Edit tour

Windows Analysis Report
NVDisplay.Container.exe

Overview

General Information

Sample name:	NVDisplay.Container.exe
Analysis ID:	1490155
MD5:	25a35dd1848a060d8ae2e2e0124d132d
SHA1:	372194560fa6897313881d74c12f231639c3d1c8
SHA256:	99824d9ba21635461f054a515afa6ea1a6aace55b8902f304c2cfd6aad38b880

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

PE file contains sections with non-standard names

Program does not show much activity (idle)

Sample file is different than original file name gathered from version info

Classification

Process Tree

System is w10x64

NVDisplay.Container.exe (PID: 6680 cmdline: "C:\Users\user\Desktop\NVDisplay.Container.exe" MD5: 25A35DD1848A060D8AE2E2E0124D132D)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: NVDisplay.Container.exe

Static PE information: certificate valid

Source: NVDisplay.Container.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\dvs\p4\build\sw\gcomp\dev\src\NvContainer\_out\x86_64\release\container\NvContainer.pdb source: NVDisplay.Container.exe
Source:	Binary string: V:VC:\dvs\p4\build\sw\gcomp\dev\src\NvContainer\_out\x86_64\release\container\NvContainer.pdb" source: NVDisplay.Container.exe

Source: NVDisplay.Container.exe	String found in binary or memory: http://aia.entrust.net/ts1-chain256.cer01
Source: NVDisplay.Container.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: NVDisplay.Container.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: NVDisplay.Container.exe	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: NVDisplay.Container.exe	String found in binary or memory: http://crl.entrust.net/ts1ca.crl0
Source: NVDisplay.Container.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: NVDisplay.Container.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: NVDisplay.Container.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: NVDisplay.Container.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: NVDisplay.Container.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: NVDisplay.Container.exe	String found in binary or memory: http://ocsp.entrust.net02
Source: NVDisplay.Container.exe	String found in binary or memory: http://ocsp.entrust.net03
Source: NVDisplay.Container.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: NVDisplay.Container.exe	String found in binary or memory: http://www.entrust.net/rpa03
Source: NVDisplay.Container.exe	String found in binary or memory: https://www.entrust.net/rpa0

Source: NVDisplay.Container.exe, 00000000.00000000.2021051270.00007FF7FBFB9000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameNvContainer.exeB vs NVDisplay.Container.exe
Source: NVDisplay.Container.exe	Binary or memory string: OriginalFilenameNvContainer.exeB vs NVDisplay.Container.exe

Source: classification engine

Classification label: clean1.winEXE@1/0@0/0

Source: NVDisplay.Container.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\NVDisplay.Container.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: NVDisplay.Container.exe	String found in binary or memory: -d/d--directoryload plugins from the specified directory-s/s--servicerun container process as service with the provided name-f/f--logfileoutput traces to the specified log file-l/l--loglevelset logging level to the provided value-t/t--testtimespecify test duration in ms-c/c--childstart container as child-a/a--autoconfigure service container in auto-start mode-m/m--safemodestart container in safe mode (recovery mode)-r/r--recursiverecursively traverse the plugin folder and load plugins from subfolders-p/p--checkperiodspecify self-check period in ms-h/h--helpprint usage help message-b/b--blocklogoffblock user logoff requests-st/st--sendtelemetrysends telemetry using specified container telemetry helper DLL-cfg/cfg--configurationFetches configuration settings based on given identifier%uNvContainer - generic NV host process.
Source: NVDisplay.Container.exe	String found in binary or memory: -d/d--directoryload plugins from the specified directory-s/s--servicerun container process as service with the provided name-f/f--logfileoutput traces to the specified log file-l/l--loglevelset logging level to the provided value-t/t--testtimespecify test duration in ms-c/c--childstart container as child-a/a--autoconfigure service container in auto-start mode-m/m--safemodestart container in safe mode (recovery mode)-r/r--recursiverecursively traverse the plugin folder and load plugins from subfolders-p/p--checkperiodspecify self-check period in ms-h/h--helpprint usage help message-b/b--blocklogoffblock user logoff requests-st/st--sendtelemetrysends telemetry using specified container telemetry helper DLL-cfg/cfg--configurationFetches configuration settings based on given identifier%uNvContainer - generic NV host process.
Source: NVDisplay.Container.exe	String found in binary or memory: -d/d--directoryload plugins from the specified directory-s/s--servicerun container process as service with the provided name-f/f--logfileoutput traces to the specified log file-l/l--loglevelset logging level to the provided value-t/t--testtimespecify test duration in ms-c/c--childstart container as child-a/a--autoconfigure service container in auto-start mode-m/m--safemodestart container in safe mode (recovery mode)-r/r--recursiverecursively traverse the plugin folder and load plugins from subfolders-p/p--checkperiodspecify self-check period in ms-h/h--helpprint usage help message-b/b--blocklogoffblock user logoff requests-st/st--sendtelemetrysends telemetry using specified container telemetry helper DLL-cfg/cfg--configurationFetches configuration settings based on given identifier%uNvContainer - generic NV host process.
Source: NVDisplay.Container.exe	String found in binary or memory: Failed to save auto-start flag %ls to registry for service %ls. Error %ld
Source: NVDisplay.Container.exe	String found in binary or memory: Changed service %ls start type to auto-start
Source: NVDisplay.Container.exe	String found in binary or memory: Failed to change service to auto-start for %ls. Error %u
Source: NVDisplay.Container.exe	String found in binary or memory: Service hostC:\dvs\p4\build\sw\gcomp\dev\src\NvContainer\container\windows\NvcServiceHost.cppService host: failed to create ServiceThread. Error %uService host: wait completed with %uService host failedWaiting for ServiceConfigThread to finishServiceConfigThread finishedFailed to determine SID size. Error %uFailed to allocate memory - %uFailed to create users SID. Error %uFailed to lookup SID. Error %uFailed to create new DACL. Error %uCreated new DACL with added privileges 0x%08lXOpenProcess failed for %u. Error %uOpenProcessToken failed for %u. Error %uFailed to get security info for %u. Error %uSuccessfully adjusted DACL for process %uFailed to update security info for %u. Error %uRecoverySafe mode is ON. Optional plugins will not be loadedServiceAutoStartFailed to save auto-start flag %ls to registry for service %ls. Error %ldService host: failed to register service %ls. Error %uFailed to open SCM. Error %uFailed to open service %ls. Error %uFailed to query service configuration for %ls. Error %uLeaving service %ls start type %u unchangedChanged service %ls start type to auto-startFailed to change service to auto-start for %ls. Error %uServiceConfigThread: Quit event signaledServiceConfigThread: Timeout occurredServiceConfigThread: unknown wait conditionService host:Service host: service registration failedService host: failed to create ServiceConfigThread. Error %uService host: Created ServiceConfigThreadQuit received by window proc for message code: %d. IgnoredService host: quit enabledService host: quit disabledService host control: %u, %u, %pStart-pendingStop-pendingRunningContinue-pendingPause-pendingPausedService host: failed to report '%s' status. Error %uService host: '%s' status reported. Exit code %u

Source: C:\Users\user\Desktop\NVDisplay.Container.exe

Section loaded: kernel.appcore.dll

Jump to behavior

Source: NVDisplay.Container.exe

Static PE information: certificate valid

Source: NVDisplay.Container.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: NVDisplay.Container.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: NVDisplay.Container.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: NVDisplay.Container.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: NVDisplay.Container.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: NVDisplay.Container.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: NVDisplay.Container.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: NVDisplay.Container.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: NVDisplay.Container.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\dvs\p4\build\sw\gcomp\dev\src\NvContainer\_out\x86_64\release\container\NvContainer.pdb source: NVDisplay.Container.exe
Source:	Binary string: V:VC:\dvs\p4\build\sw\gcomp\dev\src\NvContainer\_out\x86_64\release\container\NvContainer.pdb" source: NVDisplay.Container.exe

Source: NVDisplay.Container.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: NVDisplay.Container.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: NVDisplay.Container.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: NVDisplay.Container.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: NVDisplay.Container.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: NVDisplay.Container.exe	Static PE information: section name: .didat
Source: NVDisplay.Container.exe	Static PE information: section name: _RDATA

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 DLL Side-Loading	OS Credential Dumping	1 System Information Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://aia.entrust.net/ts1-chain256.cer01	0%	URL Reputation	safe
http://crl.entrust.net/ts1ca.crl0	0%	URL Reputation	safe
http://ocsp.entrust.net03	0%	URL Reputation	safe
http://ocsp.entrust.net02	0%	URL Reputation	safe
http://www.entrust.net/rpa03	0%	URL Reputation	safe
http://crl.entrust.net/2048ca.crl0	0%	URL Reputation	safe
https://www.entrust.net/rpa0	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://aia.entrust.net/ts1-chain256.cer01	NVDisplay.Container.exe	false	URL Reputation: safe	unknown
http://crl.entrust.net/ts1ca.crl0	NVDisplay.Container.exe	false	URL Reputation: safe	unknown
http://ocsp.entrust.net03	NVDisplay.Container.exe	false	URL Reputation: safe	unknown
http://ocsp.entrust.net02	NVDisplay.Container.exe	false	URL Reputation: safe	unknown
http://www.entrust.net/rpa03	NVDisplay.Container.exe	false	URL Reputation: safe	unknown
http://crl.entrust.net/2048ca.crl0	NVDisplay.Container.exe	false	URL Reputation: safe	unknown
https://www.entrust.net/rpa0	NVDisplay.Container.exe	false	URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1490155
Start date and time:	2024-08-08 19:27:30 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 1m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	2
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	NVDisplay.Container.exe
Detection:	CLEAN
Classification:	clean1.winEXE@1/0@0/0
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
VT rate limit hit for: NVDisplay.Container.exe

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.453788434500371
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	NVDisplay.Container.exe
File size:	1'014'752 bytes
MD5:	25a35dd1848a060d8ae2e2e0124d132d
SHA1:	372194560fa6897313881d74c12f231639c3d1c8
SHA256:	99824d9ba21635461f054a515afa6ea1a6aace55b8902f304c2cfd6aad38b880
SHA512:	a8e0e6d5e69887017fed220072a9512387b2162755218cd4b0512de24f36e767e3a3d2af0ed9c680c8957110c50dfffb3326791f07ba1a23d621d68239147033
SSDEEP:	24576:2ZPo9KDpIHEE0rpZQESit86xUR6sCGkMrg:2ZPgKDpIH0pZQESc86xUR6t5
TLSH:	432539456E9BC5EAC17BA13FC5461943E9BEF602031393CB4B914A753B136E34E3A392
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........J\..+2..+2..+2..@6..+2..@1..+2..@7.d+2..^6..+2..^1..+2..^7..+2..v3..+2..+3..+2..^7..+2..^6..+2..^2..+2..^...+2..^0..+2.Rich.+2

File Icon


Icon Hash:	0cd3c0cad8c13244

Static PE Info

General

Entrypoint:	0x140036bd0
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x621DBDA6 [Tue Mar 1 06:31:02 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	f9bbd9a50a1378278fd166c16250f282

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	18/10/2022 02:00:00 16/10/2025 01:59:59
Subject Chain	CN=NVIDIA Corporation, OU=1-F, O=NVIDIA Corporation, L=Santa Clara, S=California, C=US
Version:	3
Thumbprint MD5:	ADDD0E5C2C1FCB87E286ABF0F7292AF3
Thumbprint SHA-1:	01DF5BFEFA251B27AC1933E4E4CB61F21C44D57B
Thumbprint SHA-256:	CCDDF490761FD36F95BB22F6593DE9E2AC4BB190A617F1090DC9224E2713888D
Serial:	0D0194CD1E3142205135D1C636E4E9BA

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F3970F180F4h
dec eax
add esp, 28h
jmp 00007F3970F17523h
int3
int3
jmp 00007F3970F16B48h
int3
int3
int3
dec eax
mov eax, esp
dec esp
mov dword ptr [eax+20h], ecx
dec esp
mov dword ptr [eax+18h], eax
dec eax
mov dword ptr [eax+10h], edx
push ebx
push esi
push edi
inc ecx
push esi
dec eax
sub esp, 38h
dec ebp
mov esi, ecx
dec ecx
mov ebx, eax
dec eax
mov esi, edx
mov byte ptr [eax-38h], 00000000h
dec eax
mov edi, edx
dec ecx
imul edi, eax
dec eax
add edi, ecx
dec eax
mov dword ptr [eax+08h], edi
dec eax
mov eax, ebx
dec eax
dec ebx
dec eax
mov dword ptr [esp+70h], ebx
dec eax
test eax, eax
je 00007F3970F1774Bh
dec eax
sub edi, esi
dec eax
mov dword ptr [esp+60h], edi
dec eax
mov ecx, edi
dec ecx
mov eax, esi
dec eax
mov edx, dword ptr [0006BA1Ch]
call edx
jmp 00007F3970F17709h
mov byte ptr [esp+20h], 00000001h
dec eax
add esp, 38h
inc ecx
pop esi
pop edi
pop esi
pop ebx
ret
int3
dec ebp
arpl ax, ax
jmp 00007F3970F176C1h
dec eax
mov dword ptr [esp+08h], ebx
push edi
dec eax
sub esp, 20h
dec eax
mov edi, dword ptr [ecx]
dec eax
mov ebx, ecx
cmp dword ptr [edi], E06D7363h
je 00007F3970F1773Fh
dec eax
mov ebx, dword ptr [esp+30h]
xor eax, eax
dec eax
add esp, 20h
pop edi
ret
call 00007F3970F188CFh
dec eax
mov dword ptr [eax], edi
dec eax
mov ebx, dword ptr [ebx+08h]
call 00007F3970F188D7h
dec eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0xc47b0	0x58	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc4808	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd9000	0x21810	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xcd000	0x963c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0xf3000	0x4be0	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xfb000	0xc08	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xb56e8	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xb5790	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa9c40	0x138	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xa2000	0x650	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0xc468c	0x60	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xa01d6	0xa0200	ae36fb1444bd4f93e3ac43b5b8067936	False	0.44458369925839186	data	6.41079136367007	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xa2000	0x23e4c	0x24000	0fb7d3607d2a2e5d2ffde8c48e7e3f23	False	0.34759521484375	OpenPGP Public Key	5.208802659242257	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xc6000	0x612c	0x2600	70a3d30110ad56a1cd30375b7164b9bb	False	0.19449013157894737	data	3.5529144363971814	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0xcd000	0x963c	0x9800	445cf24d8edd5dfdb30cf3601f9f1cc4	False	0.4973016036184211	PEX Binary Archive	5.970528807311775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.didat	0xd7000	0x30	0x200	e6e9f19d20ab19642b6158a7ad31e909	False	0.056640625	data	0.35064057787291114	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
_RDATA	0xd8000	0x180	0x200	7088bcbec4af56067fadb975e64f8ec8	False	0.3359375	data	3.2525265821445117	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xd9000	0x21810	0x21a00	f12be6f09af899736c70749801593e34	False	0.22983707016728624	data	4.704931928489124	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xfb000	0xc08	0xe00	f61863cf6ebae549539b37ce0717162a	False	0.4361049107142857	data	5.056637225563827	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xd935c	0x2a17	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9395823665893271
RT_ICON	0xdbd74	0x4c28	Device independent bitmap graphic, 128 x 256 x 8, image size 16384, 256 important colors	English	United States	0.09643003693065244
RT_ICON	0xe099c	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.18523454157782515
RT_ICON	0xe1844	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.24458483754512636
RT_ICON	0xe20ec	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	English	United States	0.23444700460829493
RT_ICON	0xe27b4	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.2203757225433526
RT_ICON	0xe2d1c	0x27cb	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9359968587415334
RT_ICON	0xe54e8	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States	0.06272920856500651
RT_ICON	0xf5d10	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.11639004149377594
RT_ICON	0xf82b8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.14845215759849906
RT_ICON	0xf9360	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.19836065573770492
RT_ICON	0xf9ce8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.22783687943262412
RT_GROUP_ICON	0xfa150	0xae	data	English	United States	0.6264367816091954
RT_VERSION	0xfa200	0x314	data	English	United States	0.4606598984771574
RT_MANIFEST	0xfa514	0x2fa	ASCII text, with very long lines (762), with no line terminators	English	United States	0.4776902887139108

Imports

DLL	Import
SHLWAPI.dll	PathIsRelativeW
KERNEL32.dll	VerSetConditionMask, CreateFileW, GetFileAttributesW, GetFullPathNameW, OutputDebugStringW, SetLastError, CreateProcessA, CreateProcessW, GetSystemDirectoryW, FreeLibrary, GetModuleFileNameA, GetModuleFileNameW, GetProcAddress, LoadLibraryExW, lstrcmpA, VerifyVersionInfoW, FileTimeToSystemTime, ExpandEnvironmentStringsW, DeleteFileW, FindClose, FindFirstFileW, FindNextFileW, OutputDebugStringA, Sleep, GetCurrentThreadId, ProcessIdToSessionId, GetSystemTime, GetSystemTimeAsFileTime, CreateTimerQueueTimer, DeleteTimerQueueTimer, GetModuleHandleExW, MoveFileW, MultiByteToWideChar, WideCharToMultiByte, CreateToolhelp32Snapshot, Process32FirstW, RemoveVectoredContinueHandler, CreateDirectoryW, FindCloseChangeNotification, FindFirstChangeNotificationW, FindNextChangeNotification, GetCurrentDirectoryW, GetErrorMode, SetErrorMode, GetCommandLineW, RaiseException, GetSystemInfo, VirtualProtect, VirtualQuery, LoadLibraryExA, RemoveDirectoryW, DeviceIoControl, HeapSize, GetProcessHeap, SetEnvironmentVariableW, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineA, GetOEMCP, GetACP, IsValidCodePage, GetStringTypeW, GetFileSizeEx, ReadConsoleW, ReadFile, SetStdHandle, GetConsoleMode, GetConsoleOutputCP, FlushFileBuffers, SetConsoleCtrlHandler, GetCurrentThread, EnumSystemLocalesW, AddVectoredContinueHandler, RemoveVectoredExceptionHandler, AddVectoredExceptionHandler, SetUnhandledExceptionFilter, RtlCaptureStackBackTrace, RtlUnwind, GetModuleHandleW, WaitForMultipleObjects, OpenEventW, LocalFree, LocalAlloc, OpenProcess, CreateThread, GetCurrentProcessId, CreateEventW, WaitForSingleObject, SetEvent, GetLastError, CloseHandle, GetCurrentProcess, GetProcessTimes, SetDefaultDllDirectories, HeapReAlloc, Process32NextW, FormatMessageA, SetCurrentDirectoryW, FindFirstFileExW, GetDiskFreeSpaceExW, GetFileAttributesExW, GetFileInformationByHandle, GetFinalPathNameByHandleW, SetEndOfFile, SetFileAttributesW, SetFileInformationByHandle, SetFilePointerEx, SetFileTime, GetTempPathW, AreFileApisANSI, CreateDirectoryExW, CopyFileW, MoveFileExW, CreateHardLinkW, GetFileInformationByHandleEx, CreateSymbolicLinkW, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, ResetEvent, WaitForSingleObjectEx, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, IsDebuggerPresent, GetStartupInfoW, QueryPerformanceCounter, InitializeSListHead, InterlockedPushEntrySList, InterlockedFlushSList, RtlUnwindEx, RtlPcToFileHeader, EncodePointer, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, ExitProcess, GetFileType, GetStdHandle, WriteConsoleW, GetCPInfo, WriteFile, HeapAlloc, HeapFree, GetDateFormatW, GetTimeFormatW, CompareStringW, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID
USER32.dll	PeekMessageW, GetMessageW, ShutdownBlockReasonDestroy, ShutdownBlockReasonCreate, SetWindowLongPtrW, GetWindowLongPtrW, LoadStringW, UnregisterClassW, RegisterClassW, DefWindowProcW, PostMessageW, DispatchMessageW, TranslateMessage, DestroyWindow, PostThreadMessageW, CreateWindowExW
SHELL32.dll	CommandLineToArgvW
ADVAPI32.dll	RegDeleteValueW, RegSetKeyValueW, RegOpenKeyExW, GetUserNameW, BuildExplicitAccessWithNameW, SetSecurityInfo, GetSecurityInfo, SetEntriesInAclW, StartServiceCtrlDispatcherW, SetServiceStatus, RegisterServiceCtrlHandlerExW, QueryServiceConfigW, OpenServiceW, OpenSCManagerW, CloseServiceHandle, ChangeServiceConfigW, RegGetValueW, RegSetValueExW, RegCreateKeyExW, RegCloseKey, LookupAccountSidW, CreateWellKnownSid, OpenProcessToken

Exports

Name	Ordinal	Address
NvOptimusEnablement	1	0x1400c6000

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

⊘No network behavior found

Statistics

CPU Usage

• NVDisplay.Container.exe

Click to jump to process

Memory Usage

• NVDisplay.Container.exe

Click to jump to process

System Behavior

Analysis Process: NVDisplay.Container.exePID: 6680, Parent PID: 1028

Function Logs

General

Target ID:	0
Start time:	13:28:19
Start date:	08/08/2024
Path:	C:\Users\user\Desktop\NVDisplay.Container.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\NVDisplay.Container.exe"
Imagebase:	0x7ff7fbed0000
File size:	1'014'752 bytes
MD5 hash:	25A35DD1848A060D8AE2E2E0124D132D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

File Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Section Activities

Sections loaded by Windows

Sections loaded by Program

Show Windows behavior

Registry Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Mutex Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Process Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Thread Activities

Thread Information Set

Show Windows behavior

Memory Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

System Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report NVDisplay.Container.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: NVDisplay.Container.exePID: 6680, Parent PID: 1028

General

File Activities

File Opened

File Attributes Queried

Volume Information Queried

Section Activities

Sections loaded by Windows

Sections loaded by Program

Registry Activities

Key Opened

Key Value Queried

Windows Analysis Report
NVDisplay.Container.exe