Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
31/08/2026, 11:24
General
- Target 6c543b1125bca0234f9427830b71968b4d9ba0c442725368c692a691b9b2e317.exe
- Size 2.4MB
- Sample260831-nhzf2a1alg
- SHA256 6c543b1125bca0234f9427830b71968b4d9ba0c442725368c692a691b9b2e317
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 8 IoCs
- Loads dropped DLL 7 IoCs
- Drops file in System32 directory 5 IoCs
- Drops file in Windows directory 7 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 5 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c543b1125bca0234f9427830b71968b4d9ba0c442725368c692a691b9b2e317.exe"C:\Users\Admin\AppData\Local\Temp\6c543b1125bca0234f9427830b71968b4d9ba0c442725368c692a691b9b2e317.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\appcompat\NvBackend.exe"C:\Windows\appcompat\NvBackend.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\appcompat\新建文件夹.exe"C:\Windows\appcompat\新建文件夹.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\downlevel\NvBackend.exe"C:\Windows\SysWOW64\downlevel\NvBackend.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\downlevel\NvBackend.exe"C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=04⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\downlevel\NvBackend.exe"C:\Windows\SysWOW64\downlevel\NvBackend.exe" --b --watch=28445⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"5⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Windows\appcompat\NvBackend.exeC:\Windows\appcompat\NvBackend.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\downlevel\NvBackend.exeC:\Windows\SysWOW64\downlevel\NvBackend.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\downlevel\NvBackend.exe"C:\Windows\SysWOW64\downlevel\NvBackend.exe" --a --watch=02⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -c "Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\downlevel" -Force"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_ujufcoy0.jgm.ps1
detoured.dll
NvBackend.exe
detoured.dll
新建文件夹.exe
memory/2068-96-0x0000000010000000-0x0000000010053000-memory.dmp
memory/2844-81-0x0000000010000000-0x0000000010053000-memory.dmp
memory/2844-61-0x0000000010000000-0x0000000010053000-memory.dmp
memory/2844-65-0x0000000010000000-0x0000000010053000-memory.dmp
memory/2956-52-0x000000006FFF0000-0x0000000070000000-memory.dmp
memory/2956-48-0x0000000010000000-0x0000000010053000-memory.dmp
memory/2956-149-0x0000000075B20000-0x0000000075D35000-memory.dmp
memory/2956-43-0x0000000010000000-0x0000000010053000-memory.dmp
memory/4868-105-0x0000000010000000-0x0000000010053000-memory.dmp
memory/4868-107-0x0000000010000000-0x0000000010053000-memory.dmp
memory/5228-140-0x0000000007280000-0x000000000728E000-memory.dmp
memory/5228-127-0x000000006FB50000-0x000000006FB9C000-memory.dmp
memory/5228-142-0x00000000073A0000-0x00000000073BA000-memory.dmp
memory/5228-139-0x0000000007250000-0x0000000007261000-memory.dmp
memory/5228-143-0x00000000072D0000-0x00000000072D8000-memory.dmp
memory/5228-135-0x0000000007690000-0x0000000007D0A000-memory.dmp
memory/5380-72-0x0000000010000000-0x0000000010053000-memory.dmp
memory/5380-79-0x0000000075B20000-0x0000000075D35000-memory.dmp
memory/6068-98-0x0000000006690000-0x00000000066AE000-memory.dmp
memory/6068-116-0x0000000006C50000-0x0000000006C82000-memory.dmp
memory/6068-126-0x0000000007680000-0x0000000007723000-memory.dmp
memory/6068-117-0x000000006FB50000-0x000000006FB9C000-memory.dmp
memory/6068-125-0x0000000006C30000-0x0000000006C4E000-memory.dmp
memory/6068-136-0x00000000079B0000-0x00000000079CA000-memory.dmp
memory/6068-137-0x0000000007A20000-0x0000000007A2A000-memory.dmp
memory/6068-138-0x0000000007C30000-0x0000000007CC6000-memory.dmp
memory/6068-99-0x00000000066C0000-0x000000000670C000-memory.dmp
memory/6068-90-0x00000000060E0000-0x0000000006434000-memory.dmp
memory/6068-141-0x0000000007BF0000-0x0000000007C04000-memory.dmp
memory/6068-82-0x0000000006070000-0x00000000060D6000-memory.dmp
memory/6068-80-0x0000000006000000-0x0000000006066000-memory.dmp
memory/6068-77-0x00000000057D0000-0x00000000057F2000-memory.dmp
memory/6068-76-0x0000000005860000-0x0000000005E88000-memory.dmp
memory/6068-66-0x00000000050B0000-0x00000000050E6000-memory.dmp