Analysis

  • max time kernel
    899s
  • max time network
    454s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-es
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-eslocale:es-esos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/08/2026, 01:13

General

  • Target
    NVIDIA_app_v11.0.8.299.exe
  • Size 168.7MB
  • Sample260809-ble6cafp9z
  • SHA256 df54c76346a8c4b3d9cc2d65b31d92e68bc0fef73ba0a775ddb53264d7ee75d6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10

Malware Config

Signatures

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 64 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NVIDIA_app_v11.0.8.299.exe
    "C:\Users\Admin\AppData\Local\Temp\NVIDIA_app_v11.0.8.299.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2876
    • C:\NVIDIA\NVAPP2\setup.exe
      "C:\NVIDIA\NVAPP2\setup.exe" -log:"C:\ProgramData\\NVIDIA Corporation\\NVIDIA App\\Installer\\Logs" -loglevel:6
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:720
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:3272
    • C:\Windows\System32\SecurityHealthHost.exe
      \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
      1⤵
        PID:1112

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            0000.ui.forms

            • Path C:\NVIDIA\NVAPP2\NVI2\0000.ui.forms
            • Size 72KB
            • SHA256 c69a31733610c6ef02c052dcf483ec8591fb9dc7b23ef1dd0ee66b8809fcb41b
            • MD5 SHA1 SHA512 SSDEEP TLSH

            0000.ui.strings

            • Path C:\NVIDIA\NVAPP2\NVI2\0000.ui.strings
            • Size 2KB
            • SHA256 c0404e4eff2a2d0d33e48e3dad9488da05f588ff19af34095e108afec89a4d07
            • MD5 SHA1 SHA512 TLSH

            0401.ui.forms

            • Path C:\NVIDIA\NVAPP2\NVI2\0401.ui.forms
            • Size 5KB
            • SHA256 295e5891f684083da6f0694889a9da1c09c4976ff1cdf87a6aa9504dfb22e567
            • MD5 SHA1 SHA512 SSDEEP TLSH

            0401.ui.strings

            • Path C:\NVIDIA\NVAPP2\NVI2\0401.ui.strings
            • Size 13KB
            • SHA256 0f0b740340c257662cc857778c264bbed33a356c1177f54a8acb818709c5fde5
            • MD5 SHA1 SHA512 SSDEEP TLSH

            0404.ui.forms

            • Path C:\NVIDIA\NVAPP2\NVI2\0404.ui.forms
            • Size 6KB
            • SHA256 7bbb642ed96b774bf81d6ab909ce2d68581110ce6b27d6cb941d7478784ede22
            • MD5 SHA1 SHA512 SSDEEP TLSH

            0404.ui.strings

            • Path C:\NVIDIA\NVAPP2\NVI2\0404.ui.strings
            • Size 10KB
            • SHA256 10220b66da36826ad17e4072263d54b214f2d56c9a160a6be00ae2dcca9ce54c
            • MD5 SHA1 SHA512 SSDEEP TLSH

            0405.ui.forms

            • Path C:\NVIDIA\NVAPP2\NVI2\0405.ui.forms
            • Size 5KB
            • SHA256 3f1d4d41c3c486ac58b17ae2641dc46f322847c0797b28f77a217cca9742f389
            • MD5 SHA1 SHA512 SSDEEP TLSH

            0405.ui.strings

            • Path C:\NVIDIA\NVAPP2\NVI2\0405.ui.strings
            • Size 11KB
            • SHA256 b1d5eb724cff4e5a0b7f7868335bf8d9a24d89b6ab6204233dc8fef1b3040d18
            • MD5 SHA1 SHA512 SSDEEP TLSH

            0406.ui.forms

            • Path C:\NVIDIA\NVAPP2\NVI2\0406.ui.forms
            • Size 5KB
            • SHA256 e57909fb0269f96256aaf695c0681ccd13571cc6d960268635538eff8eac87da
            • MD5 SHA1 SHA512 SSDEEP TLSH

            0406.ui.strings

            • Path C:\NVIDIA\NVAPP2\NVI2\0406.ui.strings
            • Size 11KB
            • SHA256 c4af84aeba3245587fc8973587a7a59f6290cc2e3df7859578808a555fa84de3
            • MD5 SHA1 SHA512 SSDEEP TLSH

            0407.ui.forms

            • Path C:\NVIDIA\NVAPP2\NVI2\0407.ui.forms
            • Size 6KB
            • SHA256 0157e8e2a58463c0bc84b961e268c1cd6fccda2b79b3fe49b0aaa82a2945b361
            • MD5 SHA1 SHA512 SSDEEP TLSH

            0407.ui.strings

            • Path C:\NVIDIA\NVAPP2\NVI2\0407.ui.strings
            • Size 12KB
            • SHA256 dc7ed7f6eef7cc5026263aa3e72bc42d1583f26a141d268619e9b8dbda3485d0
            • MD5 SHA1 SHA512 SSDEEP TLSH

            0408.ui.forms

            • Path C:\NVIDIA\NVAPP2\NVI2\0408.ui.forms
            • Size 6KB
            • SHA256 8b2f67857667fd22587641594915b44d9d24cadcde09f8da89b46097b40071f1
            • MD5 SHA1 SHA512 SSDEEP TLSH

            0408.ui.strings

            • Path C:\NVIDIA\NVAPP2\NVI2\0408.ui.strings
            • Size 16KB
            • SHA256 6c3da6d85355558a584c79c2efc0c8a0c0687d57b45ad2a267546ecdfd828601
            • MD5 SHA1 SHA512 SSDEEP TLSH

            0409.ui.forms

            • Path C:\NVIDIA\NVAPP2\NVI2\0409.ui.forms
            • Size 5KB
            • SHA256 101bb625e9ee927bd4213dbff5ef02987ff2503fce632ecc137fca9bd20482ea
            • MD5 SHA1 SHA512 SSDEEP TLSH

            0409.ui.strings

            • Path C:\NVIDIA\NVAPP2\NVI2\0409.ui.strings
            • Size 11KB
            • SHA256 e16de6186924233ff114d0622aea5810ad584205d3057a1d517098a7e6ed8426
            • MD5 SHA1 SHA512 SSDEEP TLSH

            040a.ui.forms

            • Path C:\NVIDIA\NVAPP2\NVI2\040a.ui.forms
            • Size 5KB
            • SHA256 5a2afb404213bb542118340bc55dda108894763f83c1c48ea3e15a922a90bb45
            • MD5 SHA1 SHA512 SSDEEP TLSH

            040a.ui.strings

            • Path C:\NVIDIA\NVAPP2\NVI2\040a.ui.strings
            • Size 11KB
            • SHA256 0ba8fae49abb00f1f44af94989104160705b2caf8ab0fa07ae3563ec8febfcdd
            • MD5 SHA1 SHA512 SSDEEP TLSH

            040b.ui.forms

            • Path C:\NVIDIA\NVAPP2\NVI2\040b.ui.forms
            • Size 5KB
            • SHA256 e7a0116df7de34b4b7899c1f50e3260ffbaf7ed96ef446a38a78e3ac18f3cfb7
            • MD5 SHA1 SHA512 SSDEEP TLSH

            040b.ui.strings

            • Path C:\NVIDIA\NVAPP2\NVI2\040b.ui.strings
            • Size 11KB
            • SHA256 fe0fb9983c05afea60bea85e6433ad09eb2dcbf3d7af5da565ac496071c0d65a
            • MD5 SHA1 SHA512 SSDEEP TLSH

            040c.ui.forms

            • Path C:\NVIDIA\NVAPP2\NVI2\040c.ui.forms
            • Size 5KB
            • SHA256 6c47dda221a46b83faf61f4bca02ca745d08fe0a94b9a06d4e9d5246e7af0ce2
            • MD5 SHA1 SHA512 SSDEEP TLSH

            040c.ui.strings

            • Path C:\NVIDIA\NVAPP2\NVI2\040c.ui.strings
            • Size 12KB
            • SHA256 116fac8bb51e379e418a140488e8d1b19b26b0060f1d4efb5c93564cdf072e87
            • MD5 SHA1 SHA512 SSDEEP TLSH

            040d.ui.forms

            • Path C:\NVIDIA\NVAPP2\NVI2\040d.ui.forms
            • Size 5KB
            • SHA256 6d2ba12358e3ffd75a334863147650025eca97b2d2726c2c313eda3b6620a3ca
            • MD5 SHA1 SHA512 SSDEEP TLSH

            040d.ui.strings

            • Path C:\NVIDIA\NVAPP2\NVI2\040d.ui.strings
            • Size 13KB
            • SHA256 c882a267be74c2eaa0cd621113497b27678cea9a7adc725841d97fb73e2195df
            • MD5 SHA1 SHA512 SSDEEP TLSH

            040e.ui.forms

            • Path C:\NVIDIA\NVAPP2\NVI2\040e.ui.forms
            • Size 6KB
            • SHA256 9ddc0b698176711e252691dd58a179ee0e169a99dd9a4bd63b93bc27c49b9a75
            • MD5 SHA1 SHA512 SSDEEP TLSH

            040e.ui.strings

            • Path C:\NVIDIA\NVAPP2\NVI2\040e.ui.strings
            • Size 12KB
            • SHA256 a255ad4717133e7cf794d0040f753b03079e2297308bd1fdc381170e3cf2e5df
            • MD5 SHA1 SHA512 SSDEEP TLSH

            0410.ui.forms

            • Path C:\NVIDIA\NVAPP2\NVI2\0410.ui.forms
            • Size 6KB
            • SHA256 cabe9a8e9cc0421a1b86ab74dd81aa1f4843dd28cfde7be6ddfc8d26b755de40
            • MD5 SHA1 SHA512 SSDEEP TLSH

            0410.ui.strings

            • Path C:\NVIDIA\NVAPP2\NVI2\0410.ui.strings
            • Size 12KB
            • SHA256 62f719e89c03ad5cf7541d87ac2b73a3e48ae3c7c6c2a9464b8df8944d39aba5
            • MD5 SHA1 SHA512 SSDEEP TLSH

            0411.ui.forms

            • Path C:\NVIDIA\NVAPP2\NVI2\0411.ui.forms
            • Size 5KB
            • SHA256 034fe40e0a4b46f60426509cb2ff972150e77da2dcffe8b8fa22d24a2eaf4eba
            • MD5 SHA1 SHA512 SSDEEP TLSH

            0411.ui.strings

            • Path C:\NVIDIA\NVAPP2\NVI2\0411.ui.strings
            • Size 13KB
            • SHA256 34f8de252cfae764de7895b7a80b46d7e462e48dee3f1d2c421e6ff9de85fa4a
            • MD5 SHA1 SHA512 SSDEEP TLSH

            0412.ui.forms

            • Path C:\NVIDIA\NVAPP2\NVI2\0412.ui.forms
            • Size 5KB
            • SHA256 5a7d4b84da04b98a3e49f2f8069a30e6d39a0c6592aba2e2c7484e57653a5153
            • MD5 SHA1 SHA512 SSDEEP TLSH

            0412.ui.strings

            • Path C:\NVIDIA\NVAPP2\NVI2\0412.ui.strings
            • Size 12KB
            • SHA256 e85b9e0fb2c746a9d48481d7b27e619989c5da1697c8780fa16a69e37b4e4985
            • MD5 SHA1 SHA512 SSDEEP TLSH

            0413.ui.forms

            • Path C:\NVIDIA\NVAPP2\NVI2\0413.ui.forms
            • Size 6KB
            • SHA256 2c60c2bec06cbfbaa4704749b84291dda81e517246579ce653100aa2e7ae0793
            • MD5 SHA1 SHA512 SSDEEP TLSH

            0413.ui.strings

            • Path C:\NVIDIA\NVAPP2\NVI2\0413.ui.strings
            • Size 11KB
            • SHA256 6ecab0378311111ab87fb06f162ffb684627c5b107ba4de8aac323cfac9accc8
            • MD5 SHA1 SHA512 SSDEEP TLSH

            0414.ui.forms

            • Path C:\NVIDIA\NVAPP2\NVI2\0414.ui.forms
            • Size 5KB
            • SHA256 909f24f2aaf78275d29b66902a0bfbe0b08a9006c0f4c64630d994ed7ba2ed15
            • MD5 SHA1 SHA512 SSDEEP TLSH

            0414.ui.strings

            • Path C:\NVIDIA\NVAPP2\NVI2\0414.ui.strings
            • Size 11KB
            • SHA256 d41c12a284e3e1c23295cd50cbdae3d8e649fcce91e02a9bb2771dd3dd92c573
            • MD5 SHA1 SHA512 SSDEEP TLSH

            0415.ui.forms

            • Path C:\NVIDIA\NVAPP2\NVI2\0415.ui.forms
            • Size 6KB
            • SHA256 7d64dbef083119bf0a5a8db3d4c1050789dc67a98f4b6f8d1a68cdce1324e272
            • MD5 SHA1 SHA512 SSDEEP TLSH

            0415.ui.strings

            • Path C:\NVIDIA\NVAPP2\NVI2\0415.ui.strings
            • Size 12KB
            • SHA256 17558f0108d817ecc3c8a920ff60645956acd0d2364b5f6010b1f1686b639a29
            • MD5 SHA1 SHA512 SSDEEP TLSH

            0416.ui.forms

            • Path C:\NVIDIA\NVAPP2\NVI2\0416.ui.forms
            • Size 5KB
            • SHA256 869354049867d4ede0a8019dcbd240c5b8606c60366bc878b0837b543822a2f0
            • MD5 SHA1 SHA512 SSDEEP TLSH

            0416.ui.strings

            • Path C:\NVIDIA\NVAPP2\NVI2\0416.ui.strings
            • Size 11KB
            • SHA256 cc82166e845427249a9054209e3df3e2221ae6c9014b07351182cc1064c20e96
            • MD5 SHA1 SHA512 SSDEEP TLSH

            0419.ui.forms

            • Path C:\NVIDIA\NVAPP2\NVI2\0419.ui.forms
            • Size 6KB
            • SHA256 e32183eaa66635fd328773235003ed2073d55274939f572e6c9f7b8f4a57a06d
            • MD5 SHA1 SHA512 SSDEEP TLSH

            041b.ui.forms

            • Path C:\NVIDIA\NVAPP2\NVI2\041b.ui.forms
            • Size 5KB
            • SHA256 504387546bf04619502504c17a01199180c3c063b2d789a3e29925c4040ee41e
            • MD5 SHA1 SHA512 SSDEEP TLSH

            041d.ui.forms

            • Path C:\NVIDIA\NVAPP2\NVI2\041d.ui.forms
            • Size 5KB
            • SHA256 978cab71275bafbad634ff867c08bc2eaeaac094e0a11f24b55a372e0afbc54b
            • MD5 SHA1 SHA512 SSDEEP TLSH

            041e.ui.forms

            • Path C:\NVIDIA\NVAPP2\NVI2\041e.ui.forms
            • Size 5KB
            • SHA256 2ee54ef58814e52ae0a986d6826ce93f94c82c831a4db2b07cf3a9e31fb12eb7
            • MD5 SHA1 SHA512 SSDEEP TLSH

            041f.ui.forms

            • Path C:\NVIDIA\NVAPP2\NVI2\041f.ui.forms
            • Size 5KB
            • SHA256 c226fb75cf60ca698c3b5e2f75671e5b3a2f0f5361ed3aa7c4f785890cdba448
            • MD5 SHA1 SHA512 SSDEEP TLSH

            0422.ui.forms

            • Path C:\NVIDIA\NVAPP2\NVI2\0422.ui.forms
            • Size 6KB
            • SHA256 39b3529676395ceb9f68802ca27278cdfcb5610bb7a7286dd298a054c2a897c0
            • MD5 SHA1 SHA512 SSDEEP TLSH

            0424.ui.forms

            • Path C:\NVIDIA\NVAPP2\NVI2\0424.ui.forms
            • Size 5KB
            • SHA256 3f806d0dfcaadd66765d78e1ff1ec7048eb9025785dca6405e50332a1a9edc54
            • MD5 SHA1 SHA512 SSDEEP TLSH

            0804.ui.forms

            • Path C:\NVIDIA\NVAPP2\NVI2\0804.ui.forms
            • Size 5KB
            • SHA256 1c6054f64907fb4c553c509b905aa6752672df0d8fa549650ed703e73704db7d
            • MD5 SHA1 SHA512 SSDEEP TLSH

            080a.ui.forms

            • Path C:\NVIDIA\NVAPP2\NVI2\080a.ui.forms
            • Size 5KB
            • SHA256 87aa0e0735f4e8676ea19a5c49199555004ecbcef53f7017e77d8bd8db6b61b3
            • MD5 SHA1 SHA512 SSDEEP TLSH

            0816.ui.forms

            • Path C:\NVIDIA\NVAPP2\NVI2\0816.ui.forms
            • Size 5KB
            • SHA256 da1cb94d85ff537b4da1bde35a70f20a073329b5fddd593ee3e160d9c1d2811f
            • MD5 SHA1 SHA512 SSDEEP TLSH

            DynamicBillboardPresentations.cfg

            • Path C:\NVIDIA\NVAPP2\NVI2\DynamicBillboardPresentations.cfg
            • Size 1KB
            • SHA256 ef8f85fa5f18105cb3d5b20bb6f72fda912a74340f4e6dc3302b600a1fb9b3e5
            • MD5 SHA1 SHA512 TLSH

            DynamicBillboardPresentations.dll

            • Path C:\NVIDIA\NVAPP2\NVI2\DynamicBillboardPresentations.dll
            • Size 1.0MB
            • SHA256 987e9ed8b35dba254a8dc00a753fd3fa16e003291f8cee12ca59c776d115a110
            • MD5 SHA1 SHA512 SSDEEP TLSH

            DynamicBillboardPresentations.htm

            • Path C:\NVIDIA\NVAPP2\NVI2\DynamicBillboardPresentations.htm
            • Size 10KB
            • SHA256 0af72677221bad8f8b562908c16466ee2344e60bdda10e99402e5c15f6aab75c
            • MD5 SHA1 SHA512 SSDEEP TLSH

            NVI2.DLL

            • Path C:\NVIDIA\NVAPP2\NVI2\NVI2.DLL
            • Size 6.6MB
            • SHA256 1e9b750e50ab83fae2059dc95d3c0f068f4b1ee9398f82af02ef9af5dc575765
            • MD5 SHA1 SHA512 SSDEEP TLSH

            json2.js

            • Path C:\NVIDIA\NVAPP2\NVI2\json2.js
            • Size 35KB
            • SHA256 74b00e155f94a22614e41286810080636f047f1aab88d0c87b3fb609ce6d7f69
            • MD5 SHA1 SHA512 SSDEEP TLSH

            theme.cfg

            • Path C:\NVIDIA\NVAPP2\NVI2\theme.cfg
            • Size 13KB
            • SHA256 1145bf9e21b232dd046d1b27916ecb4fec12e4a24cc005d78dd2ee7543f31458
            • MD5 SHA1 SHA512 SSDEEP TLSH

            DriverUpdateRecommendation.json

            • Path C:\NVIDIA\NVAPP2\NvApp\CEF\config\DriverUpdateRecommendation.json
            • Size 87B
            • SHA256 b5b12e4b06e3f99b9cd8b1b64fca5b6faf2e35293885198785ec5e22ff7871ac
            • MD5 SHA1 SHA512 TLSH

            EULA.txt

            • Path C:\NVIDIA\NVAPP2\NvApp\EULA.txt
            • Size 22KB
            • SHA256 073e4e717ece44b61e22456d724d33dbd2552640dde8c6902835e3d2f03fef08
            • MD5 SHA1 SHA512 SSDEEP TLSH

            FunctionalConsent_es-MX.txt

            • Path C:\NVIDIA\NVAPP2\NvApp\FunctionalConsent_es-MX.txt
            • Size 898B
            • SHA256 dacea331c07c7b0f48dae9989dca056d6175244ddca273dc148c55b3db953204
            • MD5 SHA1 SHA512 TLSH

            PrivacyPolicy_es-MX.htm

            • Path C:\NVIDIA\NVAPP2\NvApp\PrivacyPolicy\PrivacyPolicy_es-MX.htm
            • Size 164KB
            • SHA256 40dd3e1a0d61c3f60f6f7192e25d3b4429d8031a8d884d7c29ee46d1d794f00b
            • MD5 SHA1 SHA512 SSDEEP TLSH

            NvApp_upgrade_text_080a.txt

            • Path C:\NVIDIA\NVAPP2\NvApp\UpgradeConsent\NvApp_upgrade_text_080a.txt
            • Size 493B
            • SHA256 497c468673bbcf40ae812f48b82d143698879c0bdacb771b3cff6ed9e15f034e
            • MD5 SHA1 SHA512 TLSH

            Marquee_Hero_Image_Gradient.svg

            • Path C:\NVIDIA\NVAPP2\NvApp\www\assets\img\Marquee_Hero_Image_Gradient.svg
            • Size 68KB
            • SHA256 ccf2b77b27e7f5a297f14e2643131686a1f48bc52c1127baa447f3527408466c
            • MD5 SHA1 SHA512 SSDEEP TLSH

            Marquee_Hero_Image_Gradient_RTL.svg

            • Path C:\NVIDIA\NVAPP2\NvApp\www\assets\img\Marquee_Hero_Image_Gradient_RTL.svg
            • Size 68KB
            • SHA256 2c83cfbe96ec803325d6a0ebd62f23ecf44cedf6ecf70e405ecf4152a3f6d1cb
            • MD5 SHA1 SHA512 SSDEEP TLSH

            mobile_marquee_hero_mask_ltr.webp

            • Path C:\NVIDIA\NVAPP2\NvApp\www\assets\img\mobile_marquee_hero_mask_ltr.webp
            • Size 43KB
            • SHA256 69cc5690bdcb4a8cd8e05a44f429899f7a36b098e80e4315d83049f7e17acafe
            • MD5 SHA1 SHA512 SSDEEP TLSH

            mobile_marquee_hero_mask_rtl.webp

            • Path C:\NVIDIA\NVAPP2\NvApp\www\assets\img\mobile_marquee_hero_mask_rtl.webp
            • Size 42KB
            • SHA256 1428f5b98ee6f731d7c915d3eb3a47408a0bd32bb921d7c15e100cc690c3f4e8
            • MD5 SHA1 SHA512 SSDEEP TLSH

            setup.CFG

            • Path C:\NVIDIA\NVAPP2\setup.CFG
            • Size 46KB
            • SHA256 9d4bcf9df40e6fc4aa0fb7d6d64ee9578bd2c65cb5b343b8a1be523afb0b3f32
            • MD5 SHA1 SHA512 SSDEEP TLSH

            setup.exe

            • Path C:\NVIDIA\NVAPP2\setup.exe
            • Size 637KB
            • SHA256 c17f3d77c86883c672a36fb4b099e76818a99e9748ae1c3444f7ef6fac7d1102
            • MD5 SHA1 SHA512 SSDEEP TLSH