Analysis
- max time kernel
149s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 00:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
VATNo.20260809224851.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
VATNo.20260809224851.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
Behavioral task
behavioral3
Sample
pdfcoRE8.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
pdfcoRE8.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target VATNo.20260809224851.exe
- Size 3.5MB
- Sample260810-agla5adb25
- SHA256 b869fbddbda07a9b4e511f533b4b7ac2a161cc88dae0519e0e55347c74db94a8
- MD5 c185dbe4fcb5da174009ada3aa4822c3
- SHA1 e8f1f825d79914fe88e9fd40983661f5ed638800
- SHA512 4fdad99da5cf6d3df2befe6505f844bafae4406f3b4e4c5777e767dd29ab0ec477e34fc73392288fd383b4a6900ecb6e8e933508c1c555a5343e1c46a4789af4
- SSDEEP 98304:7yG4M3dIc4WP1RG/w7VoTwvLIBvnR31C5Tfw/Ix6vFdO7:O4+jTxZV1C5bcIx6v/O7
- TLSH T173F58D20BAC08036D97216314DAA7739A6BDFE301B35A1D752543E783930BD26D396BF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: HDAudio.NVX.EXE File opened (read-only) \??\Q: HDAudio.NVX.EXE File opened (read-only) \??\R: HDAudio.NVX.EXE File opened (read-only) \??\W: HDAudio.NVX.EXE File opened (read-only) \??\Y: HDAudio.NVX.EXE File opened (read-only) \??\Z: HDAudio.NVX.EXE File opened (read-only) \??\O: HDAudio.NVX.EXE File opened (read-only) \??\B: HDAudio.NVX.EXE File opened (read-only) \??\D: HDAudio.NVX.EXE File opened (read-only) \??\H: HDAudio.NVX.EXE File opened (read-only) \??\I: HDAudio.NVX.EXE File opened (read-only) \??\K: HDAudio.NVX.EXE File opened (read-only) \??\S: HDAudio.NVX.EXE File opened (read-only) \??\U: HDAudio.NVX.EXE File opened (read-only) \??\M: HDAudio.NVX.EXE File opened (read-only) \??\N: HDAudio.NVX.EXE File opened (read-only) \??\T: HDAudio.NVX.EXE File opened (read-only) \??\V: HDAudio.NVX.EXE File opened (read-only) \??\X: HDAudio.NVX.EXE File opened (read-only) \??\G: HDAudio.NVX.EXE File opened (read-only) \??\J: HDAudio.NVX.EXE File opened (read-only) \??\L: HDAudio.NVX.EXE - Looks up external IP address via web service 1 TTPs 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 9 icanhazip.com 1 api.ipify.org 1 icanhazip.com - Discovers running processes 1 TTPs 3 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 3904 tasklist.exe 3740 tasklist.exe 4796 tasklist.exe - Executes dropped EXE 2 IoCs
pid Process 5848 HDAudio.NVX.EXE 4456 HDAudio.NVX.EXE - Loads dropped DLL 2 IoCs
pid Process 5848 HDAudio.NVX.EXE 4456 HDAudio.NVX.EXE - Executes a command shell one-liner 1 TTPs 3 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5932 cmd.exe 5920 cmd.exe 2540 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 17 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ComputerDefaults.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HDAudio.NVX.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HDAudio.NVX.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VATNo.20260809224851.exe - Delays execution with timeout.exe 3 IoCs
pid Process 6124 timeout.exe 2716 timeout.exe 5360 timeout.exe - Kills process with taskkill 1 IoCs
pid Process 1012 taskkill.exe - Modifies registry class 10 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\ms-settings\Shell\open\command\DelegateExecute = "Ā" VATNo.20260809224851.exe Key deleted \REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\ms-settings\Shell VATNo.20260809224851.exe Key created \REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\ms-settings\Shell VATNo.20260809224851.exe Key deleted \REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\ms-settings\Shell\open\command VATNo.20260809224851.exe Key deleted \REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\ms-settings\Shell\open VATNo.20260809224851.exe Key deleted \REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\ms-settings VATNo.20260809224851.exe Key created \REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\ms-settings\Shell\open\command VATNo.20260809224851.exe Key created \REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\ms-settings VATNo.20260809224851.exe Key created \REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\ms-settings\Shell\open VATNo.20260809224851.exe Set value (str) \REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/HDAudio.Driver.{C23ECDC0-63D6-4EB8-AF18-77EBD1970EC9}/HDAudio.nvi/HDAudio.NVX.EXE" VATNo.20260809224851.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5848 HDAudio.NVX.EXE 5848 HDAudio.NVX.EXE 5848 HDAudio.NVX.EXE 5848 HDAudio.NVX.EXE 5848 HDAudio.NVX.EXE 5848 HDAudio.NVX.EXE 5848 HDAudio.NVX.EXE 5848 HDAudio.NVX.EXE 5848 HDAudio.NVX.EXE 5848 HDAudio.NVX.EXE 5848 HDAudio.NVX.EXE 5848 HDAudio.NVX.EXE 5848 HDAudio.NVX.EXE 5848 HDAudio.NVX.EXE 5848 HDAudio.NVX.EXE 5848 HDAudio.NVX.EXE 5848 HDAudio.NVX.EXE 5848 HDAudio.NVX.EXE 5848 HDAudio.NVX.EXE 5848 HDAudio.NVX.EXE 5848 HDAudio.NVX.EXE 5848 HDAudio.NVX.EXE 5848 HDAudio.NVX.EXE 5848 HDAudio.NVX.EXE 5848 HDAudio.NVX.EXE 5848 HDAudio.NVX.EXE 5848 HDAudio.NVX.EXE 5848 HDAudio.NVX.EXE 5848 HDAudio.NVX.EXE 5848 HDAudio.NVX.EXE 5848 HDAudio.NVX.EXE 5848 HDAudio.NVX.EXE 5848 HDAudio.NVX.EXE 5848 HDAudio.NVX.EXE 5848 HDAudio.NVX.EXE 5848 HDAudio.NVX.EXE 5848 HDAudio.NVX.EXE 5848 HDAudio.NVX.EXE 5848 HDAudio.NVX.EXE 5848 HDAudio.NVX.EXE 5848 HDAudio.NVX.EXE 5848 HDAudio.NVX.EXE 5848 HDAudio.NVX.EXE 5848 HDAudio.NVX.EXE 5848 HDAudio.NVX.EXE 5848 HDAudio.NVX.EXE 5848 HDAudio.NVX.EXE 5848 HDAudio.NVX.EXE 5848 HDAudio.NVX.EXE 5848 HDAudio.NVX.EXE 5848 HDAudio.NVX.EXE 5848 HDAudio.NVX.EXE 5848 HDAudio.NVX.EXE 5848 HDAudio.NVX.EXE 5848 HDAudio.NVX.EXE 5848 HDAudio.NVX.EXE 5848 HDAudio.NVX.EXE 5848 HDAudio.NVX.EXE 5848 HDAudio.NVX.EXE 5848 HDAudio.NVX.EXE 5848 HDAudio.NVX.EXE 5848 HDAudio.NVX.EXE 5848 HDAudio.NVX.EXE 5848 HDAudio.NVX.EXE - Suspicious use of AdjustPrivilegeToken 44 IoCs
description pid Process Token: SeDebugPrivilege 5848 HDAudio.NVX.EXE Token: SeLoadDriverPrivilege 5848 HDAudio.NVX.EXE Token: SeTakeOwnershipPrivilege 5848 HDAudio.NVX.EXE Token: SeIncBasePriorityPrivilege 5848 HDAudio.NVX.EXE Token: SeTcbPrivilege 5848 HDAudio.NVX.EXE Token: SeDebugPrivilege 1012 taskkill.exe Token: SeDebugPrivilege 3904 tasklist.exe Token: SeDebugPrivilege 5848 HDAudio.NVX.EXE Token: SeCreateTokenPrivilege 5848 HDAudio.NVX.EXE Token: SeAssignPrimaryTokenPrivilege 5848 HDAudio.NVX.EXE Token: SeLockMemoryPrivilege 5848 HDAudio.NVX.EXE Token: SeIncreaseQuotaPrivilege 5848 HDAudio.NVX.EXE Token: SeMachineAccountPrivilege 5848 HDAudio.NVX.EXE Token: SeTcbPrivilege 5848 HDAudio.NVX.EXE Token: SeSecurityPrivilege 5848 HDAudio.NVX.EXE Token: SeTakeOwnershipPrivilege 5848 HDAudio.NVX.EXE Token: SeLoadDriverPrivilege 5848 HDAudio.NVX.EXE Token: SeSystemProfilePrivilege 5848 HDAudio.NVX.EXE Token: SeSystemtimePrivilege 5848 HDAudio.NVX.EXE Token: SeProfSingleProcessPrivilege 5848 HDAudio.NVX.EXE Token: SeIncBasePriorityPrivilege 5848 HDAudio.NVX.EXE Token: SeCreatePagefilePrivilege 5848 HDAudio.NVX.EXE Token: SeCreatePermanentPrivilege 5848 HDAudio.NVX.EXE Token: SeBackupPrivilege 5848 HDAudio.NVX.EXE Token: SeRestorePrivilege 5848 HDAudio.NVX.EXE Token: SeShutdownPrivilege 5848 HDAudio.NVX.EXE Token: SeDebugPrivilege 5848 HDAudio.NVX.EXE Token: SeAuditPrivilege 5848 HDAudio.NVX.EXE Token: SeSystemEnvironmentPrivilege 5848 HDAudio.NVX.EXE Token: SeChangeNotifyPrivilege 5848 HDAudio.NVX.EXE Token: SeRemoteShutdownPrivilege 5848 HDAudio.NVX.EXE Token: SeUndockPrivilege 5848 HDAudio.NVX.EXE Token: SeSyncAgentPrivilege 5848 HDAudio.NVX.EXE Token: SeEnableDelegationPrivilege 5848 HDAudio.NVX.EXE Token: SeManageVolumePrivilege 5848 HDAudio.NVX.EXE Token: SeImpersonatePrivilege 5848 HDAudio.NVX.EXE Token: SeCreateGlobalPrivilege 5848 HDAudio.NVX.EXE Token: 31 5848 HDAudio.NVX.EXE Token: 32 5848 HDAudio.NVX.EXE Token: 33 5848 HDAudio.NVX.EXE Token: 34 5848 HDAudio.NVX.EXE Token: 35 5848 HDAudio.NVX.EXE Token: SeDebugPrivilege 3740 tasklist.exe Token: SeDebugPrivilege 4796 tasklist.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4296 VATNo.20260809224851.exe 5848 HDAudio.NVX.EXE 5848 HDAudio.NVX.EXE 4456 HDAudio.NVX.EXE - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 4296 wrote to memory of 5920 4296 VATNo.20260809224851.exe 89 PID 5920 wrote to memory of 2428 5920 cmd.exe 91 PID 2428 wrote to memory of 5848 2428 ComputerDefaults.exe 92 PID 5848 wrote to memory of 1012 5848 HDAudio.NVX.EXE 93 PID 5848 wrote to memory of 2540 5848 HDAudio.NVX.EXE 96 PID 2540 wrote to memory of 5932 2540 cmd.exe 98 PID 5932 wrote to memory of 3904 5932 cmd.exe 99 PID 5932 wrote to memory of 1368 5932 cmd.exe 100 PID 5932 wrote to memory of 6124 5932 cmd.exe 101 PID 5932 wrote to memory of 3740 5932 cmd.exe 105 PID 5932 wrote to memory of 5256 5932 cmd.exe 106 PID 5932 wrote to memory of 2716 5932 cmd.exe 107 PID 5932 wrote to memory of 4796 5932 cmd.exe 108 PID 5932 wrote to memory of 1584 5932 cmd.exe 109 PID 5932 wrote to memory of 5360 5932 cmd.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\VATNo.20260809224851.exe"C:\Users\Admin\AppData\Local\Temp\VATNo.20260809224851.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Windows\SysWOW64\cmd.exe/c C:\Windows\System32\ComputerDefaults.exe2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5920 -
C:\Windows\SysWOW64\ComputerDefaults.exeC:\Windows\System32\ComputerDefaults.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\ProgramData\HDAudio.Driver.{C23ECDC0-63D6-4EB8-AF18-77EBD1970EC9}\HDAudio.nvi\HDAudio.NVX.EXE"HDAudio.NVX.EXE"4⤵
- Enumerates connected drives
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5848 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im cmd.exe5⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1012
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start "" /B cmd /C C:\Users\Admin\AppData\Local\Temp\BC2411DEE9DC.CMD5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\SysWOW64\cmd.execmd /C C:\Users\Admin\AppData\Local\Temp\BC2411DEE9DC.CMD6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq HDAudio.NVX.EXE" /FO CSV7⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3904
-
-
C:\Windows\SysWOW64\find.exeFIND /I "HDAudio.NVX.EXE"7⤵
- System Location Discovery: System Language Discovery
PID:1368
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:6124
-
-
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq HDAudio.NVX.EXE" /FO CSV7⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3740
-
-
C:\Windows\SysWOW64\find.exeFIND /I "HDAudio.NVX.EXE"7⤵
- System Location Discovery: System Language Discovery
PID:5256
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2716
-
-
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq HDAudio.NVX.EXE" /FO CSV7⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4796
-
-
C:\Windows\SysWOW64\find.exeFIND /I "HDAudio.NVX.EXE"7⤵
- System Location Discovery: System Language Discovery
PID:1584
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:5360
-
-
-
-
-
-
-
C:\ProgramData\HDAudio.Driver.{C23ECDC0-63D6-4EB8-AF18-77EBD1970EC9}\HDAudio.nvi\HDAudio.NVX.EXEC:\ProgramData\HDAudio.Driver.{C23ECDC0-63D6-4EB8-AF18-77EBD1970EC9}\HDAudio.nvi\HDAudio.NVX.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4456
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\HDAudio.Driver.{C23ECDC0-63D6-4EB8-AF18-77EBD1970EC9}\HDAudio.nvi\HDAudio.NVX.EXE
- Size 3.5MB
- SHA256 b869fbddbda07a9b4e511f533b4b7ac2a161cc88dae0519e0e55347c74db94a8
- MD5 c185dbe4fcb5da174009ada3aa4822c3
- SHA1 e8f1f825d79914fe88e9fd40983661f5ed638800
- SHA512 4fdad99da5cf6d3df2befe6505f844bafae4406f3b4e4c5777e767dd29ab0ec477e34fc73392288fd383b4a6900ecb6e8e933508c1c555a5343e1c46a4789af4
- SSDEEP 98304:7yG4M3dIc4WP1RG/w7VoTwvLIBvnR31C5Tfw/Ix6vFdO7:O4+jTxZV1C5bcIx6v/O7
- TLSH T173F58D20BAC08036D97216314DAA7739A6BDFE301B35A1D752543E783930BD26D396BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\HDAudio.Driver.{C23ECDC0-63D6-4EB8-AF18-77EBD1970EC9}\HDAudio.nvi\pdfcORe8.DlL
- Size 5.2MB
- SHA256 6d76680c3319eb999bbbb776437a39b7c6d2c6ab0be776b431e061e6723fd4ca
- MD5 1e8fbc84fd0d89eb6ee50d11042fca9c
- SHA1 1a0c059ccc7da75f9a8a3e33635fb14a1972bcd7
- SHA512 cb4861f435ba1719db84586c8dbcf20c0154620dcdf16b5bba26cf0490716717ba50c915bb4ae592b52f6261ac2458a82051344467e69e6d2c6e681c0a06d803
- SSDEEP 98304:YXQoFQcPfKmSMvuqQLeRktAJXOWzfHXzuWuVgCN//Y/VKtLZ4OiZrq1DfPHNADtV:YEWHXXOWzfHXzuWuV5nY9qZ4O7NADtVb
- TLSH T1CB46D0913D9C006AE25B0133895DE2FCF67EADA01B3604B71144BB1DBBF27436E195AB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\BC2411DEE9DC.CMD
- Size 1KB
- SHA256 571d0b2c89ac7a6f2ed760c434d9a64360e1b618549b10cd0007e2082537fc26
- MD5 29fd8cccde7f624b2f1fb764f600cd62
- SHA1 9d19d9357e93f61cd2fbc12b5e9e84333c521993
- SHA512 91dabc44ddd0f0d5dc006cce7e8923f8e6000e1c53e4935a82cfee33592858cb00faca75d9218e3b5dd3fbaebeebd3d382cc6803f98fbc654bef2ca7958cbc69
- TLSH T15831F48EC4174D0D031401EF329ACCAEC654E047ED843190B19C6BC4238599D1D66BED
- MD5 SHA1 SHA512 TLSH