Analysis
- user interaction
yes - max time kernel
439s - max time network
443s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-ja - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-jalocale:ja-jpos:windows11-ltsc_2024-x64systemwindows - submitted
20/08/2026, 00:52
Behavioral task
behavioral1
Sample
B57852BA0-4921278-202608~.zip
Resource
win10v2004-20260513-ja
windows10-2004-x64
18 signatures
600 seconds
Behavioral task
behavioral2
Sample
B57852BA0-4921278-202608~.zip
Resource
win11ltsc2024-20260709-ja
windows11-ltsc_2024-x64
18 signatures
600 seconds
Behavioral task
behavioral3
Sample
hdp.dll
Resource
win10v2004-20260513-ja
windows10-2004-x64
18 signatures
600 seconds
Behavioral task
behavioral4
Sample
hdp.dll
Resource
win11ltsc2024-20260710-ja
windows11-ltsc_2024-x64
18 signatures
600 seconds
Errors
Reason
Machine shutdown
General
- Target B57852BA0-4921278-202608~.zip
- Size 5.1MB
- Sample260820-a75sfszvbz
- SHA256 ab62b50e50d8148e7c894df644e62f365dbe2bd7f7ec0039b7d1af42c555562e
- MD5 06f293dae6f0f070e9815ca35721d46b
- SHA1 b5f28dd7ae4957f8282b104b6657c5804e42e749
- SHA512 b2608e957bb67a01e00ca5361b64138c908ece0b5ba5a73c875b6f0ca22e850311866cd82c8bf39c6ec407f384929d6daaece77b5e48d1d9b4bb4858ea3d8f4f
- SSDEEP 98304:+mF8xHBycYkWcxHVtpEps+xbg8WacppzOFcfwKJxJoPVwAsTXGzykRdM:XF8W5k1ks+xb81OFtKJWVwANzP7M
- TLSH T1EF3633A282D40EF591B606AB2F160D4D7DCE7619B30DA1AD1F932EEEDC433190CD7A58
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: valleyrat
- Windows_Trojan_Winos_464b8a2e 9 IoCs
resource yara_rule behavioral2/memory/4408-9-0x0000000004990000-0x00000000049E8000-memory.dmp Windows_Trojan_Winos_464b8a2e behavioral2/memory/4408-12-0x0000000004990000-0x00000000049E8000-memory.dmp Windows_Trojan_Winos_464b8a2e behavioral2/memory/4408-10-0x0000000004990000-0x00000000049E8000-memory.dmp Windows_Trojan_Winos_464b8a2e behavioral2/memory/4408-14-0x0000000004990000-0x00000000049E8000-memory.dmp Windows_Trojan_Winos_464b8a2e behavioral2/memory/4408-13-0x0000000004990000-0x00000000049E8000-memory.dmp Windows_Trojan_Winos_464b8a2e behavioral2/memory/4408-29-0x0000000004990000-0x00000000049E8000-memory.dmp Windows_Trojan_Winos_464b8a2e behavioral2/memory/4408-44-0x0000000004990000-0x00000000049E8000-memory.dmp Windows_Trojan_Winos_464b8a2e behavioral2/memory/4408-64-0x0000000004990000-0x00000000049E8000-memory.dmp Windows_Trojan_Winos_464b8a2e behavioral2/memory/4408-65-0x0000000004990000-0x00000000049E8000-memory.dmp Windows_Trojan_Winos_464b8a2e - https://www.esentire.com/blog/winos4-0-online-module-staging-component-used-in-cleversoar-campaign 10 IoCs
resource yara_rule behavioral2/files/0x000d00000001c522-2.dat WinosStager behavioral2/memory/4408-9-0x0000000004990000-0x00000000049E8000-memory.dmp WinosStager behavioral2/memory/4408-12-0x0000000004990000-0x00000000049E8000-memory.dmp WinosStager behavioral2/memory/4408-10-0x0000000004990000-0x00000000049E8000-memory.dmp WinosStager behavioral2/memory/4408-14-0x0000000004990000-0x00000000049E8000-memory.dmp WinosStager behavioral2/memory/4408-13-0x0000000004990000-0x00000000049E8000-memory.dmp WinosStager behavioral2/memory/4408-29-0x0000000004990000-0x00000000049E8000-memory.dmp WinosStager behavioral2/memory/4408-44-0x0000000004990000-0x00000000049E8000-memory.dmp WinosStager behavioral2/memory/4408-64-0x0000000004990000-0x00000000049E8000-memory.dmp WinosStager behavioral2/memory/4408-65-0x0000000004990000-0x00000000049E8000-memory.dmp WinosStager - Executes dropped EXE 2 IoCs
pid Process 4408 NvPluginNvapiMonitor.NVX.exe 5112 NvPluginNvapiMonitor.NVX.exe - Loads dropped DLL 1 IoCs
pid Process 4408 NvPluginNvapiMonitor.NVX.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: NvPluginNvapiMonitor.NVX.exe File opened (read-only) \??\T: NvPluginNvapiMonitor.NVX.exe File opened (read-only) \??\U: NvPluginNvapiMonitor.NVX.exe File opened (read-only) \??\Y: NvPluginNvapiMonitor.NVX.exe File opened (read-only) \??\Z: NvPluginNvapiMonitor.NVX.exe File opened (read-only) \??\K: NvPluginNvapiMonitor.NVX.exe File opened (read-only) \??\M: NvPluginNvapiMonitor.NVX.exe File opened (read-only) \??\O: NvPluginNvapiMonitor.NVX.exe File opened (read-only) \??\V: NvPluginNvapiMonitor.NVX.exe File opened (read-only) \??\B: NvPluginNvapiMonitor.NVX.exe File opened (read-only) \??\H: NvPluginNvapiMonitor.NVX.exe File opened (read-only) \??\I: NvPluginNvapiMonitor.NVX.exe File opened (read-only) \??\L: NvPluginNvapiMonitor.NVX.exe File opened (read-only) \??\N: NvPluginNvapiMonitor.NVX.exe File opened (read-only) \??\Q: NvPluginNvapiMonitor.NVX.exe File opened (read-only) \??\S: NvPluginNvapiMonitor.NVX.exe File opened (read-only) \??\W: NvPluginNvapiMonitor.NVX.exe File opened (read-only) \??\G: NvPluginNvapiMonitor.NVX.exe File opened (read-only) \??\P: NvPluginNvapiMonitor.NVX.exe File opened (read-only) \??\R: NvPluginNvapiMonitor.NVX.exe File opened (read-only) \??\X: NvPluginNvapiMonitor.NVX.exe - Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 10 api.ipify.org 24 api.ipify.org - Discovers running processes 1 TTPs 6 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 1300 tasklist.exe 1392 tasklist.exe 1708 tasklist.exe 3004 tasklist.exe 5028 tasklist.exe 4688 tasklist.exe - Executes a command shell one-liner 1 TTPs 3 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5964 cmd.exe 2856 cmd.exe 4944 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 26 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TI.Number-20260819230254.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ComputerDefaults.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NvPluginNvapiMonitor.NVX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NvPluginNvapiMonitor.NVX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe - Delays execution with timeout.exe 6 IoCs
pid Process 1892 timeout.exe 2748 timeout.exe 1460 timeout.exe 4684 timeout.exe 5820 timeout.exe 5396 timeout.exe - Kills process with taskkill 1 IoCs
pid Process 3696 taskkill.exe - Modifies data under HKEY_USERS 4 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe - Modifies registry class 10 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/NvContainer.NvapiMonitor.{7D30E223-D545-48BB-BB48-5F0BEACA2491}/NVPLUGINNVAPIMONITOR.NVX.VBE/NvPluginNvapiMonitor.NVX.exe" TI.Number-20260819230254.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\ms-settings\Shell\open\command\DelegateExecute = "Ā" TI.Number-20260819230254.EXE Key deleted \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\ms-settings\Shell\open\command TI.Number-20260819230254.EXE Key deleted \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\ms-settings\Shell\open TI.Number-20260819230254.EXE Key deleted \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\ms-settings\Shell TI.Number-20260819230254.EXE Key created \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\ms-settings\Shell TI.Number-20260819230254.EXE Key created \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\ms-settings\Shell\open TI.Number-20260819230254.EXE Key deleted \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\ms-settings TI.Number-20260819230254.EXE Key created \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\ms-settings\Shell\open\command TI.Number-20260819230254.EXE Key created \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\ms-settings TI.Number-20260819230254.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4408 NvPluginNvapiMonitor.NVX.exe 4408 NvPluginNvapiMonitor.NVX.exe 4408 NvPluginNvapiMonitor.NVX.exe 4408 NvPluginNvapiMonitor.NVX.exe 4408 NvPluginNvapiMonitor.NVX.exe 4408 NvPluginNvapiMonitor.NVX.exe 4408 NvPluginNvapiMonitor.NVX.exe 4408 NvPluginNvapiMonitor.NVX.exe 4408 NvPluginNvapiMonitor.NVX.exe 4408 NvPluginNvapiMonitor.NVX.exe 4408 NvPluginNvapiMonitor.NVX.exe 4408 NvPluginNvapiMonitor.NVX.exe 4408 NvPluginNvapiMonitor.NVX.exe 4408 NvPluginNvapiMonitor.NVX.exe 4408 NvPluginNvapiMonitor.NVX.exe 4408 NvPluginNvapiMonitor.NVX.exe 4408 NvPluginNvapiMonitor.NVX.exe 4408 NvPluginNvapiMonitor.NVX.exe 4408 NvPluginNvapiMonitor.NVX.exe 4408 NvPluginNvapiMonitor.NVX.exe 4408 NvPluginNvapiMonitor.NVX.exe 4408 NvPluginNvapiMonitor.NVX.exe 4408 NvPluginNvapiMonitor.NVX.exe 4408 NvPluginNvapiMonitor.NVX.exe 4408 NvPluginNvapiMonitor.NVX.exe 4408 NvPluginNvapiMonitor.NVX.exe 4408 NvPluginNvapiMonitor.NVX.exe 4408 NvPluginNvapiMonitor.NVX.exe 4408 NvPluginNvapiMonitor.NVX.exe 4408 NvPluginNvapiMonitor.NVX.exe 4408 NvPluginNvapiMonitor.NVX.exe 4408 NvPluginNvapiMonitor.NVX.exe 4408 NvPluginNvapiMonitor.NVX.exe 4408 NvPluginNvapiMonitor.NVX.exe 4408 NvPluginNvapiMonitor.NVX.exe 4408 NvPluginNvapiMonitor.NVX.exe 4408 NvPluginNvapiMonitor.NVX.exe 4408 NvPluginNvapiMonitor.NVX.exe 4408 NvPluginNvapiMonitor.NVX.exe 4408 NvPluginNvapiMonitor.NVX.exe 4408 NvPluginNvapiMonitor.NVX.exe 4408 NvPluginNvapiMonitor.NVX.exe 4408 NvPluginNvapiMonitor.NVX.exe 4408 NvPluginNvapiMonitor.NVX.exe 4408 NvPluginNvapiMonitor.NVX.exe 4408 NvPluginNvapiMonitor.NVX.exe 4408 NvPluginNvapiMonitor.NVX.exe 4408 NvPluginNvapiMonitor.NVX.exe 4408 NvPluginNvapiMonitor.NVX.exe 4408 NvPluginNvapiMonitor.NVX.exe 4408 NvPluginNvapiMonitor.NVX.exe 4408 NvPluginNvapiMonitor.NVX.exe 4408 NvPluginNvapiMonitor.NVX.exe 4408 NvPluginNvapiMonitor.NVX.exe 4408 NvPluginNvapiMonitor.NVX.exe 4408 NvPluginNvapiMonitor.NVX.exe 4408 NvPluginNvapiMonitor.NVX.exe 4408 NvPluginNvapiMonitor.NVX.exe 4408 NvPluginNvapiMonitor.NVX.exe 4408 NvPluginNvapiMonitor.NVX.exe 4408 NvPluginNvapiMonitor.NVX.exe 4408 NvPluginNvapiMonitor.NVX.exe 4408 NvPluginNvapiMonitor.NVX.exe 4408 NvPluginNvapiMonitor.NVX.exe - Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeDebugPrivilege 4408 NvPluginNvapiMonitor.NVX.exe Token: SeLoadDriverPrivilege 4408 NvPluginNvapiMonitor.NVX.exe Token: SeTakeOwnershipPrivilege 4408 NvPluginNvapiMonitor.NVX.exe Token: SeIncBasePriorityPrivilege 4408 NvPluginNvapiMonitor.NVX.exe Token: SeTcbPrivilege 4408 NvPluginNvapiMonitor.NVX.exe Token: SeDebugPrivilege 3696 taskkill.exe Token: SeDebugPrivilege 1300 tasklist.exe Token: SeDebugPrivilege 4408 NvPluginNvapiMonitor.NVX.exe Token: SeCreateTokenPrivilege 4408 NvPluginNvapiMonitor.NVX.exe Token: SeAssignPrimaryTokenPrivilege 4408 NvPluginNvapiMonitor.NVX.exe Token: SeLockMemoryPrivilege 4408 NvPluginNvapiMonitor.NVX.exe Token: SeIncreaseQuotaPrivilege 4408 NvPluginNvapiMonitor.NVX.exe Token: SeMachineAccountPrivilege 4408 NvPluginNvapiMonitor.NVX.exe Token: SeTcbPrivilege 4408 NvPluginNvapiMonitor.NVX.exe Token: SeSecurityPrivilege 4408 NvPluginNvapiMonitor.NVX.exe Token: SeTakeOwnershipPrivilege 4408 NvPluginNvapiMonitor.NVX.exe Token: SeLoadDriverPrivilege 4408 NvPluginNvapiMonitor.NVX.exe Token: SeSystemProfilePrivilege 4408 NvPluginNvapiMonitor.NVX.exe Token: SeSystemtimePrivilege 4408 NvPluginNvapiMonitor.NVX.exe Token: SeProfSingleProcessPrivilege 4408 NvPluginNvapiMonitor.NVX.exe Token: SeIncBasePriorityPrivilege 4408 NvPluginNvapiMonitor.NVX.exe Token: SeCreatePagefilePrivilege 4408 NvPluginNvapiMonitor.NVX.exe Token: SeCreatePermanentPrivilege 4408 NvPluginNvapiMonitor.NVX.exe Token: SeBackupPrivilege 4408 NvPluginNvapiMonitor.NVX.exe Token: SeRestorePrivilege 4408 NvPluginNvapiMonitor.NVX.exe Token: SeShutdownPrivilege 4408 NvPluginNvapiMonitor.NVX.exe Token: SeDebugPrivilege 4408 NvPluginNvapiMonitor.NVX.exe Token: SeAuditPrivilege 4408 NvPluginNvapiMonitor.NVX.exe Token: SeSystemEnvironmentPrivilege 4408 NvPluginNvapiMonitor.NVX.exe Token: SeChangeNotifyPrivilege 4408 NvPluginNvapiMonitor.NVX.exe Token: SeRemoteShutdownPrivilege 4408 NvPluginNvapiMonitor.NVX.exe Token: SeUndockPrivilege 4408 NvPluginNvapiMonitor.NVX.exe Token: SeSyncAgentPrivilege 4408 NvPluginNvapiMonitor.NVX.exe Token: SeEnableDelegationPrivilege 4408 NvPluginNvapiMonitor.NVX.exe Token: SeManageVolumePrivilege 4408 NvPluginNvapiMonitor.NVX.exe Token: SeImpersonatePrivilege 4408 NvPluginNvapiMonitor.NVX.exe Token: SeCreateGlobalPrivilege 4408 NvPluginNvapiMonitor.NVX.exe Token: 31 4408 NvPluginNvapiMonitor.NVX.exe Token: 32 4408 NvPluginNvapiMonitor.NVX.exe Token: 33 4408 NvPluginNvapiMonitor.NVX.exe Token: 34 4408 NvPluginNvapiMonitor.NVX.exe Token: 35 4408 NvPluginNvapiMonitor.NVX.exe Token: SeDebugPrivilege 1392 tasklist.exe Token: SeDebugPrivilege 1708 tasklist.exe Token: SeDebugPrivilege 3004 tasklist.exe Token: SeDebugPrivilege 5028 tasklist.exe Token: SeDebugPrivilege 4688 tasklist.exe Token: SeShutdownPrivilege 4408 NvPluginNvapiMonitor.NVX.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4408 NvPluginNvapiMonitor.NVX.exe 4192 LogonUI.exe - Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 5044 wrote to memory of 5964 5044 TI.Number-20260819230254.EXE 98 PID 5964 wrote to memory of 1228 5964 cmd.exe 100 PID 4408 wrote to memory of 3696 4408 NvPluginNvapiMonitor.NVX.exe 102 PID 4408 wrote to memory of 2856 4408 NvPluginNvapiMonitor.NVX.exe 105 PID 2856 wrote to memory of 4944 2856 cmd.exe 107 PID 4944 wrote to memory of 1300 4944 cmd.exe 108 PID 4944 wrote to memory of 3284 4944 cmd.exe 109 PID 4944 wrote to memory of 1892 4944 cmd.exe 110 PID 4944 wrote to memory of 1392 4944 cmd.exe 113 PID 4944 wrote to memory of 2900 4944 cmd.exe 114 PID 4944 wrote to memory of 2748 4944 cmd.exe 115 PID 4944 wrote to memory of 1708 4944 cmd.exe 116 PID 4944 wrote to memory of 1616 4944 cmd.exe 117 PID 4944 wrote to memory of 1460 4944 cmd.exe 118 PID 4944 wrote to memory of 3004 4944 cmd.exe 119 PID 4944 wrote to memory of 5568 4944 cmd.exe 120 PID 4944 wrote to memory of 4684 4944 cmd.exe 121 PID 4944 wrote to memory of 5028 4944 cmd.exe 123 PID 4944 wrote to memory of 4868 4944 cmd.exe 124 PID 4944 wrote to memory of 5820 4944 cmd.exe 125 PID 4944 wrote to memory of 4688 4944 cmd.exe 126 PID 4944 wrote to memory of 5984 4944 cmd.exe 127 PID 4944 wrote to memory of 5396 4944 cmd.exe 128
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\B57852BA0-4921278-202608~.zip1⤵PID:4272
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1808
-
\??\D:\TI.Number-20260819230254.EXE"D:\TI.Number-20260819230254.EXE"1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Windows\SysWOW64\cmd.exe/c C:\Windows\System32\ComputerDefaults.exe2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5964 -
C:\Windows\SysWOW64\ComputerDefaults.exeC:\Windows\System32\ComputerDefaults.exe3⤵
- System Location Discovery: System Language Discovery
PID:1228 -
C:\ProgramData\NvContainer.NvapiMonitor.{7D30E223-D545-48BB-BB48-5F0BEACA2491}\NVPLUGINNVAPIMONITOR.NVX.VBE\NvPluginNvapiMonitor.NVX.exe"NvPluginNvapiMonitor.NVX.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im cmd.exe5⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3696
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start "" /B cmd /C C:\ProgramData\S-1-5-21-1738198120-2966725515-3980530802\S-1-5-21-1738198120-2966725515-3980530802.CMD5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\SysWOW64\cmd.execmd /C C:\ProgramData\S-1-5-21-1738198120-2966725515-3980530802\S-1-5-21-1738198120-2966725515-3980530802.CMD6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq NvPluginNvapiMonitor.NVX.exe" /FO CSV7⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1300
-
-
C:\Windows\SysWOW64\find.exeFIND /I "NvPluginNvapiMonitor.NVX.exe"7⤵
- System Location Discovery: System Language Discovery
PID:3284
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1892
-
-
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq NvPluginNvapiMonitor.NVX.exe" /FO CSV7⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1392
-
-
C:\Windows\SysWOW64\find.exeFIND /I "NvPluginNvapiMonitor.NVX.exe"7⤵
- System Location Discovery: System Language Discovery
PID:2900
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2748
-
-
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq NvPluginNvapiMonitor.NVX.exe" /FO CSV7⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1708
-
-
C:\Windows\SysWOW64\find.exeFIND /I "NvPluginNvapiMonitor.NVX.exe"7⤵
- System Location Discovery: System Language Discovery
PID:1616
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1460
-
-
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq NvPluginNvapiMonitor.NVX.exe" /FO CSV7⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3004
-
-
C:\Windows\SysWOW64\find.exeFIND /I "NvPluginNvapiMonitor.NVX.exe"7⤵
- System Location Discovery: System Language Discovery
PID:5568
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4684
-
-
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq NvPluginNvapiMonitor.NVX.exe" /FO CSV7⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5028
-
-
C:\Windows\SysWOW64\find.exeFIND /I "NvPluginNvapiMonitor.NVX.exe"7⤵
- System Location Discovery: System Language Discovery
PID:4868
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:5820
-
-
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq NvPluginNvapiMonitor.NVX.exe" /FO CSV7⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4688
-
-
C:\Windows\SysWOW64\find.exeFIND /I "NvPluginNvapiMonitor.NVX.exe"7⤵
- System Location Discovery: System Language Discovery
PID:5984
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:5396
-
-
-
-
-
-
-
C:\ProgramData\NvContainer.NvapiMonitor.{7D30E223-D545-48BB-BB48-5F0BEACA2491}\NVPLUGINNVAPIMONITOR.NVX.VBE\NvPluginNvapiMonitor.NVX.exeC:\ProgramData\NvContainer.NvapiMonitor.{7D30E223-D545-48BB-BB48-5F0BEACA2491}\NVPLUGINNVAPIMONITOR.NVX.VBE\NvPluginNvapiMonitor.NVX.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5112
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:4780
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa39c6055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4192
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k CameraMonitor1⤵PID:2408
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\NvContainer.NvapiMonitor.{7D30E223-D545-48BB-BB48-5F0BEACA2491}\NVPLUGINNVAPIMONITOR.NVX.VBE\logger\hdp.log
- Size 336B
- SHA256 71dfa953913636b884b005a0902c1addaeee98bed2c332f15a07e80cb7abb028
- MD5 a7b946809d7c8b382be347f1e6527bc7
- SHA1 1ced36ef16eaf616b198371261bac54fe503ed36
- SHA512 4f99c878ad8b92c2db29419bcdf9695f6b68c69ccf5fa1e32a42ca8edb8413f23b0ba145c2669c9700a4959493f8d399db3f381c406216ff9ed662a8739b9547
- TLSH T1CFE02660A2BE6CBB0FF01F4AAD987FDA3646F0023112A689124196D5A45EB479C82A64
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\NvContainer.NvapiMonitor.{7D30E223-D545-48BB-BB48-5F0BEACA2491}\nvpluginnvapimonitor.nvx.vbe\NvPluginNvapiMonitor.NVX.exe
- Size 3.0MB
- SHA256 53a4e54f23228c129e2f3d6f34ac457878e49ed2bb5ac13f05c10a55693d2dd8
- MD5 9033f5bed49269403341abcfbd8244eb
- SHA1 b2c8ddc97ec6894123ceba781ca0311a25472a3d
- SHA512 bef1c4c9fdb148554ccb84320d0164e9f3d4ef27ccb238592a6d56d27b7b901bbcd4540075c5a3302ecb6853ad4d4f827e39de7d75f7c1de6fe7a7ee9030009a
- SSDEEP 98304:16NPHPNYDT1g+8UYEP8deLgOgBnr9HUAi58:16NPHPNYDT1g+bYw8deLsnrtge
- TLSH T1A9E59D22F9019432F8E20077D7FE4BBE492DAA30172894D3D7D518A95AB05E27B3B357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\NvContainer.NvapiMonitor.{7D30E223-D545-48BB-BB48-5F0BEACA2491}\nvpluginnvapimonitor.nvx.vbe\hdp.dLL
- Size 5.8MB
- SHA256 056dd24538084987a5119b4c33b15a43c056a6d1a344b730299971f37e0cc2c6
- MD5 fa21a3fca3eb72a940dbb4237396d522
- SHA1 3602422e9ce411c99b62e1ee704acd7608b9dfe5
- SHA512 33b58f58499092a42b076caf5bc3e9dcd67cb897992fe992e556615249b2df1c55b97d128fbd0517338bb86e2c9b1d01e0feff099a6ca99052dca4b5b913a03c
- SSDEEP 98304:c6CysmjOw4YDZJdbYM6ZahkmUnrSbVHyqbtbZ4OiZrq1DfPHNADtV6v+zM+rwroJ:Bs7wnBP6ZahkmGi1RZ4O7NADtV6v+zZT
- TLSH T13856D0913D5C40A6E05B1231CF6BA2BCF2EE7DB03B75315B1680FA1AFB357414A18A5B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\S-1-5-21-1738198120-2966725515-3980530802\S-1-5-21-1738198120-2966725515-3980530802.CMD
- Size 1KB
- SHA256 1b6da20fc6437c0fa800f8f4b55e1e4b4a87f4b5f8cb92ed9d20d16c94cefe75
- MD5 709dd7b34ea30a90e3a9b273e2b18db9
- SHA1 c5c7c7b071bb080e4508222ba106c2f5d72982cf
- SHA512 2f54dee759f5f8385bbb9dd8d7fbd7c269d04a6566158d4525e1d6b0ee28b8821b6be81c41da9c2f6d598fc5f0c0ae846482aefcb83f1e7cdd9f306ed9f4616c
- TLSH T1503110CEC8170E1C032503DF234ACC6BC690E097EDC531A0F0EC2B952752F99096AAEC
- MD5 SHA1 SHA512 TLSH