9a4e54a6781e17f7f646a89f2c3d5e622c59205b6f40c152802eeeee239fb7eb

Analysis

user interaction
yes
max time kernel
86s
max time network
88s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 00:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NVIDIA PACK V4.rar
Size 3.9MB
Sample260809-akpgysga44
SHA256 9a4e54a6781e17f7f646a89f2c3d5e622c59205b6f40c152802eeeee239fb7eb
MD5 75e24b99c8be9bec727074846b7bd51e
SHA1 07d52911d73317f82fcd62fcaba6f3cba31eec92
SHA512 e35e6d8a83eebf44d68fd30eafa1c955ba1be01717aacc6ce973cb77e97a5010c47710067034a7db948335634b41aba12306baeb1e0f9b29268a9077399b836c
SSDEEP 98304:QX+8ttEt56rGo21mg9J9n9951H2euv1SaxB:QX+wtEt5668g9j3qeuN9
TLSH
T151163382BDEDD3E9F39EF6444C2DF12487A88ACD110E5273443A5D906DAA45933237EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution installer persistence

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
1444	MSI_util_v3.exe
4728	NVCleanstall_1.19.0.exe
1752	nvidiaProfileInspector.exe

ConfuserEx .NET packer 2 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
behavioral1/files/0x00070000000244b7-19.dat	ConfuserEx
behavioral1/memory/4728-28-0x000001F36C3F0000-0x000001F36C9C6000-memory.dmp	ConfuserEx

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4816	powershell.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4368	cmd.exe
3232	cmd.exe

Inno Setup is an open-source installation builder for Windows applications. 1 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/4728-28-0x000001F36C3F0000-0x000001F36C9C6000-memory.dmp	innosetup

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
4228	7zFM.exe
4228	7zFM.exe
4816	powershell.exe
4816	powershell.exe
4816	powershell.exe
4228	7zFM.exe
4228	7zFM.exe
4228	7zFM.exe
4228	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4228	7zFM.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeRestorePrivilege	4228	7zFM.exe
Token: 35	4228	7zFM.exe
Token: SeSecurityPrivilege	4228	7zFM.exe
Token: SeSecurityPrivilege	4228	7zFM.exe
Token: SeShutdownPrivilege	4728	NVCleanstall_1.19.0.exe
Token: SeCreatePagefilePrivilege	4728	NVCleanstall_1.19.0.exe
Token: SeDebugPrivilege	4728	NVCleanstall_1.19.0.exe
Token: SeSecurityPrivilege	4228	7zFM.exe
Token: SeDebugPrivilege	4816	powershell.exe
Token: SeSecurityPrivilege	1600	msiexec.exe
Token: SeSecurityPrivilege	4228	7zFM.exe
Token: SeSecurityPrivilege	4228	7zFM.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
4228	7zFM.exe
4228	7zFM.exe
1444	MSI_util_v3.exe
4228	7zFM.exe
4228	7zFM.exe
4228	7zFM.exe
4228	7zFM.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4228 wrote to memory of 1444	4228	7zFM.exe	95
PID 4228 wrote to memory of 4728	4228	7zFM.exe	100
PID 4228 wrote to memory of 4368	4228	7zFM.exe	104
PID 4368 wrote to memory of 4816	4368	cmd.exe	106
PID 4228 wrote to memory of 3232	4228	7zFM.exe	109
PID 4228 wrote to memory of 1752	4228	7zFM.exe	111

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\NVIDIA PACK V4.rar"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4228
- C:\Users\Admin\AppData\Local\Temp\7zO480EA1F8\MSI_util_v3.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO480EA1F8\MSI_util_v3.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  PID:1444
- C:\Users\Admin\AppData\Local\Temp\7zO480716C8\NVCleanstall_1.19.0.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO480716C8\NVCleanstall_1.19.0.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7zO48077879\Nvidia Debloat.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4368
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-WmiObject -Query \"SELECT * FROM Win32_Product WHERE Name LIKE 'Telemetry'\" | ForEach-Object { $_.Uninstall() }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4816
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7zO480C9759\Clean Temp Files.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:3232
- C:\Users\Admin\AppData\Local\Temp\7zO48062CB9\nvidiaProfileInspector.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO48062CB9\nvidiaProfileInspector.exe"
  2⤵
  - Executes dropped EXE
  PID:1752

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

nvidiaProfileInspector.exe

Path C:\Users\Admin\AppData\Local\Temp\7zO48062CB9\nvidiaProfileInspector.exe
Size 535KB
SHA256 1233487ea4db928ee062f12b00a6eda01445d001ab55566107234dea4dc65872
MD5 ff5f39370b67a274cb58ba7e2039d2e2
SHA1 3020bb33e563e9efe59ea22aa4588bed5f1b2897
SHA512 7decec37c80d1d5ad6296d737d5d16c4fc92353a3ae4bd083c4a7b267bb6073a53d9f6152b20f9b5e62ba6c93f76d08f813812a83ce164db4c91107d7ad5a95f
SSDEEP 6144:4sP/zdlaCgMOx9mN1S0Mi11iBFmEobpU0u5p:/P5cCdOHmN1S0Mi2BFmLU0A
TLSH
T13DC4BE4D35ECA99AEB0804F2F13F25259A5BEA560A85532CB97C26B37363DC811C1D3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NVCleanstall_1.19.0.exe

Path C:\Users\Admin\AppData\Local\Temp\7zO480716C8\NVCleanstall_1.19.0.exe
Size 3.8MB
SHA256 9dd36ef956af927cf41fa441f91b329a7973e13965e4e7d70e6fa9c1df1cade6
MD5 b2c6e0b0e19a3e1657761b7e8c3f1716
SHA1 36c5a84f88c13c94a998904aeb14a2faa76830fa
SHA512 944cca789c3006effa72c73eb0804ed14b557dfa86bc91f1d2b8fe3ce951a203063d02e635c482c03d670cac08d9d64e0a32d3d6bf3a3bfc003a020bbb3eef15
SSDEEP 98304:nq0Kv4bIAe+9hHjQNsbUEBE6frVLSt+zcyk:nq0u459ZkNc7WwrV2ozY
TLSH
T17D0633DD5ADFF87BD6CA4DB1829B0FA2CBAE45B68024A79E75015978F4222BC170D034
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nvidia Debloat.bat

Path C:\Users\Admin\AppData\Local\Temp\7zO48077879\Nvidia Debloat.bat
Size 1KB
SHA256 b0c127b4781125b2417941958f0f20fa338f6d0d17610a2eadc5297122ae47d3
MD5 08c8a4166d562518c0a1312631f531eb
SHA1 fd0e06f392176ad08974a9342a07c6f7137e03a9
SHA512 e7134df1e0977b4e62b0dd38b0571ae8abda06acbdcdb392109efecf569ff2d3822735c71cb808d7f752b2bdc490dd10aa407a7e3ea4801852a792340e31c078
TLSH
T16B311103670EC0BA62D1807AEFA35D22FE264401915029473B95D3EAE7CA5CC57BC558
MD5 SHA1 SHA512 TLSH

Submit Download

Clean Temp Files.bat

Path C:\Users\Admin\AppData\Local\Temp\7zO480C9759\Clean Temp Files.bat
Size 1KB
SHA256 bad63a42f7a2b3d49b2f1afd046337e1d78ca744814ced577b084259ce23f15d
MD5 71fd0ae93297ac4599d568cc881d6e97
SHA1 d791e8ba66eebfba552dda87c90be170f4d99d23
SHA512 d8f1a73075871daa223e884a79867018464bbb4fc6168b28229c089e54a1f1ac8dff156e39871f501e8db6256d42dca5f08bf48cbeb3ea7425f3c221ed942ab8
TLSH
T15F31C00135F617B085F25D6A328F22F3D20976CA95AC09340AD051F0EE655EB1BB73CE
MD5 SHA1 SHA512 TLSH

Submit Download

MSI_util_v3.exe

Path C:\Users\Admin\AppData\Local\Temp\7zO480EA1F8\MSI_util_v3.exe
Size 45KB
SHA256 695800afad96f858a3f291b7df21c16649528f13d39b63fb7c233e5676c8df6f
MD5 6c748415c350f14fd5b78fa5c37173a5
SHA1 332d64f5885a738d6ce968172b79b1101303cb5b
SHA512 c53c5d8ab355d950ae27022dc79f168def1aaeeb64398a553bb96f73d5f1c4df2e085b977a3c558329979b86f99a940fa94e33e671c9dcc5cd7a1310d2eb7461
SSDEEP 768:1AthLhXIHo+tMCXCBU4copfP4xSwpPO0zsU9RXMJmiuofnC8+d:2kztMCSBU4copwVXz9dMYKfz+d
TLSH
T1D1234B0177DD4B3BE1FE0AB85472100507B2F5BA6531FBCE5D9960DE5CA3B808A61B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_e5riveac.ta3.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_e5riveac.ta3.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1444-12-0x000001C0A7100000-0x000001C0A7112000-memory.dmp

Download

memory/1444-13-0x000001C0A8F20000-0x000001C0A8F30000-memory.dmp

Download

memory/1752-67-0x000001AACBF20000-0x000001AACBFAC000-memory.dmp

Download

memory/4728-31-0x000001F36BA90000-0x000001F36BA96000-memory.dmp

Download

memory/4728-34-0x000001F36DCA0000-0x000001F36DCAE000-memory.dmp

Download

memory/4728-33-0x000001F36E1C0000-0x000001F36E1F8000-memory.dmp

Download

memory/4728-35-0x000001F36C200000-0x000001F36C29A000-memory.dmp

Download

memory/4728-32-0x000001F36DC00000-0x000001F36DC08000-memory.dmp

Download

memory/4728-30-0x000001F36DCF0000-0x000001F36E1BC000-memory.dmp

Download

memory/4728-29-0x000001F36BAC0000-0x000001F36BAE2000-memory.dmp

Download

memory/4728-28-0x000001F36C3F0000-0x000001F36C9C6000-memory.dmp

Download

memory/4728-27-0x000001F369A60000-0x000001F369E32000-memory.dmp

Download