Overview

overview

8

Static

static

1

author-nvm.exe

windows10-2004-x64

1

author-nvm.exe

windows11-ltsc_2024-x64

1

elevate.cmd

windows10-2004-x64

3

elevate.cmd

windows11-ltsc_2024-x64

3

elevate.vbs

windows10-2004-x64

5

elevate.vbs

windows11-ltsc_2024-x64

5

install.cmd

windows10-2004-x64

3

install.cmd

windows11-ltsc_2024-x64

3

nvm.exe

windows10-2004-x64

1

nvm.exe

windows11-ltsc_2024-x64

1

run.cmd

windows10-2004-x64

8

run.cmd

windows11-ltsc_2024-x64

8

setuserenv.vbs

windows10-2004-x64

5

setuserenv.vbs

windows11-ltsc_2024-x64

5

unsetuserenv.vbs

windows10-2004-x64

5

unsetuserenv.vbs

windows11-ltsc_2024-x64

5

Sharing

Copy URL Twitter E-mail

General

  • Target
    nvm-noinstall.zip
  • Size 6.0MB
  • Sample260828-akyevs1xgz
  • SHA256 74232ea51c060ecd44ecf2cebee314ed9e3f6da56e1f9484d8d46c4e8bb6ae0e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
execution

Malware Config

Targets

    • Target
      author-nvm.exe
    • Size 8.5MB
    • SHA256 7577d50512288e9e84d45e29873deba74218f2d902db16f7b8cd6afa4559f2a8
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral1behavioral2
    • Target
      elevate.cmd
    • Size 305B
    • SHA256 792d6a485d26b3ae1c926d1d4915e5eaf9a40113afd623212d1a9591e56bb1d5
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral3behavioral4
    • Target
      elevate.vbs
    • Size 335B
    • SHA256 3219b67d6c49d02b832026d13ece959c85d64690326d6b3f10923790c8a5f130
    • MD5 SHA1 SHA512 TLSH
    Score
    5/10
    execution

    • Executes a VBScript file via the Windows Script Host.

      execution
    behavioral5behavioral6
    • Target
      install.cmd
    • Size 724B
    • SHA256 bf99d720a62a7838c0569c5f8a4925ab8c3ace00387ec3ba89129c36704a8f7d
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral7behavioral8
    • Target
      nvm.exe
    • Size 6.7MB
    • SHA256 665b0b033e88098367381e929b71cfc96dc4058a3cb6fef760a0ccc9a883dd13
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral10behavioral9
    • Target
      run.cmd
    • Size 218B
    • SHA256 6e1c759178df7f88c09444bc27889ba19991ba6c0c7d00da5c6faf0695a44561
    • MD5 SHA1 SHA512 TLSH
    Score
    8/10
    execution

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution
    behavioral11behavioral12
    • Target
      setuserenv.vbs
    • Size 384B
    • SHA256 76a89f12d74fe66448499c5ade1f66d0edb991af0bbe6d3e2818353f6a7e6a6f
    • MD5 SHA1 SHA512 TLSH
    Score
    5/10
    execution

    • Executes a VBScript file via the Windows Script Host.

      execution
    behavioral13behavioral14
    • Target
      unsetuserenv.vbs
    • Size 286B
    • SHA256 6f54edd8bab74d5c722ec00ab2f1fadd38ceb1ddca5aed60a400a6dd846eefef
    • MD5 SHA1 SHA512 TLSH
    Score
    5/10
    execution

    • Executes a VBScript file via the Windows Script Host.

      execution
    behavioral15behavioral16

MITRE ATT&CK Enterprise v16

Tasks