Analysis
- max time kernel
300s - max time network
299s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/08/2026, 16:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
20260821085422.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
300 seconds
Behavioral task
behavioral2
Sample
20260821085422.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
14 signatures
300 seconds
Behavioral task
behavioral3
Sample
INT-Number.A128C1CB446F1705C8B.Doc.lnk
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
300 seconds
Behavioral task
behavioral4
Sample
INT-Number.A128C1CB446F1705C8B.Doc.lnk
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
300 seconds
Behavioral task
behavioral5
Sample
hdp.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
300 seconds
Behavioral task
behavioral6
Sample
hdp.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
300 seconds
General
- Target 20260821085422.exe
- Size 3.0MB
- Sample260823-tybb2as1dy
- SHA256 53a4e54f23228c129e2f3d6f34ac457878e49ed2bb5ac13f05c10a55693d2dd8
- MD5 9033f5bed49269403341abcfbd8244eb
- SHA1 b2c8ddc97ec6894123ceba781ca0311a25472a3d
- SHA512 bef1c4c9fdb148554ccb84320d0164e9f3d4ef27ccb238592a6d56d27b7b901bbcd4540075c5a3302ecb6853ad4d4f827e39de7d75f7c1de6fe7a7ee9030009a
- SSDEEP 98304:16NPHPNYDT1g+8UYEP8deLgOgBnr9HUAi58:16NPHPNYDT1g+bYw8deLsnrtge
- TLSH T1A9E59D22F9019432F8E20077D7FE4BBE492DAA30172894D3D7D518A95AB05E27B3B357
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: NvPluginNvapiMonitor.NVX.exe File opened (read-only) \??\G: NvPluginNvapiMonitor.NVX.exe File opened (read-only) \??\N: NvPluginNvapiMonitor.NVX.exe File opened (read-only) \??\W: NvPluginNvapiMonitor.NVX.exe File opened (read-only) \??\Z: NvPluginNvapiMonitor.NVX.exe File opened (read-only) \??\D: NvPluginNvapiMonitor.NVX.exe File opened (read-only) \??\K: NvPluginNvapiMonitor.NVX.exe File opened (read-only) \??\O: NvPluginNvapiMonitor.NVX.exe File opened (read-only) \??\Y: NvPluginNvapiMonitor.NVX.exe File opened (read-only) \??\H: NvPluginNvapiMonitor.NVX.exe File opened (read-only) \??\J: NvPluginNvapiMonitor.NVX.exe File opened (read-only) \??\M: NvPluginNvapiMonitor.NVX.exe File opened (read-only) \??\P: NvPluginNvapiMonitor.NVX.exe File opened (read-only) \??\Q: NvPluginNvapiMonitor.NVX.exe File opened (read-only) \??\R: NvPluginNvapiMonitor.NVX.exe File opened (read-only) \??\U: NvPluginNvapiMonitor.NVX.exe File opened (read-only) \??\X: NvPluginNvapiMonitor.NVX.exe File opened (read-only) \??\I: NvPluginNvapiMonitor.NVX.exe File opened (read-only) \??\L: NvPluginNvapiMonitor.NVX.exe File opened (read-only) \??\S: NvPluginNvapiMonitor.NVX.exe File opened (read-only) \??\T: NvPluginNvapiMonitor.NVX.exe File opened (read-only) \??\V: NvPluginNvapiMonitor.NVX.exe - Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 11 api.ipify.org 12 api.ipify.org - Discovers running processes 1 TTPs 5 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 1452 tasklist.exe 1308 tasklist.exe 4340 tasklist.exe 4696 tasklist.exe 264 tasklist.exe - Executes dropped EXE 2 IoCs
pid Process 4264 NvPluginNvapiMonitor.NVX.exe 2928 NvPluginNvapiMonitor.NVX.exe - Loads dropped DLL 1 IoCs
pid Process 4264 NvPluginNvapiMonitor.NVX.exe - Executes a command shell one-liner 1 TTPs 3 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2588 cmd.exe 5640 cmd.exe 4312 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20260821085422.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NvPluginNvapiMonitor.NVX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ComputerDefaults.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NvPluginNvapiMonitor.NVX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe - Delays execution with timeout.exe 5 IoCs
pid Process 3056 timeout.exe 4160 timeout.exe 1964 timeout.exe 4896 timeout.exe 1160 timeout.exe - Kills process with taskkill 1 IoCs
pid Process 2400 taskkill.exe - Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\ms-settings\Shell 20260821085422.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\ms-settings\Shell\open 20260821085422.exe Set value (str) \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/NvContainer.NvapiMonitor.{041D9F44-22FE-4FDB-B45B-152DAA10BEBA}/NVPLUGINNVAPIMONITOR.NVX.VBE/NvPluginNvapiMonitor.NVX.exe" 20260821085422.exe Set value (str) \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\ms-settings\Shell\open\command\DelegateExecute = "Ā" 20260821085422.exe Key deleted \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\ms-settings\Shell\open\command 20260821085422.exe Key deleted \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\ms-settings\Shell 20260821085422.exe Key deleted \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\ms-settings 20260821085422.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\ms-settings\Shell\open\command 20260821085422.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\ms-settings 20260821085422.exe Key deleted \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\ms-settings\Shell\open 20260821085422.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4264 NvPluginNvapiMonitor.NVX.exe 4264 NvPluginNvapiMonitor.NVX.exe 4264 NvPluginNvapiMonitor.NVX.exe 4264 NvPluginNvapiMonitor.NVX.exe 4264 NvPluginNvapiMonitor.NVX.exe 4264 NvPluginNvapiMonitor.NVX.exe 4264 NvPluginNvapiMonitor.NVX.exe 4264 NvPluginNvapiMonitor.NVX.exe 4264 NvPluginNvapiMonitor.NVX.exe 4264 NvPluginNvapiMonitor.NVX.exe 4264 NvPluginNvapiMonitor.NVX.exe 4264 NvPluginNvapiMonitor.NVX.exe 4264 NvPluginNvapiMonitor.NVX.exe 4264 NvPluginNvapiMonitor.NVX.exe 4264 NvPluginNvapiMonitor.NVX.exe 4264 NvPluginNvapiMonitor.NVX.exe 4264 NvPluginNvapiMonitor.NVX.exe 4264 NvPluginNvapiMonitor.NVX.exe 4264 NvPluginNvapiMonitor.NVX.exe 4264 NvPluginNvapiMonitor.NVX.exe 4264 NvPluginNvapiMonitor.NVX.exe 4264 NvPluginNvapiMonitor.NVX.exe 4264 NvPluginNvapiMonitor.NVX.exe 4264 NvPluginNvapiMonitor.NVX.exe 4264 NvPluginNvapiMonitor.NVX.exe 4264 NvPluginNvapiMonitor.NVX.exe 4264 NvPluginNvapiMonitor.NVX.exe 4264 NvPluginNvapiMonitor.NVX.exe 4264 NvPluginNvapiMonitor.NVX.exe 4264 NvPluginNvapiMonitor.NVX.exe 4264 NvPluginNvapiMonitor.NVX.exe 4264 NvPluginNvapiMonitor.NVX.exe 4264 NvPluginNvapiMonitor.NVX.exe 4264 NvPluginNvapiMonitor.NVX.exe 4264 NvPluginNvapiMonitor.NVX.exe 4264 NvPluginNvapiMonitor.NVX.exe 4264 NvPluginNvapiMonitor.NVX.exe 4264 NvPluginNvapiMonitor.NVX.exe 4264 NvPluginNvapiMonitor.NVX.exe 4264 NvPluginNvapiMonitor.NVX.exe 4264 NvPluginNvapiMonitor.NVX.exe 4264 NvPluginNvapiMonitor.NVX.exe 4264 NvPluginNvapiMonitor.NVX.exe 4264 NvPluginNvapiMonitor.NVX.exe 4264 NvPluginNvapiMonitor.NVX.exe 4264 NvPluginNvapiMonitor.NVX.exe 4264 NvPluginNvapiMonitor.NVX.exe 4264 NvPluginNvapiMonitor.NVX.exe 4264 NvPluginNvapiMonitor.NVX.exe 4264 NvPluginNvapiMonitor.NVX.exe 4264 NvPluginNvapiMonitor.NVX.exe 4264 NvPluginNvapiMonitor.NVX.exe 4264 NvPluginNvapiMonitor.NVX.exe 4264 NvPluginNvapiMonitor.NVX.exe 4264 NvPluginNvapiMonitor.NVX.exe 4264 NvPluginNvapiMonitor.NVX.exe 4264 NvPluginNvapiMonitor.NVX.exe 4264 NvPluginNvapiMonitor.NVX.exe 4264 NvPluginNvapiMonitor.NVX.exe 4264 NvPluginNvapiMonitor.NVX.exe 4264 NvPluginNvapiMonitor.NVX.exe 4264 NvPluginNvapiMonitor.NVX.exe 4264 NvPluginNvapiMonitor.NVX.exe 4264 NvPluginNvapiMonitor.NVX.exe - Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 4264 NvPluginNvapiMonitor.NVX.exe Token: SeLoadDriverPrivilege 4264 NvPluginNvapiMonitor.NVX.exe Token: SeTakeOwnershipPrivilege 4264 NvPluginNvapiMonitor.NVX.exe Token: SeIncBasePriorityPrivilege 4264 NvPluginNvapiMonitor.NVX.exe Token: SeTcbPrivilege 4264 NvPluginNvapiMonitor.NVX.exe Token: SeDebugPrivilege 2400 taskkill.exe Token: SeDebugPrivilege 4264 NvPluginNvapiMonitor.NVX.exe Token: SeCreateTokenPrivilege 4264 NvPluginNvapiMonitor.NVX.exe Token: SeAssignPrimaryTokenPrivilege 4264 NvPluginNvapiMonitor.NVX.exe Token: SeLockMemoryPrivilege 4264 NvPluginNvapiMonitor.NVX.exe Token: SeIncreaseQuotaPrivilege 4264 NvPluginNvapiMonitor.NVX.exe Token: SeMachineAccountPrivilege 4264 NvPluginNvapiMonitor.NVX.exe Token: SeTcbPrivilege 4264 NvPluginNvapiMonitor.NVX.exe Token: SeSecurityPrivilege 4264 NvPluginNvapiMonitor.NVX.exe Token: SeTakeOwnershipPrivilege 4264 NvPluginNvapiMonitor.NVX.exe Token: SeLoadDriverPrivilege 4264 NvPluginNvapiMonitor.NVX.exe Token: SeSystemProfilePrivilege 4264 NvPluginNvapiMonitor.NVX.exe Token: SeSystemtimePrivilege 4264 NvPluginNvapiMonitor.NVX.exe Token: SeProfSingleProcessPrivilege 4264 NvPluginNvapiMonitor.NVX.exe Token: SeIncBasePriorityPrivilege 4264 NvPluginNvapiMonitor.NVX.exe Token: SeCreatePagefilePrivilege 4264 NvPluginNvapiMonitor.NVX.exe Token: SeCreatePermanentPrivilege 4264 NvPluginNvapiMonitor.NVX.exe Token: SeBackupPrivilege 4264 NvPluginNvapiMonitor.NVX.exe Token: SeRestorePrivilege 4264 NvPluginNvapiMonitor.NVX.exe Token: SeShutdownPrivilege 4264 NvPluginNvapiMonitor.NVX.exe Token: SeDebugPrivilege 4264 NvPluginNvapiMonitor.NVX.exe Token: SeAuditPrivilege 4264 NvPluginNvapiMonitor.NVX.exe Token: SeSystemEnvironmentPrivilege 4264 NvPluginNvapiMonitor.NVX.exe Token: SeChangeNotifyPrivilege 4264 NvPluginNvapiMonitor.NVX.exe Token: SeRemoteShutdownPrivilege 4264 NvPluginNvapiMonitor.NVX.exe Token: SeUndockPrivilege 4264 NvPluginNvapiMonitor.NVX.exe Token: SeSyncAgentPrivilege 4264 NvPluginNvapiMonitor.NVX.exe Token: SeEnableDelegationPrivilege 4264 NvPluginNvapiMonitor.NVX.exe Token: SeManageVolumePrivilege 4264 NvPluginNvapiMonitor.NVX.exe Token: SeImpersonatePrivilege 4264 NvPluginNvapiMonitor.NVX.exe Token: SeCreateGlobalPrivilege 4264 NvPluginNvapiMonitor.NVX.exe Token: 31 4264 NvPluginNvapiMonitor.NVX.exe Token: 32 4264 NvPluginNvapiMonitor.NVX.exe Token: 33 4264 NvPluginNvapiMonitor.NVX.exe Token: 34 4264 NvPluginNvapiMonitor.NVX.exe Token: 35 4264 NvPluginNvapiMonitor.NVX.exe Token: SeDebugPrivilege 1452 tasklist.exe Token: SeDebugPrivilege 1308 tasklist.exe Token: SeDebugPrivilege 4340 tasklist.exe Token: SeDebugPrivilege 4696 tasklist.exe Token: SeDebugPrivilege 264 tasklist.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4264 NvPluginNvapiMonitor.NVX.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2192 wrote to memory of 2588 2192 20260821085422.exe 90 PID 2588 wrote to memory of 424 2588 cmd.exe 92 PID 424 wrote to memory of 4264 424 ComputerDefaults.exe 93 PID 4264 wrote to memory of 2400 4264 NvPluginNvapiMonitor.NVX.exe 94 PID 4264 wrote to memory of 5640 4264 NvPluginNvapiMonitor.NVX.exe 96 PID 5640 wrote to memory of 4312 5640 cmd.exe 98 PID 4312 wrote to memory of 1452 4312 cmd.exe 99 PID 4312 wrote to memory of 3448 4312 cmd.exe 100 PID 4312 wrote to memory of 1160 4312 cmd.exe 101 PID 4312 wrote to memory of 1308 4312 cmd.exe 105 PID 4312 wrote to memory of 4428 4312 cmd.exe 106 PID 4312 wrote to memory of 3056 4312 cmd.exe 107 PID 4312 wrote to memory of 4340 4312 cmd.exe 108 PID 4312 wrote to memory of 3120 4312 cmd.exe 109 PID 4312 wrote to memory of 4160 4312 cmd.exe 110 PID 4312 wrote to memory of 4696 4312 cmd.exe 111 PID 4312 wrote to memory of 3032 4312 cmd.exe 112 PID 4312 wrote to memory of 1964 4312 cmd.exe 113 PID 4312 wrote to memory of 264 4312 cmd.exe 114 PID 4312 wrote to memory of 1088 4312 cmd.exe 115 PID 4312 wrote to memory of 4896 4312 cmd.exe 116
Processes
-
C:\Users\Admin\AppData\Local\Temp\20260821085422.exe"C:\Users\Admin\AppData\Local\Temp\20260821085422.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Windows\SysWOW64\cmd.exe/c C:\Windows\System32\ComputerDefaults.exe2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Windows\SysWOW64\ComputerDefaults.exeC:\Windows\System32\ComputerDefaults.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:424 -
C:\ProgramData\NvContainer.NvapiMonitor.{041D9F44-22FE-4FDB-B45B-152DAA10BEBA}\NVPLUGINNVAPIMONITOR.NVX.VBE\NvPluginNvapiMonitor.NVX.exe"NvPluginNvapiMonitor.NVX.exe"4⤵
- Enumerates connected drives
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im cmd.exe5⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2400
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start "" /B cmd /C C:\ProgramData\S-1-5-21-2246396966-3025826688-3847171515\S-1-5-21-2246396966-3025826688-3847171515.CMD5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\Windows\SysWOW64\cmd.execmd /C C:\ProgramData\S-1-5-21-2246396966-3025826688-3847171515\S-1-5-21-2246396966-3025826688-3847171515.CMD6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq NvPluginNvapiMonitor.NVX.exe" /FO CSV7⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1452
-
-
C:\Windows\SysWOW64\find.exeFIND /I "NvPluginNvapiMonitor.NVX.exe"7⤵
- System Location Discovery: System Language Discovery
PID:3448
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1160
-
-
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq NvPluginNvapiMonitor.NVX.exe" /FO CSV7⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1308
-
-
C:\Windows\SysWOW64\find.exeFIND /I "NvPluginNvapiMonitor.NVX.exe"7⤵
- System Location Discovery: System Language Discovery
PID:4428
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:3056
-
-
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq NvPluginNvapiMonitor.NVX.exe" /FO CSV7⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4340
-
-
C:\Windows\SysWOW64\find.exeFIND /I "NvPluginNvapiMonitor.NVX.exe"7⤵
- System Location Discovery: System Language Discovery
PID:3120
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4160
-
-
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq NvPluginNvapiMonitor.NVX.exe" /FO CSV7⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4696
-
-
C:\Windows\SysWOW64\find.exeFIND /I "NvPluginNvapiMonitor.NVX.exe"7⤵
- System Location Discovery: System Language Discovery
PID:3032
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1964
-
-
C:\Windows\SysWOW64\tasklist.exeTASKLIST /FI "IMAGENAME eq NvPluginNvapiMonitor.NVX.exe" /FO CSV7⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:264
-
-
C:\Windows\SysWOW64\find.exeFIND /I "NvPluginNvapiMonitor.NVX.exe"7⤵
- System Location Discovery: System Language Discovery
PID:1088
-
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT /t 60 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4896
-
-
-
-
-
-
-
C:\ProgramData\NvContainer.NvapiMonitor.{041D9F44-22FE-4FDB-B45B-152DAA10BEBA}\NVPLUGINNVAPIMONITOR.NVX.VBE\NvPluginNvapiMonitor.NVX.exeC:\ProgramData\NvContainer.NvapiMonitor.{041D9F44-22FE-4FDB-B45B-152DAA10BEBA}\NVPLUGINNVAPIMONITOR.NVX.VBE\NvPluginNvapiMonitor.NVX.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2928
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\NvContainer.NvapiMonitor.{041D9F44-22FE-4FDB-B45B-152DAA10BEBA}\NVPLUGINNVAPIMONITOR.NVX.VBE\logger\hdp.log
- Size 336B
- SHA256 082e64bbf16ca8b98edab78a8d98ed614d8baeb3781d7141872d9a2226b2a9f3
- MD5 00dc8cd3a4c2fbfa530b50a9acbe13a1
- SHA1 90ccb4bf77a72af4b974204522aa76a24a5ce107
- SHA512 96dcd65cece897a1e09c2091152b72ea6a521edb4072097436f5e2d6f6e9b2bdca1206b056f5fc8d58e2bbf2242a21ace6b3b341312bd04ce2e2b3f2827dfbe7
- TLSH T1EFE07D90F0FF197F8EF01C4E695A2FCE3686701101A263A506269235F84EFD70C02BAD
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\NvContainer.NvapiMonitor.{041D9F44-22FE-4FDB-B45B-152DAA10BEBA}\nvpluginnvapimonitor.nvx.vbe\NvPluginNvapiMonitor.NVX.exe
- Size 3.0MB
- SHA256 53a4e54f23228c129e2f3d6f34ac457878e49ed2bb5ac13f05c10a55693d2dd8
- MD5 9033f5bed49269403341abcfbd8244eb
- SHA1 b2c8ddc97ec6894123ceba781ca0311a25472a3d
- SHA512 bef1c4c9fdb148554ccb84320d0164e9f3d4ef27ccb238592a6d56d27b7b901bbcd4540075c5a3302ecb6853ad4d4f827e39de7d75f7c1de6fe7a7ee9030009a
- SSDEEP 98304:16NPHPNYDT1g+8UYEP8deLgOgBnr9HUAi58:16NPHPNYDT1g+bYw8deLsnrtge
- TLSH T1A9E59D22F9019432F8E20077D7FE4BBE492DAA30172894D3D7D518A95AB05E27B3B357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\NvContainer.NvapiMonitor.{041D9F44-22FE-4FDB-B45B-152DAA10BEBA}\nvpluginnvapimonitor.nvx.vbe\hdp.dLL
- Size 5.8MB
- SHA256 d93b8f420b4f7b912db5e45d6c19f900896a80027d16efce5023764ef6a49396
- MD5 52b5616e792f500a0f6ca2c005d79fc9
- SHA1 c075d8976cb752c9cafdeddcb880c2e6a2342bcd
- SHA512 7203c0315978b091e68efa83f4f229e0294d44b14427baea37b1735a7994af05a45c891ca348831e4b61d89282827e4a5e391b05ba135713d3e42f0baf818078
- SSDEEP 98304:c6CysmjOw4YDZJdbYM6ZahkmwnrSbVHyqbtbZ4OiZrq1DfPHNADtV6v+zM+rwroJ:Bs7wnBP6Zahkm6i1RZ4O7NADtV6v+zZT
- TLSH T15656D0913D5C40A6E05B1231CF6BA2BCF2EE7DB03B75315B1680FA1AFB357414A18A5B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\S-1-5-21-2246396966-3025826688-3847171515\S-1-5-21-2246396966-3025826688-3847171515.CMD
- Size 1KB
- SHA256 02165d9184e1d257752a8b3a2aa9347b8d1785c5e8a91562c163dc74dd008178
- MD5 2638675c25bcabe9602d564d88dbc9a5
- SHA1 55c2baada6810d86082fe71dbef5f88308b2eda4
- SHA512 8ca26bb2d0ad6523fec6aa82c153068fc73ec04eac2f1b19dbe6f36ad1c5efa8342b371c53cb2937e067819b0273d4d8f8d3c84d8678dc96c56eb3dbd1f4d72a
- TLSH T12831109EC4178E0E436512EF134ACC5BD340E4ABEDC430A0F1DD1B861386F9909AABED
- MD5 SHA1 SHA512 TLSH