Analysis
- max time kernel
150s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 12:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
VAT-N0.20260807142129.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
VAT-N0.20260807142129.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
Behavioral task
behavioral3
Sample
pdfcorE8.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
pdfcorE8.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target VAT-N0.20260807142129.exe
- Size 3.5MB
- Sample260808-pg2qfa1saw
- SHA256 b869fbddbda07a9b4e511f533b4b7ac2a161cc88dae0519e0e55347c74db94a8
- MD5 c185dbe4fcb5da174009ada3aa4822c3
- SHA1 e8f1f825d79914fe88e9fd40983661f5ed638800
- SHA512 4fdad99da5cf6d3df2befe6505f844bafae4406f3b4e4c5777e767dd29ab0ec477e34fc73392288fd383b4a6900ecb6e8e933508c1c555a5343e1c46a4789af4
- SSDEEP 98304:7yG4M3dIc4WP1RG/w7VoTwvLIBvnR31C5Tfw/Ix6vFdO7:O4+jTxZV1C5bcIx6v/O7
- TLSH T173F58D20BAC08036D97216314DAA7739A6BDFE301B35A1D752543E783930BD26D396BF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: NVDisplay.Container.exe File opened (read-only) \??\B: NVDisplay.Container.exe File opened (read-only) \??\J: NVDisplay.Container.exe File opened (read-only) \??\K: NVDisplay.Container.exe File opened (read-only) \??\R: NVDisplay.Container.exe File opened (read-only) \??\U: NVDisplay.Container.exe File opened (read-only) \??\Y: NVDisplay.Container.exe File opened (read-only) \??\Z: NVDisplay.Container.exe File opened (read-only) \??\D: NVDisplay.Container.exe File opened (read-only) \??\G: NVDisplay.Container.exe File opened (read-only) \??\L: NVDisplay.Container.exe File opened (read-only) \??\O: NVDisplay.Container.exe File opened (read-only) \??\V: NVDisplay.Container.exe File opened (read-only) \??\X: NVDisplay.Container.exe File opened (read-only) \??\I: NVDisplay.Container.exe File opened (read-only) \??\Q: NVDisplay.Container.exe File opened (read-only) \??\H: NVDisplay.Container.exe File opened (read-only) \??\M: NVDisplay.Container.exe File opened (read-only) \??\N: NVDisplay.Container.exe File opened (read-only) \??\P: NVDisplay.Container.exe File opened (read-only) \??\S: NVDisplay.Container.exe File opened (read-only) \??\T: NVDisplay.Container.exe - Looks up external IP address via web service 1 TTPs 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 api.ipify.org 1 icanhazip.com 6 icanhazip.com - Discovers running processes 1 TTPs 3 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 1468 tasklist.exe 4400 tasklist.exe 1208 tasklist.exe - Executes dropped EXE 2 IoCs
pid Process 6004 NVDisplay.Container.exe 1036 NVDisplay.Container.exe - Loads dropped DLL 2 IoCs
pid Process 6004 NVDisplay.Container.exe 1036 NVDisplay.Container.exe - Executes a command shell one-liner 1 TTPs 3 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3160 cmd.exe 5736 cmd.exe 4888 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 17 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NVDisplay.Container.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ComputerDefaults.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VAT-N0.20260807142129.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NVDisplay.Container.exe - Delays execution with timeout.exe 3 IoCs
pid Process 5024 timeout.exe 1144 timeout.exe 2684 timeout.exe - Kills process with taskkill 1 IoCs
pid Process 3384 taskkill.exe - Modifies registry class 10 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/NvContainer.AIUser.{F8899258-2595-4721-A7DA-62686F3A9A8B}/NvContainerAIUser.nvi/NVDisplay.Container.exe" VAT-N0.20260807142129.exe Key deleted \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\ms-settings\Shell\open\command VAT-N0.20260807142129.exe Key deleted \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\ms-settings\Shell VAT-N0.20260807142129.exe Key deleted \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\ms-settings VAT-N0.20260807142129.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\ms-settings\Shell\open\command VAT-N0.20260807142129.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\ms-settings VAT-N0.20260807142129.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\ms-settings\Shell VAT-N0.20260807142129.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\ms-settings\Shell\open VAT-N0.20260807142129.exe Set value (str) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\ms-settings\Shell\open\command\DelegateExecute = "Ā" VAT-N0.20260807142129.exe Key deleted \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\ms-settings\Shell\open VAT-N0.20260807142129.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 6004 NVDisplay.Container.exe 6004 NVDisplay.Container.exe 6004 NVDisplay.Container.exe 6004 NVDisplay.Container.exe 6004 NVDisplay.Container.exe 6004 NVDisplay.Container.exe 6004 NVDisplay.Container.exe 6004 NVDisplay.Container.exe 6004 NVDisplay.Container.exe 6004 NVDisplay.Container.exe 6004 NVDisplay.Container.exe 6004 NVDisplay.Container.exe 6004 NVDisplay.Container.exe 6004 NVDisplay.Container.exe 6004 NVDisplay.Container.exe 6004 NVDisplay.Container.exe 6004 NVDisplay.Container.exe 6004 NVDisplay.Container.exe 6004 NVDisplay.Container.exe 6004 NVDisplay.Container.exe 6004 NVDisplay.Container.exe 6004 NVDisplay.Container.exe 6004 NVDisplay.Container.exe 6004 NVDisplay.Container.exe 6004 NVDisplay.Container.exe 6004 NVDisplay.Container.exe 6004 NVDisplay.Container.exe 6004 NVDisplay.Container.exe 6004 NVDisplay.Container.exe 6004 NVDisplay.Container.exe 6004 NVDisplay.Container.exe 6004 NVDisplay.Container.exe 6004 NVDisplay.Container.exe 6004 NVDisplay.Container.exe 6004 NVDisplay.Container.exe 6004 NVDisplay.Container.exe 6004 NVDisplay.Container.exe 6004 NVDisplay.Container.exe 6004 NVDisplay.Container.exe 6004 NVDisplay.Container.exe 6004 NVDisplay.Container.exe 6004 NVDisplay.Container.exe 6004 NVDisplay.Container.exe 6004 NVDisplay.Container.exe 6004 NVDisplay.Container.exe 6004 NVDisplay.Container.exe 6004 NVDisplay.Container.exe 6004 NVDisplay.Container.exe 6004 NVDisplay.Container.exe 6004 NVDisplay.Container.exe 6004 NVDisplay.Container.exe 6004 NVDisplay.Container.exe 6004 NVDisplay.Container.exe 6004 NVDisplay.Container.exe 6004 NVDisplay.Container.exe 6004 NVDisplay.Container.exe 6004 NVDisplay.Container.exe 6004 NVDisplay.Container.exe 6004 NVDisplay.Container.exe 6004 NVDisplay.Container.exe 6004 NVDisplay.Container.exe 6004 NVDisplay.Container.exe 6004 NVDisplay.Container.exe 6004 NVDisplay.Container.exe - Suspicious use of AdjustPrivilegeToken 44 IoCs
description pid Process Token: SeDebugPrivilege 6004 NVDisplay.Container.exe Token: SeLoadDriverPrivilege 6004 NVDisplay.Container.exe Token: SeTakeOwnershipPrivilege 6004 NVDisplay.Container.exe Token: SeIncBasePriorityPrivilege 6004 NVDisplay.Container.exe Token: SeTcbPrivilege 6004 NVDisplay.Container.exe Token: SeDebugPrivilege 3384 taskkill.exe Token: SeDebugPrivilege 1208 tasklist.exe Token: SeDebugPrivilege 6004 NVDisplay.Container.exe Token: SeCreateTokenPrivilege 6004 NVDisplay.Container.exe Token: SeAssignPrimaryTokenPrivilege 6004 NVDisplay.Container.exe Token: SeLockMemoryPrivilege 6004 NVDisplay.Container.exe Token: SeIncreaseQuotaPrivilege 6004 NVDisplay.Container.exe Token: SeMachineAccountPrivilege 6004 NVDisplay.Container.exe Token: SeTcbPrivilege 6004 NVDisplay.Container.exe Token: SeSecurityPrivilege 6004 NVDisplay.Container.exe Token: SeTakeOwnershipPrivilege 6004 NVDisplay.Container.exe Token: SeLoadDriverPrivilege 6004 NVDisplay.Container.exe Token: SeSystemProfilePrivilege 6004 NVDisplay.Container.exe Token: SeSystemtimePrivilege 6004 NVDisplay.Container.exe Token: SeProfSingleProcessPrivilege 6004 NVDisplay.Container.exe Token: SeIncBasePriorityPrivilege 6004 NVDisplay.Container.exe Token: SeCreatePagefilePrivilege 6004 NVDisplay.Container.exe Token: SeCreatePermanentPrivilege 6004 NVDisplay.Container.exe Token: SeBackupPrivilege 6004 NVDisplay.Container.exe Token: SeRestorePrivilege 6004 NVDisplay.Container.exe Token: SeShutdownPrivilege 6004 NVDisplay.Container.exe Token: SeDebugPrivilege 6004 NVDisplay.Container.exe Token: SeAuditPrivilege 6004 NVDisplay.Container.exe Token: SeSystemEnvironmentPrivilege 6004 NVDisplay.Container.exe Token: SeChangeNotifyPrivilege 6004 NVDisplay.Container.exe Token: SeRemoteShutdownPrivilege 6004 NVDisplay.Container.exe Token: SeUndockPrivilege 6004 NVDisplay.Container.exe Token: SeSyncAgentPrivilege 6004 NVDisplay.Container.exe Token: SeEnableDelegationPrivilege 6004 NVDisplay.Container.exe Token: SeManageVolumePrivilege 6004 NVDisplay.Container.exe Token: SeImpersonatePrivilege 6004 NVDisplay.Container.exe Token: SeCreateGlobalPrivilege 6004 NVDisplay.Container.exe Token: 31 6004 NVDisplay.Container.exe Token: 32 6004 NVDisplay.Container.exe Token: 33 6004 NVDisplay.Container.exe Token: 34 6004 NVDisplay.Container.exe Token: 35 6004 NVDisplay.Container.exe Token: SeDebugPrivilege 1468 tasklist.exe Token: SeDebugPrivilege 4400 tasklist.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1228 VAT-N0.20260807142129.exe 6004 NVDisplay.Container.exe 6004 NVDisplay.Container.exe 1036 NVDisplay.Container.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1228 wrote to memory of 3160 1228 VAT-N0.20260807142129.exe 89 PID 3160 wrote to memory of 2568 3160 cmd.exe 91 PID 2568 wrote to memory of 6004 2568 ComputerDefaults.exe 92 PID 6004 wrote to memory of 3384 6004 NVDisplay.Container.exe 93 PID 6004 wrote to memory of 5736 6004 NVDisplay.Container.exe 96 PID 5736 wrote to memory of 4888 5736 cmd.exe 98 PID 4888 wrote to memory of 1208 4888 cmd.exe 99 PID 4888 wrote to memory of 6088 4888 cmd.exe 100 PID 4888 wrote to memory of 5024 4888 cmd.exe 101 PID 4888 wrote to memory of 1468 4888 cmd.exe 106 PID 4888 wrote to memory of 1380 4888 cmd.exe 107 PID 4888 wrote to memory of 1144 4888 cmd.exe 108 PID 4888 wrote to memory of 4400 4888 cmd.exe 109 PID 4888 wrote to memory of 2524 4888 cmd.exe 110 PID 4888 wrote to memory of 2684 4888 cmd.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\VAT-N0.20260807142129.exe"C:\Users\Admin\AppData\Local\Temp\VAT-N0.20260807142129.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Windows\SysWOW64\cmd.exe/c C:\Windows\System32\ComputerDefaults.exe2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Windows\SysWOW64\ComputerDefaults.exeC:\Windows\System32\ComputerDefaults.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\ProgramData\NvContainer.AIUser.{F8899258-2595-4721-A7DA-62686F3A9A8B}\NvContainerAIUser.nvi\NVDisplay.Container.exe"NVDisplay.Container.exe"4⤵
- Enumerates connected drives
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6004 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im cmd.exe5⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3384
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start "" /B cmd /C C:\Users\Admin\AppData\Local\Temp\BC2411DEE9DC.CMD5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5736 -
C:\Windows\SysWOW64\cmd.execmd /C C:\Users\Admin\AppData\Local\Temp\BC2411DEE9DC.CMD6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq NVDisplay.Container.exe" /FO CSV7⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1208
-
-
C:\Windows\SysWOW64\find.exeFIND /I "NVDisplay.Container.exe"7⤵
- System Location Discovery: System Language Discovery
PID:6088
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:5024
-
-
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq NVDisplay.Container.exe" /FO CSV7⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1468
-
-
C:\Windows\SysWOW64\find.exeFIND /I "NVDisplay.Container.exe"7⤵
- System Location Discovery: System Language Discovery
PID:1380
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1144
-
-
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq NVDisplay.Container.exe" /FO CSV7⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4400
-
-
C:\Windows\SysWOW64\find.exeFIND /I "NVDisplay.Container.exe"7⤵
- System Location Discovery: System Language Discovery
PID:2524
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2684
-
-
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:3936
-
C:\ProgramData\NvContainer.AIUser.{F8899258-2595-4721-A7DA-62686F3A9A8B}\NvContainerAIUser.nvi\NVDisplay.Container.exeC:\ProgramData\NvContainer.AIUser.{F8899258-2595-4721-A7DA-62686F3A9A8B}\NvContainerAIUser.nvi\NVDisplay.Container.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1036
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\NvContainer.AIUser.{F8899258-2595-4721-A7DA-62686F3A9A8B}\NvContainerAIUser.nvi\NVDisplay.Container.exe
- Size 3.5MB
- SHA256 b869fbddbda07a9b4e511f533b4b7ac2a161cc88dae0519e0e55347c74db94a8
- MD5 c185dbe4fcb5da174009ada3aa4822c3
- SHA1 e8f1f825d79914fe88e9fd40983661f5ed638800
- SHA512 4fdad99da5cf6d3df2befe6505f844bafae4406f3b4e4c5777e767dd29ab0ec477e34fc73392288fd383b4a6900ecb6e8e933508c1c555a5343e1c46a4789af4
- SSDEEP 98304:7yG4M3dIc4WP1RG/w7VoTwvLIBvnR31C5Tfw/Ix6vFdO7:O4+jTxZV1C5bcIx6v/O7
- TLSH T173F58D20BAC08036D97216314DAA7739A6BDFE301B35A1D752543E783930BD26D396BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\NvContainer.AIUser.{F8899258-2595-4721-A7DA-62686F3A9A8B}\NvContainerAIUser.nvi\pdfcorE8.DLL
- Size 5.2MB
- SHA256 5b4acaf5006310cadac78c9de2feb7083fb7422b59101c1843038862f714d357
- MD5 f58d02e598560097c2aa54cfe79ad244
- SHA1 a50470aa906eb46e91ec20c9e43eb954738f23a0
- SHA512 14fb82462963b1a96127538d7ec23b0a543b347def1e1652d1b65972d86bd078402989bda77e992689e8e6bd441b28979d122bc50e4717e843e9919ff454bdbc
- SSDEEP 98304:2y/6ViOMXkk1VtnMvsFNbuWjs2Xwk5bNM3Lkd4tZ4OiZrq1DfPHNADtV6v+:2DViwk1XywuWjs2XwkxeHtZ4O7NADtVb
- TLSH T15246D0123DBD0CEDF0AB52344E98F2F4E7AEBDB01E390A5F11607619B931771492896B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\BC2411DEE9DC.CMD
- Size 1KB
- SHA256 f456dac6bb1a59fefc2da4ebf716111710f468cb5dff21f2ba4652eddf5f637d
- MD5 67b38d492e794defcfdd7d3d9d4d6c94
- SHA1 ac57f2485a997c5cddee4b428082510d344db91f
- SHA512 ea115d5cab69388f375adad5a92d425745073c8ae60ef2f2854927340c1447b2e004123ad003a9771c065b476905179ddee64164d6e7f44b2994a572253bedb3
- TLSH T14231FE8EC8074E1C431442DF129ACCAFC650E147FD847190B5DCAF812386A8D0DAABED
- MD5 SHA1 SHA512 TLSH