Analysis
- max time kernel
299s - max time network
299s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
15/08/2026, 16:07
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
20260813085418.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
300 seconds
Behavioral task
behavioral2
Sample
20260813085418.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
300 seconds
Behavioral task
behavioral3
Sample
INV-No.880C4B7B55A3CAB3D72.doc.lnk
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
300 seconds
Behavioral task
behavioral4
Sample
INV-No.880C4B7B55A3CAB3D72.doc.lnk
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
300 seconds
Behavioral task
behavioral5
Sample
Pdfcore8.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
300 seconds
Behavioral task
behavioral6
Sample
Pdfcore8.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
300 seconds
General
- Target 20260813085418.exe
- Size 1.1MB
- Sample260815-tk1prszbrg
- SHA256 1180c0180e9e175ec90378f68c1cf0eb177beb9b66d202eda966fe8a8ef9d1f6
- MD5 13412cd73870016f6f59125e47e076a9
- SHA1 1060f66f1ab91b99144f45cbe97abca77cd9e2cc
- SHA512 d7431b3214cf3e8f03bfb14e714b11b468d1e3411f4f0f824cc6aa20254c5e3a70dd5a823c24e19c4cd464701103a67cbaa2efc50724e7a024a79be226bda163
- SSDEEP 12288:h0sTavoBAocQGtg7JZ+RyDETRfMjyItHyxPwZAbjvRhgSqq16:qm4JNtg7yFlMjttOwZAbjvRw
- TLSH T130456D8296404D23F852BBB14B4E46398F2E8EE77690FF8258907DCD7A3519E19F2317
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 1132 GFExperience.nvi.EXE 4920 GFExperience.nvi.EXE - Loads dropped DLL 2 IoCs
pid Process 1132 GFExperience.nvi.EXE 4920 GFExperience.nvi.EXE - Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: GFExperience.nvi.EXE File opened (read-only) \??\E: GFExperience.nvi.EXE File opened (read-only) \??\K: GFExperience.nvi.EXE File opened (read-only) \??\O: GFExperience.nvi.EXE File opened (read-only) \??\Q: GFExperience.nvi.EXE File opened (read-only) \??\R: GFExperience.nvi.EXE File opened (read-only) \??\S: GFExperience.nvi.EXE File opened (read-only) \??\X: GFExperience.nvi.EXE File opened (read-only) \??\G: GFExperience.nvi.EXE File opened (read-only) \??\M: GFExperience.nvi.EXE File opened (read-only) \??\N: GFExperience.nvi.EXE File opened (read-only) \??\P: GFExperience.nvi.EXE File opened (read-only) \??\U: GFExperience.nvi.EXE File opened (read-only) \??\V: GFExperience.nvi.EXE File opened (read-only) \??\Z: GFExperience.nvi.EXE File opened (read-only) \??\H: GFExperience.nvi.EXE File opened (read-only) \??\W: GFExperience.nvi.EXE File opened (read-only) \??\Y: GFExperience.nvi.EXE File opened (read-only) \??\I: GFExperience.nvi.EXE File opened (read-only) \??\J: GFExperience.nvi.EXE File opened (read-only) \??\L: GFExperience.nvi.EXE File opened (read-only) \??\T: GFExperience.nvi.EXE - Looks up external IP address via web service 1 TTPs 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 18 api.ipify.org 19 api.ipify.org 35 icanhazip.com 36 icanhazip.com - Discovers running processes 1 TTPs 6 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 1984 tasklist.exe 3568 tasklist.exe 704 tasklist.exe 4840 tasklist.exe 2304 tasklist.exe 4288 tasklist.exe - Executes a command shell one-liner 1 TTPs 5 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3388 cmd.exe 2208 cmd.exe 4712 cmd.exe 4228 cmd.exe 1784 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 29 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GFExperience.nvi.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ComputerDefaults.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20260813085418.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GFExperience.nvi.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Delays execution with timeout.exe 6 IoCs
pid Process 3844 timeout.exe 2236 timeout.exe 2460 timeout.exe 2448 timeout.exe 436 timeout.exe 4904 timeout.exe - Kills process with taskkill 2 IoCs
pid Process 5028 taskkill.exe 4304 taskkill.exe - Modifies registry class 10 IoCs
description ioc Process Key deleted \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\ms-settings\Shell\open 20260813085418.exe Key deleted \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\ms-settings\Shell 20260813085418.exe Key deleted \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\ms-settings 20260813085418.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\ms-settings 20260813085418.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\ms-settings\Shell 20260813085418.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\ms-settings\Shell\open 20260813085418.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/VirtualAudio.Driver.{B0254B5C-31CE-4462-AE3D-0B796F22DDBB}/nvvad.nvi.exe/GFExperience.nvi.EXE" 20260813085418.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\ms-settings\Shell\open\command 20260813085418.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\ms-settings\Shell\open\command\DelegateExecute 20260813085418.exe Key deleted \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\ms-settings\Shell\open\command 20260813085418.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1132 GFExperience.nvi.EXE 1132 GFExperience.nvi.EXE 1132 GFExperience.nvi.EXE 1132 GFExperience.nvi.EXE 1132 GFExperience.nvi.EXE 1132 GFExperience.nvi.EXE 1132 GFExperience.nvi.EXE 1132 GFExperience.nvi.EXE 1132 GFExperience.nvi.EXE 1132 GFExperience.nvi.EXE 1132 GFExperience.nvi.EXE 1132 GFExperience.nvi.EXE 1132 GFExperience.nvi.EXE 1132 GFExperience.nvi.EXE 1132 GFExperience.nvi.EXE 1132 GFExperience.nvi.EXE 1132 GFExperience.nvi.EXE 1132 GFExperience.nvi.EXE 1132 GFExperience.nvi.EXE 1132 GFExperience.nvi.EXE 1132 GFExperience.nvi.EXE 1132 GFExperience.nvi.EXE 1132 GFExperience.nvi.EXE 1132 GFExperience.nvi.EXE 1132 GFExperience.nvi.EXE 1132 GFExperience.nvi.EXE 1132 GFExperience.nvi.EXE 1132 GFExperience.nvi.EXE 1132 GFExperience.nvi.EXE 1132 GFExperience.nvi.EXE 1132 GFExperience.nvi.EXE 1132 GFExperience.nvi.EXE 1132 GFExperience.nvi.EXE 1132 GFExperience.nvi.EXE 1132 GFExperience.nvi.EXE 1132 GFExperience.nvi.EXE 1132 GFExperience.nvi.EXE 1132 GFExperience.nvi.EXE 1132 GFExperience.nvi.EXE 1132 GFExperience.nvi.EXE 1132 GFExperience.nvi.EXE 1132 GFExperience.nvi.EXE 1132 GFExperience.nvi.EXE 1132 GFExperience.nvi.EXE 1132 GFExperience.nvi.EXE 1132 GFExperience.nvi.EXE 1132 GFExperience.nvi.EXE 1132 GFExperience.nvi.EXE 1132 GFExperience.nvi.EXE 1132 GFExperience.nvi.EXE 1132 GFExperience.nvi.EXE 1132 GFExperience.nvi.EXE 1132 GFExperience.nvi.EXE 1132 GFExperience.nvi.EXE 1132 GFExperience.nvi.EXE 1132 GFExperience.nvi.EXE 1132 GFExperience.nvi.EXE 1132 GFExperience.nvi.EXE 1132 GFExperience.nvi.EXE 1132 GFExperience.nvi.EXE 1132 GFExperience.nvi.EXE 1132 GFExperience.nvi.EXE 1132 GFExperience.nvi.EXE 1132 GFExperience.nvi.EXE - Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeDebugPrivilege 5028 taskkill.exe Token: SeDebugPrivilege 1984 tasklist.exe Token: SeDebugPrivilege 1132 GFExperience.nvi.EXE Token: SeLoadDriverPrivilege 1132 GFExperience.nvi.EXE Token: SeTakeOwnershipPrivilege 1132 GFExperience.nvi.EXE Token: SeIncBasePriorityPrivilege 1132 GFExperience.nvi.EXE Token: SeTcbPrivilege 1132 GFExperience.nvi.EXE Token: SeDebugPrivilege 1132 GFExperience.nvi.EXE Token: SeCreateTokenPrivilege 1132 GFExperience.nvi.EXE Token: SeAssignPrimaryTokenPrivilege 1132 GFExperience.nvi.EXE Token: SeLockMemoryPrivilege 1132 GFExperience.nvi.EXE Token: SeIncreaseQuotaPrivilege 1132 GFExperience.nvi.EXE Token: SeMachineAccountPrivilege 1132 GFExperience.nvi.EXE Token: SeTcbPrivilege 1132 GFExperience.nvi.EXE Token: SeSecurityPrivilege 1132 GFExperience.nvi.EXE Token: SeTakeOwnershipPrivilege 1132 GFExperience.nvi.EXE Token: SeLoadDriverPrivilege 1132 GFExperience.nvi.EXE Token: SeSystemProfilePrivilege 1132 GFExperience.nvi.EXE Token: SeSystemtimePrivilege 1132 GFExperience.nvi.EXE Token: SeProfSingleProcessPrivilege 1132 GFExperience.nvi.EXE Token: SeIncBasePriorityPrivilege 1132 GFExperience.nvi.EXE Token: SeCreatePagefilePrivilege 1132 GFExperience.nvi.EXE Token: SeCreatePermanentPrivilege 1132 GFExperience.nvi.EXE Token: SeBackupPrivilege 1132 GFExperience.nvi.EXE Token: SeRestorePrivilege 1132 GFExperience.nvi.EXE Token: SeShutdownPrivilege 1132 GFExperience.nvi.EXE Token: SeDebugPrivilege 1132 GFExperience.nvi.EXE Token: SeAuditPrivilege 1132 GFExperience.nvi.EXE Token: SeSystemEnvironmentPrivilege 1132 GFExperience.nvi.EXE Token: SeChangeNotifyPrivilege 1132 GFExperience.nvi.EXE Token: SeRemoteShutdownPrivilege 1132 GFExperience.nvi.EXE Token: SeUndockPrivilege 1132 GFExperience.nvi.EXE Token: SeSyncAgentPrivilege 1132 GFExperience.nvi.EXE Token: SeEnableDelegationPrivilege 1132 GFExperience.nvi.EXE Token: SeManageVolumePrivilege 1132 GFExperience.nvi.EXE Token: SeImpersonatePrivilege 1132 GFExperience.nvi.EXE Token: SeCreateGlobalPrivilege 1132 GFExperience.nvi.EXE Token: 31 1132 GFExperience.nvi.EXE Token: 32 1132 GFExperience.nvi.EXE Token: 33 1132 GFExperience.nvi.EXE Token: 34 1132 GFExperience.nvi.EXE Token: 35 1132 GFExperience.nvi.EXE Token: SeDebugPrivilege 4304 taskkill.exe Token: SeDebugPrivilege 3568 tasklist.exe Token: SeDebugPrivilege 704 tasklist.exe Token: SeDebugPrivilege 4840 tasklist.exe Token: SeDebugPrivilege 2304 tasklist.exe Token: SeDebugPrivilege 4288 tasklist.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 5108 20260813085418.exe 1132 GFExperience.nvi.EXE 1132 GFExperience.nvi.EXE 4920 GFExperience.nvi.EXE - Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 5108 wrote to memory of 4712 5108 20260813085418.exe 85 PID 4712 wrote to memory of 4560 4712 cmd.exe 87 PID 4560 wrote to memory of 1132 4560 ComputerDefaults.exe 88 PID 1132 wrote to memory of 5028 1132 GFExperience.nvi.EXE 89 PID 1132 wrote to memory of 4228 1132 GFExperience.nvi.EXE 93 PID 4228 wrote to memory of 1784 4228 cmd.exe 95 PID 1784 wrote to memory of 1984 1784 cmd.exe 96 PID 1784 wrote to memory of 2508 1784 cmd.exe 97 PID 1784 wrote to memory of 436 1784 cmd.exe 98 PID 4920 wrote to memory of 4304 4920 GFExperience.nvi.EXE 101 PID 4920 wrote to memory of 3388 4920 GFExperience.nvi.EXE 107 PID 3388 wrote to memory of 2208 3388 cmd.exe 109 PID 2208 wrote to memory of 3568 2208 cmd.exe 110 PID 2208 wrote to memory of 1644 2208 cmd.exe 111 PID 2208 wrote to memory of 4904 2208 cmd.exe 112 PID 2208 wrote to memory of 704 2208 cmd.exe 116 PID 2208 wrote to memory of 3716 2208 cmd.exe 117 PID 2208 wrote to memory of 3844 2208 cmd.exe 118 PID 2208 wrote to memory of 4840 2208 cmd.exe 119 PID 2208 wrote to memory of 4472 2208 cmd.exe 120 PID 2208 wrote to memory of 2236 2208 cmd.exe 121 PID 2208 wrote to memory of 2304 2208 cmd.exe 124 PID 2208 wrote to memory of 1048 2208 cmd.exe 125 PID 2208 wrote to memory of 2460 2208 cmd.exe 126 PID 2208 wrote to memory of 4288 2208 cmd.exe 127 PID 2208 wrote to memory of 4880 2208 cmd.exe 128 PID 2208 wrote to memory of 2448 2208 cmd.exe 129
Processes
-
C:\Users\Admin\AppData\Local\Temp\20260813085418.exe"C:\Users\Admin\AppData\Local\Temp\20260813085418.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Windows\SysWOW64\cmd.exe/c C:\Windows\System32\ComputerDefaults.exe2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Windows\SysWOW64\ComputerDefaults.exeC:\Windows\System32\ComputerDefaults.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\ProgramData\VirtualAudio.Driver.{B0254B5C-31CE-4462-AE3D-0B796F22DDBB}\nvvad.nvi.exe\GFExperience.nvi.EXE"GFExperience.nvi.EXE"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im cmd.exe5⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5028
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start "" /B cmd /C C:\Users\Admin\AppData\Local\Temp\BC2411DEE9DC.CMD5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Windows\SysWOW64\cmd.execmd /C C:\Users\Admin\AppData\Local\Temp\BC2411DEE9DC.CMD6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq GFExperience.nvi.EXE" /FO CSV7⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1984
-
-
C:\Windows\SysWOW64\find.exeFIND /I "GFExperience.nvi.EXE"7⤵
- System Location Discovery: System Language Discovery
PID:2508
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:436
-
-
-
-
-
-
-
C:\ProgramData\VirtualAudio.Driver.{B0254B5C-31CE-4462-AE3D-0B796F22DDBB}\nvvad.nvi.exe\GFExperience.nvi.EXEC:\ProgramData\VirtualAudio.Driver.{B0254B5C-31CE-4462-AE3D-0B796F22DDBB}\nvvad.nvi.exe\GFExperience.nvi.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im cmd.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4304
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start "" /B cmd /C C:\Users\Admin\AppData\Local\Temp\BC2411DEE9DC.CMD2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Windows\SysWOW64\cmd.execmd /C C:\Users\Admin\AppData\Local\Temp\BC2411DEE9DC.CMD3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq GFExperience.nvi.EXE" /FO CSV4⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3568
-
-
C:\Windows\SysWOW64\find.exeFIND /I "GFExperience.nvi.EXE"4⤵
- System Location Discovery: System Language Discovery
PID:1644
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak4⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4904
-
-
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq GFExperience.nvi.EXE" /FO CSV4⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:704
-
-
C:\Windows\SysWOW64\find.exeFIND /I "GFExperience.nvi.EXE"4⤵
- System Location Discovery: System Language Discovery
PID:3716
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak4⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:3844
-
-
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq GFExperience.nvi.EXE" /FO CSV4⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4840
-
-
C:\Windows\SysWOW64\find.exeFIND /I "GFExperience.nvi.EXE"4⤵
- System Location Discovery: System Language Discovery
PID:4472
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak4⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2236
-
-
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq GFExperience.nvi.EXE" /FO CSV4⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2304
-
-
C:\Windows\SysWOW64\find.exeFIND /I "GFExperience.nvi.EXE"4⤵
- System Location Discovery: System Language Discovery
PID:1048
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak4⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2460
-
-
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq GFExperience.nvi.EXE" /FO CSV4⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4288
-
-
C:\Windows\SysWOW64\find.exeFIND /I "GFExperience.nvi.EXE"4⤵
- System Location Discovery: System Language Discovery
PID:4880
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak4⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2448
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\VirtualAudio.Driver.{B0254B5C-31CE-4462-AE3D-0B796F22DDBB}\nvvad.nvi.exe\GFExperience.nvi.EXE
- Size 1.1MB
- SHA256 1180c0180e9e175ec90378f68c1cf0eb177beb9b66d202eda966fe8a8ef9d1f6
- MD5 13412cd73870016f6f59125e47e076a9
- SHA1 1060f66f1ab91b99144f45cbe97abca77cd9e2cc
- SHA512 d7431b3214cf3e8f03bfb14e714b11b468d1e3411f4f0f824cc6aa20254c5e3a70dd5a823c24e19c4cd464701103a67cbaa2efc50724e7a024a79be226bda163
- SSDEEP 12288:h0sTavoBAocQGtg7JZ+RyDETRfMjyItHyxPwZAbjvRhgSqq16:qm4JNtg7yFlMjttOwZAbjvRw
- TLSH T130456D8296404D23F852BBB14B4E46398F2E8EE77690FF8258907DCD7A3519E19F2317
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\VirtualAudio.Driver.{B0254B5C-31CE-4462-AE3D-0B796F22DDBB}\nvvad.nvi.exe\PDFCore8.dll
- Size 5.5MB
- SHA256 cc9dd67664c7aeace554d70bdf08ba06005dc48a32f44245e7a0a4feb7ca4b25
- MD5 14afbe985c622f7252a5e4fce70975d8
- SHA1 5b678160511ca1201fc7e484a02b904acadd8841
- SHA512 334cc223aa2c3663506ddd4fc65bc7f858339a86e1a0b6a9d183c1fd8beb652084bc6659039e71138377fe875c3220da75a03700d0e43ca301ebd6414876f4b7
- SSDEEP 98304:xPGFGY4xkSDQU+7JZGBqBz5qZ1Ia7ZIJYyP26hCF21ZOZ4OiZrq1DfPHNADtV6vd:xPUCCJ5qZ1H7ZuJPGciZ4O7NADtV6v+Y
- TLSH T16046CF113D9C80D6F07A1233CEA9B6ACF26EAD643F7601972680B79DFD327414B1856B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\BC2411DEE9DC.CMD
- Size 1KB
- SHA256 89968e919aee96a998ce1e84ee5d26d610eee7a94cfc0eb3d81e054343f2f5f8
- MD5 2deb5b8a84947dda1518cf9ff229d481
- SHA1 2ee496efbc6b66fb6a5b2a8500ec390410bcce7d
- SHA512 0c6ffa3f3768fdd628802c1fd966385cd9b25bf586b94573433126830ff36a8f1fc6ebe70beb8812593ba365913c5f58e73473549cb23a49782dabb8e88cdfea
- TLSH T1D931FE8FC4174E1C031542DF639BCCAAC654E047ED983190B6A85B842386A9E0DA6BED
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\BC2411DEE9DC.CMD
- Size 1KB
- SHA256 c26c269a568840b85a5c962e23f17d4a65a537bde4d7f2d3a13ffaba22c5beed
- MD5 1777e670dc826ae018b1639f94925f50
- SHA1 6584b722af5b5a1cca1f809812977cf7f0b4302d
- SHA512 a0ec707dc080a85a34452d92f3081efdc96483b79ab0fe76c20feaed2cba034bd42bb91cce240237692f4948adc09bd20701c5905f6bcab70b65c020de3944de
- TLSH T10631FE8EC4574E1D031502EF238ACCAAC654E047EE887190B2DC5B802346A8E0AA6BAD
- MD5 SHA1 SHA512 TLSH