Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
09/08/2026, 00:16
General
- Target NVIDIA PACK V4/NVCleanstall_1.19.0.exe
- Size 3.8MB
- Sample260809-akpgysga44
- SHA256 9dd36ef956af927cf41fa441f91b329a7973e13965e4e7d70e6fa9c1df1cade6
Malware Config
Signatures
- ConfuserEx .NET packer 1 IoCs
Detects ConfuserEx .NET packer.
- Inno Setup is an open-source installation builder for Windows applications. 1 IoCs
Inno Setup installer
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\NVIDIA PACK V4\NVCleanstall_1.19.0.exe"C:\Users\Admin\AppData\Local\Temp\NVIDIA PACK V4\NVCleanstall_1.19.0.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2072-0-0x000001E0B1E00000-0x000001E0B21D2000-memory.dmp
memory/2072-1-0x000001E0CC7F0000-0x000001E0CCDC6000-memory.dmp
memory/2072-2-0x000001E0B25D0000-0x000001E0B25F2000-memory.dmp
memory/2072-3-0x000001E0CE0F0000-0x000001E0CE5BC000-memory.dmp
memory/2072-4-0x000001E0B2570000-0x000001E0B2576000-memory.dmp
memory/2072-5-0x000001E0B2590000-0x000001E0B25A0000-memory.dmp
memory/2072-6-0x000001E0B2590000-0x000001E0B25A0000-memory.dmp
memory/2072-7-0x000001E0B3F50000-0x000001E0B3F58000-memory.dmp
memory/2072-8-0x000001E0B2590000-0x000001E0B25A0000-memory.dmp
memory/2072-9-0x000001E0B2590000-0x000001E0B25A0000-memory.dmp
memory/2072-11-0x000001E0CDF50000-0x000001E0CDF5E000-memory.dmp
memory/2072-10-0x000001E0CDFA0000-0x000001E0CDFD8000-memory.dmp
memory/2072-12-0x000001E0B2590000-0x000001E0B25A0000-memory.dmp
memory/2072-13-0x000001E0B2590000-0x000001E0B25A0000-memory.dmp
memory/2072-14-0x000001E0B2590000-0x000001E0B25A0000-memory.dmp