDisplay.Container.exe File opened (read-only) \??\V: NVDisplay.Container.exe File opened (read-only) \??\E: NVDisplay.Container.exe File opened (read-only) \??\H: NVDisplay.Container.exe File opened (read-only) \??\K: NVDisplay.Container.exe File opened (read-only) \??\L: NVDisplay.Container.exe File opened (read-only) \??\P: NVDisplay.Container.exe File opened (read-only) \??\Q: NVDisplay.Container.exe File opened (read-only) \??\U: NVDisplay.Container.exe File opened (read-only) \??\W: NVDisplay.Container.exe File opened (read-only) \??\J: NVDisplay.Container.exe - Looks up external IP address via web service 1 TTPs 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 16 api.ipify.org 17 api.ipify.org 31 api.ipify.org 33 icanhazip.com 34 icanhazip.com - Discovers running processes 1 TTPs 3 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 1480 tasklist.exe 2676 tasklist.exe 3756 tasklist.exe - Executes dropped EXE 2 IoCs
pid Process 1816 NVDisplay.Container.exe 3784 NVDisplay.Container.exe - Loads dropped DLL 2 IoCs
pid Process 1816 NVDisplay.Container.exe 3784 NVDisplay.Container.exe - Executes a command shell one-liner 1 TTPs 3 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3544 cmd.exe 3108 cmd.exe 1200 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 17 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ComputerDefaults.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NVDisplay.Container.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VAT-N0.20260807142129.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NVDisplay.Container.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Delays execution with timeout.exe 3 IoCs
pid Process 212 timeout.exe 1860 timeout.exe 3152 timeout.exe - Kills process with taskkill 1 IoCs
pid Process 1144 taskkill.exe - Modifies registry class 10 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\ms-settings\Shell\open\command\DelegateExecute VAT-N0.20260807142129.exe Key deleted \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\ms-settings\Shell\open VAT-N0.20260807142129.exe Key deleted \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\ms-settings\Shell VAT-N0.20260807142129.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\ms-settings\Shell\open\command VAT-N0.20260807142129.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\ms-settings VAT-N0.20260807142129.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\ms-settings\Shell\open VAT-N0.20260807142129.exe Key deleted \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\ms-settings\Shell\open\command VAT-N0.20260807142129.exe Key deleted \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\ms-settings VAT-N0.20260807142129.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\ms-settings\Shell VAT-N0.20260807142129.exe Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/NvContainer.AIUser.{369AE0BC-1AD9-4A4C-A872-2B18518F9730}/NvContainerAIUser.nvi/NVDisplay.Container.exe" VAT-N0.20260807142129.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1816 NVDisplay.Container.exe 1816 NVDisplay.Container.exe 1816 NVDisplay.Container.exe 1816 NVDisplay.Container.exe 1816 NVDisplay.Container.exe 1816 NVDisplay.Container.exe 1816 NVDisplay.Container.exe 1816 NVDisplay.Container.exe 1816 NVDisplay.Container.exe 1816 NVDisplay.Container.exe 1816 NVDisplay.Container.exe 1816 NVDisplay.Container.exe 1816 NVDisplay.Container.exe 1816 NVDisplay.Container.exe 1816 NVDisplay.Container.exe 1816 NVDisplay.Container.exe 1816 NVDisplay.Container.exe 1816 NVDisplay.Container.exe 1816 NVDisplay.Container.exe 1816 NVDisplay.Container.exe 1816 NVDisplay.Container.exe 1816 NVDisplay.Container.exe 1816 NVDisplay.Container.exe 1816 NVDisplay.Container.exe 1816 NVDisplay.Container.exe 1816 NVDisplay.Container.exe 1816 NVDisplay.Container.exe 1816 NVDisplay.Container.exe 1816 NVDisplay.Container.exe 1816 NVDisplay.Container.exe 1816 NVDisplay.Container.exe 1816 NVDisplay.Container.exe 1816 NVDisplay.Container.exe 1816 NVDisplay.Container.exe 1816 NVDisplay.Container.exe 1816 NVDisplay.Container.exe 1816 NVDisplay.Container.exe 1816 NVDisplay.Container.exe 1816 NVDisplay.Container.exe 1816 NVDisplay.Container.exe 1816 NVDisplay.Container.exe 1816 NVDisplay.Container.exe 1816 NVDisplay.Container.exe 1816 NVDisplay.Container.exe 1816 NVDisplay.Container.exe 1816 NVDisplay.Container.exe 1816 NVDisplay.Container.exe 1816 NVDisplay.Container.exe 1816 NVDisplay.Container.exe 1816 NVDisplay.Container.exe 1816 NVDisplay.Container.exe 1816 NVDisplay.Container.exe 1816 NVDisplay.Container.exe 1816 NVDisplay.Container.exe 1816 NVDisplay.Container.exe 1816 NVDisplay.Container.exe 1816 NVDisplay.Container.exe 1816 NVDisplay.Container.exe 1816 NVDisplay.Container.exe 1816 NVDisplay.Container.exe 1816 NVDisplay.Container.exe 1816 NVDisplay.Container.exe 1816 NVDisplay.Container.exe 1816 NVDisplay.Container.exe - Suspicious use of AdjustPrivilegeToken 44 IoCs
description pid Process Token: SeDebugPrivilege 1816 NVDisplay.Container.exe Token: SeLoadDriverPrivilege 1816 NVDisplay.Container.exe Token: SeTakeOwnershipPrivilege 1816 NVDisplay.Container.exe Token: SeIncBasePriorityPrivilege 1816 NVDisplay.Container.exe Token: SeTcbPrivilege 1816 NVDisplay.Container.exe Token: SeDebugPrivilege 1144 taskkill.exe Token: SeDebugPrivilege 2676 tasklist.exe Token: SeDebugPrivilege 1816 NVDisplay.Container.exe Token: SeCreateTokenPrivilege 1816 NVDisplay.Container.exe Token: SeAssignPrimaryTokenPrivilege 1816 NVDisplay.Container.exe Token: SeLockMemoryPrivilege 1816 NVDisplay.Container.exe Token: SeIncreaseQuotaPrivilege 1816 NVDisplay.Container.exe Token: SeMachineAccountPrivilege 1816 NVDisplay.Container.exe Token: SeTcbPrivilege 1816 NVDisplay.Container.exe Token: SeSecurityPrivilege 1816 NVDisplay.Container.exe Token: SeTakeOwnershipPrivilege 1816 NVDisplay.Container.exe Token: SeLoadDriverPrivilege 1816 NVDisplay.Container.exe Token: SeSystemProfilePrivilege 1816 NVDisplay.Container.exe Token: SeSystemtimePrivilege 1816 NVDisplay.Container.exe Token: SeProfSingleProcessPrivilege 1816 NVDisplay.Container.exe Token: SeIncBasePriorityPrivilege 1816 NVDisplay.Container.exe Token: SeCreatePagefilePrivilege 1816 NVDisplay.Container.exe Token: SeCreatePermanentPrivilege 1816 NVDisplay.Container.exe Token: SeBackupPrivilege 1816 NVDisplay.Container.exe Token: SeRestorePrivilege 1816 NVDisplay.Container.exe Token: SeShutdownPrivilege 1816 NVDisplay.Container.exe Token: SeDebugPrivilege 1816 NVDisplay.Container.exe Token: SeAuditPrivilege 1816 NVDisplay.Container.exe Token: SeSystemEnvironmentPrivilege 1816 NVDisplay.Container.exe Token: SeChangeNotifyPrivilege 1816 NVDisplay.Container.exe Token: SeRemoteShutdownPrivilege 1816 NVDisplay.Container.exe Token: SeUndockPrivilege 1816 NVDisplay.Container.exe Token: SeSyncAgentPrivilege 1816 NVDisplay.Container.exe Token: SeEnableDelegationPrivilege 1816 NVDisplay.Container.exe Token: SeManageVolumePrivilege 1816 NVDisplay.Container.exe Token: SeImpersonatePrivilege 1816 NVDisplay.Container.exe Token: SeCreateGlobalPrivilege 1816 NVDisplay.Container.exe Token: 31 1816 NVDisplay.Container.exe Token: 32 1816 NVDisplay.Container.exe Token: 33 1816 NVDisplay.Container.exe Token: 34 1816 NVDisplay.Container.exe Token: 35 1816 NVDisplay.Container.exe Token: SeDebugPrivilege 3756 tasklist.exe Token: SeDebugPrivilege 1480 tasklist.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1760 VAT-N0.20260807142129.exe 1816 NVDisplay.Container.exe 1816 NVDisplay.Container.exe 3784 NVDisplay.Container.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1760 wrote to memory of 1200 1760 VAT-N0.20260807142129.exe 86 PID 1200 wrote to memory of 2696 1200 cmd.exe 88 PID 2696 wrote to memory of 1816 2696 ComputerDefaults.exe 90 PID 1816 wrote to memory of 1144 1816 NVDisplay.Container.exe 96 PID 1816 wrote to memory of 3544 1816 NVDisplay.Container.exe 99 PID 3544 wrote to memory of 3108 3544 cmd.exe 101 PID 3108 wrote to memory of 2676 3108 cmd.exe 102 PID 3108 wrote to memory of 1204 3108 cmd.exe 103 PID 3108 wrote to memory of 212 3108 cmd.exe 105 PID 3108 wrote to memory of 3756 3108 cmd.exe 118 PID 3108 wrote to memory of 4396 3108 cmd.exe 119 PID 3108 wrote to memory of 1860 3108 cmd.exe 120 PID 3108 wrote to memory of 1480 3108 cmd.exe 121 PID 3108 wrote to memory of 1208 3108 cmd.exe 122 PID 3108 wrote to memory of 3152 3108 cmd.exe 123
Processes
-
C:\Users\Admin\AppData\Local\Temp\VAT-N0.20260807142129.exe"C:\Users\Admin\AppData\Local\Temp\VAT-N0.20260807142129.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Windows\SysWOW64\cmd.exe/c C:\Windows\System32\ComputerDefaults.exe2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Windows\SysWOW64\ComputerDefaults.exeC:\Windows\System32\ComputerDefaults.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\ProgramData\NvContainer.AIUser.{369AE0BC-1AD9-4A4C-A872-2B18518F9730}\NvContainerAIUser.nvi\NVDisplay.Container.exe"NVDisplay.Container.exe"4⤵
- Enumerates connected drives
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im cmd.exe5⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1144
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start "" /B cmd /C C:\Users\Admin\AppData\Local\Temp\BC2411DEE9DC.CMD5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Windows\SysWOW64\cmd.execmd /C C:\Users\Admin\AppData\Local\Temp\BC2411DEE9DC.CMD6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq NVDisplay.Container.exe" /FO CSV7⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2676
-
-
C:\Windows\SysWOW64\find.exeFIND /I "NVDisplay.Container.exe"7⤵
- System Location Discovery: System Language Discovery
PID:1204
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:212
-
-
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq NVDisplay.Container.exe" /FO CSV7⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3756
-
-
C:\Windows\SysWOW64\find.exeFIND /I "NVDisplay.Container.exe"7⤵
- System Location Discovery: System Language Discovery
PID:4396
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1860
-
-
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq NVDisplay.Container.exe" /FO CSV7⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1480
-
-
C:\Windows\SysWOW64\find.exeFIND /I "NVDisplay.Container.exe"7⤵
- System Location Discovery: System Language Discovery
PID:1208
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:3152
-
-
-
-
-
-
-
C:\ProgramData\NvContainer.AIUser.{369AE0BC-1AD9-4A4C-A872-2B18518F9730}\NvContainerAIUser.nvi\NVDisplay.Container.exeC:\ProgramData\NvContainer.AIUser.{369AE0BC-1AD9-4A4C-A872-2B18518F9730}\NvContainerAIUser.nvi\NVDisplay.Container.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3784
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\NvContainer.AIUser.{369AE0BC-1AD9-4A4C-A872-2B18518F9730}\NvContainerAIUser.nvi\NVDisplay.Container.exe
- Size 3.5MB
- SHA256 b869fbddbda07a9b4e511f533b4b7ac2a161cc88dae0519e0e55347c74db94a8
- MD5 c185dbe4fcb5da174009ada3aa4822c3
- SHA1 e8f1f825d79914fe88e9fd40983661f5ed638800
- SHA512 4fdad99da5cf6d3df2befe6505f844bafae4406f3b4e4c5777e767dd29ab0ec477e34fc73392288fd383b4a6900ecb6e8e933508c1c555a5343e1c46a4789af4
- SSDEEP 98304:7yG4M3dIc4WP1RG/w7VoTwvLIBvnR31C5Tfw/Ix6vFdO7:O4+jTxZV1C5bcIx6v/O7
- TLSH T173F58D20BAC08036D97216314DAA7739A6BDFE301B35A1D752543E783930BD26D396BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\NvContainer.AIUser.{369AE0BC-1AD9-4A4C-A872-2B18518F9730}\NvContainerAIUser.nvi\PDFCore8.dll
- Size 5.2MB
- SHA256 3cdf7e3999c68e837b015e63240ae73961da2cd583306dd988980f1499dd74ef
- MD5 9848dd054ef4c3cedc5dd1d76d5cf560
- SHA1 c5047c199f014e76b01df08ee937a108ef6f0fe5
- SHA512 d4791e14157312a2377eed0da08127989d42da32e74dc05dcd766d6ba3c59deae31e8374b7c1d14767a3e9489b97ce795578377d7db02fa6f85cfb4f8ed08595
- SSDEEP 98304:2y/6ViOMXkk1VtnMvsFNbuWjs2ywk5bNM3Lkd4tZ4OiZrq1DfPHNADtV6v+:2DViwk1XywuWjs2ywkxeHtZ4O7NADtVb
- TLSH T16F46D0123DBD0CEDF0AB52344E98F2F4E7AEBDB01E390A5F11607619B931771492896B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\BC2411DEE9DC.CMD
- Size 1KB
- SHA256 04b3057015b92d8113cc350afa6688cd7cf13605a07b6630edfb1d1b71fd8a33
- MD5 47cd2e431d025f526e6944fe33fa62d5
- SHA1 8dca8e4bf223748182d32c842423bc2279a4e775
- SHA512 4ec4dc7e85d8fd29847d23b7b8fd3f8753aa487308beb16f02641a3539d4582c4c4b7f3b728ef803ce7cfb25940d999cd13b50d828c8ec6a6d40f9148d7bcf5d
- TLSH T18431F48EC8474E1C431543DF125ACC5FC654E147FE84719075985B81138598D0D6ABAD
- MD5 SHA1 SHA512 TLSH