Edit tour

Windows Analysis Report
https://developer.download.nvidia.com/compute/cuda/12.4.0/local_installers/cuda_12.4.0_551.61_windows.exe

Overview

General Information

Sample URL:	https://developer.download.nvidia.com/compute/cuda/12.4.0/local_installers/cuda_12.4.0_551.61_windows.exe
Analysis ID:	1419160
Infos:

Detection

Score:	24
Range:	0 - 100
Whitelisted:	false
Confidence:	40%

Signatures

Drops large PE files

Abnormal high CPU Usage

Drops PE files

Found dropped PE file which has not been started or loaded

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Usage Of Web Request Commands And Cmdlets

Tries to load missing DLLs

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Analysis Advice

Sample drops PE files which have not been started, submit dropped PE samples for a secondary analysis to Joe Sandbox

Sample searches for specific file, try point organization specific fake files to the analysis machine

Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior

Process Tree

System is w10x64

cmd.exe (PID: 6780 cmdline: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://developer.download.nvidia.com/compute/cuda/12.4.0/local_installers/cuda_12.4.0_551.61_windows.exe" > cmdline.out 2>&1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6916 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wget.exe (PID: 7044 cmdline: wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://developer.download.nvidia.com/compute/cuda/12.4.0/local_installers/cuda_12.4.0_551.61_windows.exe" MD5: 3DADB6E2ECE9C4B3E1E322E617658B60)

cuda_12.4.0_551.61_windows.exe (PID: 2252 cmdline: "C:\Users\user\Desktop\download\cuda_12.4.0_551.61_windows.exe" MD5: A8324145BF4FDF5C09C76A7BFC670B93)

cleanup

Sigma Signatures

System Summary

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://developer.download.nvidia.com/compute/cuda/12.4.0/local_installers/cuda_12.4.0_551.61_windows.exe" > cmdline.out 2>&1, CommandLine: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://developer.download.nvidia.com/compute/cuda/12.4.0/local_installers/cuda_12.4.0_551.61_windows.exe" > cmdline.out 2>&1, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 648, ProcessCommandLine: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://developer.download.nvidia.com/compute/cuda/12.4.0/local_installers/cuda_12.4.0_551.61_windows.exe" > cmdline.out 2>&1, ProcessId: 6780, ProcessName: cmd.exe

Source:	Binary string: C:\dvs\p4\build\sw\dev\cm\pfw\dev_a\cm\SFX\Output\Win32\7zSfxMod.pdbh source: cuda_12.4.0_551.61_windows.exe, 0000000C.00000000.6027366330.000000000049E000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: C:\dvs\p4\build\sw\dev\cm\pfw\dev_a\cm\SFX\Output\Win32\7zSfxMod.pdb source: cuda_12.4.0_551.61_windows.exe, 0000000C.00000000.6027366330.000000000049E000.00000002.00000001.01000000.00000004.sdmp

Source: C:\Users\user\Desktop\download\cuda_12.4.0_551.61_windows.exe	File opened: C:\Users\user\AppData\Local\Temp\cuda\cuda_cupti\cupti\extras\CUPTI\doc	Jump to behavior
Source: C:\Users\user\Desktop\download\cuda_12.4.0_551.61_windows.exe	File opened: C:\Users\user\AppData\Local\Temp\cuda\cuda_cupti\cupti\extras\CUPTI	Jump to behavior
Source: C:\Users\user\Desktop\download\cuda_12.4.0_551.61_windows.exe	File opened: C:\Users\user\AppData\Local\Temp\cuda\cuda_cupti\cupti\extras\CUPTI\doc\html	Jump to behavior
Source: C:\Users\user\Desktop\download\cuda_12.4.0_551.61_windows.exe	File opened: C:\Users\user\AppData\Local\Temp\cuda\cuda_cupti\cupti\extras	Jump to behavior
Source: C:\Users\user\Desktop\download\cuda_12.4.0_551.61_windows.exe	File opened: C:\Users\user\AppData\Local\Temp\cuda\cuda_cupti\cupti	Jump to behavior
Source: C:\Users\user\Desktop\download\cuda_12.4.0_551.61_windows.exe	File opened: C:\Users\user\AppData\Local\Temp\cuda\cuda_cupti\cupti\extras\CUPTI\doc\html\api	Jump to behavior

Source: wget.exe, 00000002.00000003.5099081030.0000000000ABE000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.5099081030.0000000000AB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://aia.entrust.net/ts1-chain256.cer01
Source: wget.exe, 00000002.00000003.5099081030.0000000000ABE000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.5099081030.0000000000AB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: wget.exe, 00000002.00000003.5099081030.0000000000ABE000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.5099081030.0000000000AB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: wget.exe, 00000002.00000003.5099081030.0000000000ABE000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.5099081030.0000000000AB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/ts1ca.crl0
Source: wget.exe, 00000002.00000003.5099081030.0000000000ABE000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.5099081030.0000000000AB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: wget.exe, 00000002.00000003.5099081030.0000000000ABE000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.5099081030.0000000000AB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: CUDAToolkit.nvi.12.dr	String found in binary or memory: http://docs.nvidia.com/cuda/cuda-installation-guide-microsoft-windows/index.html#system-requirements
Source: is_trivially_relocatable.h.12.dr	String found in binary or memory: http://eel.is/c
Source: EULA.txt.12.dr	String found in binary or memory: http://impact.crhc.illinois.edu
Source: EULA.txt.12.dr	String found in binary or memory: http://llvm.org
Source: wget.exe, 00000002.00000003.5099081030.0000000000ABE000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.5099081030.0000000000AB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: wget.exe, 00000002.00000003.5099081030.0000000000ABE000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.5099081030.0000000000AB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net02
Source: wget.exe, 00000002.00000003.5099081030.0000000000ABE000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.5099081030.0000000000AB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: EULA.txt.12.dr	String found in binary or memory: http://openai.com)
Source: unique.h.12.dr, tabulate.h1.12.dr, swap_ranges.h.12.dr, device_synchronize.cuh.12.dr, namespace.h.12.dr, complex.h0.12.dr, unique.h1.12.dr, assign_value.h.12.dr, memory_resource.h0.12.dr, compiler.h.12.dr, scatter.h.12.dr, ccosh.h.12.dr, copy.h2.12.dr, reduce.h.12.dr, uninitialized_fill.h0.12.dr, partition.inl.12.dr, unique.inl.12.dr, execution_policy.h1.12.dr, fill_construct_range.inl.12.dr, sequence.h1.12.dr, transform_scan.h.12.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: EULA.txt.12.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: wget.exe, 00000002.00000003.5099081030.0000000000ABE000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.5099081030.0000000000AB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: EULA.txt.12.dr	String found in binary or memory: http://www.eclipse.org.
Source: wget.exe, 00000002.00000003.5099081030.0000000000ABE000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.5099081030.0000000000AB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.entrust.net/rpa03
Source: EULA.txt.12.dr	String found in binary or memory: http://www.gnu.org/licenses/gpl.txt
Source: FindTBB.cmake.12.dr	String found in binary or memory: http://www.ogre3d.org/
Source: EULA.txt.12.dr	String found in binary or memory: http://www.opensource.org/licenses/bsd-license.php)
Source: FindTBB.cmake.12.dr	String found in binary or memory: https://cmake.org/cmake/help/latest/variable/MSVC_VERSION.html
Source: wget.exe, 00000002.00000002.5704491020.0000000000D38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://developer.download.nvidia.com/compute/cuda/12.4.0/local_installers/cuda
Source: wget.exe, 00000002.00000002.5704258359.0000000000B90000.00000004.00000020.00020000.00000000.sdmp, cmdline.out.0.dr	String found in binary or memory: https://developer.download.nvidia.com/compute/cuda/12.4.0/local_installers/cuda_12.4.0_551.61_window
Source: EULA.txt.12.dr	String found in binary or memory: https://developer.nvidia.com.
Source: cupti_result.h.12.dr	String found in binary or memory: https://developer.nvidia.com/CUPTI_ERROR_INSUFFICIENT_PRIVILEGES
Source: cupti_result.h.12.dr	String found in binary or memory: https://developer.nvidia.com/ERR_NVCMPGPU
Source: CUDA_Toolkit_Release_Notes.txt.12.dr	String found in binary or memory: https://developer.nvidia.com/blog/updating-the-cuda-linux-gpg-repository-key/.
Source: CUDA_Toolkit_Release_Notes.txt.12.dr	String found in binary or memory: https://developer.nvidia.com/cuda-gpus.
Source: DOCS.12.dr	String found in binary or memory: https://docs.nvidia.com/cuda
Source: CUDA_Toolkit_Release_Notes.txt.12.dr	String found in binary or memory: https://docs.nvidia.com/cuda/cuda-c-best-practices-guide/index.html#cuda-compatibility-and-upgrades.
Source: CUDA_Toolkit_Release_Notes.txt.12.dr	String found in binary or memory: https://docs.nvidia.com/cuda/cuda-c-programming-guide/index.html#stream-ordered-querying-memory-supp
Source: CUDA_Toolkit_Release_Notes.txt.12.dr	String found in binary or memory: https://docs.nvidia.com/cuda/cuda-installation-guide-linux/index.html#open-gpu-kernel-modules
Source: CUDA_Toolkit_Release_Notes.txt.12.dr	String found in binary or memory: https://docs.nvidia.com/cuda/cuda-installation-guide-linux/index.html#package-manager-metas
Source: CUDA_Toolkit_Release_Notes.txt.12.dr	String found in binary or memory: https://docs.nvidia.com/cuda/cuda-installation-guide-microsoft-windows/index.html#install-cuda-softw
Source: CUDA_Toolkit_Release_Notes.txt.12.dr	String found in binary or memory: https://docs.nvidia.com/cuda/cuda-math-api/index.html
Source: CUDA_Toolkit_Release_Notes.txt.12.dr	String found in binary or memory: https://docs.nvidia.com/cuda/cuda-math-api/index.html.
Source: CUDA_Toolkit_Release_Notes.txt.12.dr	String found in binary or memory: https://docs.nvidia.com/cuda/cuda-toolkit-release-notes/index.html.
Source: CUDA_Toolkit_Release_Notes.txt.12.dr	String found in binary or memory: https://docs.nvidia.com/cuda/cusparse/index.html#cusparse-generic-function-spmm-op.
Source: CUDA_Toolkit_Release_Notes.txt.12.dr	String found in binary or memory: https://docs.nvidia.com/cuda/cusparse/index.html#cusparse-logging.
Source: driver_types.h.12.dr, cuda_runtime_api.h.12.dr	String found in binary or memory: https://docs.nvidia.com/cuda/gpudirect-rdma
Source: CUDA_Toolkit_Release_Notes.txt.12.dr	String found in binary or memory: https://docs.nvidia.com/deploy/cuda-compatibility/index.html
Source: count.h1.12.dr	String found in binary or memory: https://en.cppreference.com/w/cpp/algorithm/count
Source: sort.h0.12.dr	String found in binary or memory: https://en.cppreference.com/w/cpp/algorithm/is_sorted
Source: reverse.h0.12.dr	String found in binary or memory: https://en.cppreference.com/w/cpp/algorithm/reverse
Source: reverse.h0.12.dr	String found in binary or memory: https://en.cppreference.com/w/cpp/algorithm/reverse_copy
Source: sort.h0.12.dr	String found in binary or memory: https://en.cppreference.com/w/cpp/algorithm/sort
Source: sort.h0.12.dr	String found in binary or memory: https://en.cppreference.com/w/cpp/algorithm/stable_sort
Source: unique.h1.12.dr	String found in binary or memory: https://en.cppreference.com/w/cpp/algorithm/unique
Source: unique.h1.12.dr	String found in binary or memory: https://en.cppreference.com/w/cpp/algorithm/unique_copy
Source: count.h1.12.dr	String found in binary or memory: https://en.cppreference.com/w/cpp/concepts/equality_comparable
Source: count.h1.12.dr	String found in binary or memory: https://en.cppreference.com/w/cpp/concepts/predicate
Source: sort.h0.12.dr	String found in binary or memory: https://en.cppreference.com/w/cpp/concepts/strict_weak_order
Source: vector.h0.12.dr, vector.h.12.dr	String found in binary or memory: https://en.cppreference.com/w/cpp/container/vector
Source: advance.h.12.dr	String found in binary or memory: https://en.cppreference.com/w/cpp/iterator/advance
Source: reverse.h0.12.dr	String found in binary or memory: https://en.cppreference.com/w/cpp/iterator/bidirectional_iterator
Source: sort.h0.12.dr, tabulate.h0.12.dr, uninitialized_fill.h1.12.dr	String found in binary or memory: https://en.cppreference.com/w/cpp/iterator/forward_iterator
Source: count.h1.12.dr, advance.h.12.dr	String found in binary or memory: https://en.cppreference.com/w/cpp/iterator/input_iterator
Source: advance.h.12.dr	String found in binary or memory: https://en.cppreference.com/w/cpp/iterator/next
Source: unique.h1.12.dr, shuffle.h.12.dr, reverse.h0.12.dr	String found in binary or memory: https://en.cppreference.com/w/cpp/iterator/output_iterator
Source: advance.h.12.dr	String found in binary or memory: https://en.cppreference.com/w/cpp/iterator/prev
Source: sort.h0.12.dr	String found in binary or memory: https://en.cppreference.com/w/cpp/iterator/random_access_iterator
Source: integer_sequence.h0.12.dr	String found in binary or memory: https://en.cppreference.com/w/cpp/language/constant_expression#Integral_constant_expression
Source: uninitialized_fill.h1.12.dr	String found in binary or memory: https://en.cppreference.com/w/cpp/memory/uninitialized_fill
Source: advance.h.12.dr	String found in binary or memory: https://en.cppreference.com/w/cpp/named_req/BidirectionalIterator
Source: unique.h1.12.dr, is_operator_less_or_greater_function_object.h.12.dr	String found in binary or memory: https://en.cppreference.com/w/cpp/named_req/BinaryPredicate
Source: is_trivially_relocatable.h.12.dr	String found in binary or memory: https://en.cppreference.com/w/cpp/named_req/BinaryTypeTrait
Source: is_contiguous_iterator.h.12.dr	String found in binary or memory: https://en.cppreference.com/w/cpp/named_req/ContiguousIterator
Source: advance.h.12.dr	String found in binary or memory: https://en.cppreference.com/w/cpp/named_req/InputIterator
Source: sort.h0.12.dr	String found in binary or memory: https://en.cppreference.com/w/cpp/named_req/LessThanComparable
Source: sort.h0.12.dr	String found in binary or memory: https://en.cppreference.com/w/cpp/named_req/RandomAccessIterator
Source: is_contiguous_iterator.h.12.dr, is_operator_less_or_greater_function_object.h.12.dr, is_trivially_relocatable.h.12.dr	String found in binary or memory: https://en.cppreference.com/w/cpp/named_req/UnaryTypeTrait
Source: is_trivially_relocatable.h.12.dr	String found in binary or memory: https://en.cppreference.com/w/cpp/string/byte/memcpy
Source: integer_sequence.h0.12.dr	String found in binary or memory: https://en.cppreference.com/w/cpp/types/size_t
Source: tabulate.h0.12.dr	String found in binary or memory: https://en.cppreference.com/w/cpp/utility/functional/unary_function
Source: integer_sequence.h0.12.dr	String found in binary or memory: https://en.cppreference.com/w/cpp/utility/integer_sequence
Source: __access_property.12.dr	String found in binary or memory: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61414
Source: README.txt.12.dr	String found in binary or memory: https://github.com/microsoft/Detours
Source: EULA.txt.12.dr	String found in binary or memory: https://github.com/nvidia/cuda-samples
Source: EULA.txt.12.dr	String found in binary or memory: https://github.com/openai/openai-gemm/blob/master/LICENSE
Source: thrust-config.cmake.12.dr	String found in binary or memory: https://gitlab.kitware.com/cmake/cmake/-/issues/20670
Source: atomic_nvrtc.h.12.dr, xlocale.h0.12.dr, optional.12.dr, is_union.h.12.dr, cmp.h.12.dr, in_place.h.12.dr, thread.12.dr, __config_site.in.12.dr, cstdbool.12.dr, is_valid_expansion.h.12.dr, complex.h.12.dr, csetjmp.12.dr, chrono.h.12.dr, swap_ranges.h2.12.dr, boolean_testable.h.12.dr, set0.12.dr, stdexcept.12.dr, is_reference_wrapper.h.12.dr, list.12.dr, limits0.12.dr, forward_list.12.dr	String found in binary or memory: https://llvm.org/LICENSE.txt
Source: is_trivially_relocatable.h.12.dr	String found in binary or memory: https://wg21.link/P1144
Source: is_trivially_relocatable.h.12.dr	String found in binary or memory: https://wg21.link/P1144R0#wording-inheritance
Source: wget.exe, 00000002.00000003.5099081030.0000000000ABE000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.5099081030.0000000000AB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.entrust.net/rpa0
Source: CUDA_Toolkit_Release_Notes.txt.12.dr	String found in binary or memory: https://www.nvidia.com/drivers.

Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\cuda_12.4.0_551.61_windows.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\cuda_12.4.0_551.61_windows.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\cuda_12.4.0_551.61_windows.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\cuda_12.4.0_551.61_windows.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\cuda_12.4.0_551.61_windows.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\cuda_12.4.0_551.61_windows.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\cuda_12.4.0_551.61_windows.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\cuda_12.4.0_551.61_windows.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\cuda_12.4.0_551.61_windows.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\cuda_12.4.0_551.61_windows.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\cuda_12.4.0_551.61_windows.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\cuda_12.4.0_551.61_windows.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\cuda_12.4.0_551.61_windows.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\cuda_12.4.0_551.61_windows.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\cuda_12.4.0_551.61_windows.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\cuda_12.4.0_551.61_windows.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\cuda_12.4.0_551.61_windows.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\cuda_12.4.0_551.61_windows.exe	Section loaded: thumbcache.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\cuda_12.4.0_551.61_windows.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\cuda_12.4.0_551.61_windows.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\download\cuda_12.4.0_551.61_windows.exe	Section loaded: explorerframe.dll	Jump to behavior

Source: C:\Users\user\Desktop\download\cuda_12.4.0_551.61_windows.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\c:usersuserappdatalocaltempcuda
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6916:120:WilError_03

Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://developer.download.nvidia.com/compute/cuda/12.4.0/local_installers/cuda_12.4.0_551.61_windows.exe" > cmdline.out 2>&1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wget.exe wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://developer.download.nvidia.com/compute/cuda/12.4.0/local_installers/cuda_12.4.0_551.61_windows.exe"
Source: unknown	Process created: C:\Users\user\Desktop\download\cuda_12.4.0_551.61_windows.exe "C:\Users\user\Desktop\download\cuda_12.4.0_551.61_windows.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wget.exe wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://developer.download.nvidia.com/compute/cuda/12.4.0/local_installers/cuda_12.4.0_551.61_windows.exe"	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	3 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	12 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact

Source	Detection	Scanner	Label	Link
https://developer.download.nvidia.com/compute/cuda/12.4.0/local_installers/cuda_12.4.0_551.61_windows.exe	0%	Avira URL Cloud	safe
https://developer.download.nvidia.com/compute/cuda/12.4.0/local_installers/cuda_12.4.0_551.61_windows.exe	0%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\cuda\cuda_cupti\cupti\extras\CUPTI\samples\pc_sampling_continuous\libpc_sampling_continuous.pl	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\cuda\cuda_cupti\cupti\extras\CUPTI\samples\pc_sampling_continuous\libpc_sampling_continuous.pl	0%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://ocsp.entrust.net03	0%	URL Reputation	safe
http://ocsp.entrust.net02	0%	URL Reputation	safe
http://ocsp.entrust.net02	0%	URL Reputation	safe
http://openai.com)	0%	Avira URL Cloud	safe
https://wg21.link/P1144R0#wording-inheritance	0%	Avira URL Cloud	safe
https://wg21.link/P1144	0%	Avira URL Cloud	safe
http://eel.is/c	0%	Avira URL Cloud	safe
https://wg21.link/P1144R0#wording-inheritance	0%	Virustotal		Browse
https://wg21.link/P1144	0%	Virustotal		Browse
http://eel.is/c	0%	Virustotal		Browse

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.nvidia.com/cuda/cuda-installation-guide-microsoft-windows/index.html#system-requirements	CUDAToolkit.nvi.12.dr	false		high
https://en.cppreference.com/w/cpp/algorithm/sort	sort.h0.12.dr	false		high
https://en.cppreference.com/w/cpp/utility/functional/unary_function	tabulate.h0.12.dr	false		high
http://ocsp.entrust.net03	wget.exe, 00000002.00000003.5099081030.0000000000ABE000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.5099081030.0000000000AB6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.entrust.net02	wget.exe, 00000002.00000003.5099081030.0000000000ABE000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.5099081030.0000000000AB6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://en.cppreference.com/w/cpp/iterator/input_iterator	count.h1.12.dr, advance.h.12.dr	false		high
https://llvm.org/LICENSE.txt	atomic_nvrtc.h.12.dr, xlocale.h0.12.dr, optional.12.dr, is_union.h.12.dr, cmp.h.12.dr, in_place.h.12.dr, thread.12.dr, __config_site.in.12.dr, cstdbool.12.dr, is_valid_expansion.h.12.dr, complex.h.12.dr, csetjmp.12.dr, chrono.h.12.dr, swap_ranges.h2.12.dr, boolean_testable.h.12.dr, set0.12.dr, stdexcept.12.dr, is_reference_wrapper.h.12.dr, list.12.dr, limits0.12.dr, forward_list.12.dr	false		high
https://en.cppreference.com/w/cpp/iterator/prev	advance.h.12.dr	false		high
https://docs.nvidia.com/cuda/cusparse/index.html#cusparse-logging.	CUDA_Toolkit_Release_Notes.txt.12.dr	false		high
https://en.cppreference.com/w/cpp/concepts/equality_comparable	count.h1.12.dr	false		high
https://github.com/openai/openai-gemm/blob/master/LICENSE	EULA.txt.12.dr	false		high
http://llvm.org	EULA.txt.12.dr	false		high
https://docs.nvidia.com/cuda/cuda-c-best-practices-guide/index.html#cuda-compatibility-and-upgrades.	CUDA_Toolkit_Release_Notes.txt.12.dr	false		high
http://openai.com)	EULA.txt.12.dr	false	Avira URL Cloud: safe	low
https://docs.nvidia.com/cuda/gpudirect-rdma	driver_types.h.12.dr, cuda_runtime_api.h.12.dr	false		high
https://en.cppreference.com/w/cpp/algorithm/count	count.h1.12.dr	false		high
https://en.cppreference.com/w/cpp/iterator/bidirectional_iterator	reverse.h0.12.dr	false		high
https://en.cppreference.com/w/cpp/iterator/output_iterator	unique.h1.12.dr, shuffle.h.12.dr, reverse.h0.12.dr	false		high
https://en.cppreference.com/w/cpp/named_req/BinaryTypeTrait	is_trivially_relocatable.h.12.dr	false		high
https://en.cppreference.com/w/cpp/memory/uninitialized_fill	uninitialized_fill.h1.12.dr	false		high
https://developer.nvidia.com/CUPTI_ERROR_INSUFFICIENT_PRIVILEGES	cupti_result.h.12.dr	false		high
https://en.cppreference.com/w/cpp/algorithm/unique	unique.h1.12.dr	false		high
https://en.cppreference.com/w/cpp/named_req/RandomAccessIterator	sort.h0.12.dr	false		high
https://gitlab.kitware.com/cmake/cmake/-/issues/20670	thrust-config.cmake.12.dr	false		high
https://en.cppreference.com/w/cpp/algorithm/reverse	reverse.h0.12.dr	false		high
https://en.cppreference.com/w/cpp/algorithm/unique_copy	unique.h1.12.dr	false		high
https://en.cppreference.com/w/cpp/concepts/strict_weak_order	sort.h0.12.dr	false		high
https://en.cppreference.com/w/cpp/named_req/UnaryTypeTrait	is_contiguous_iterator.h.12.dr, is_operator_less_or_greater_function_object.h.12.dr, is_trivially_relocatable.h.12.dr	false		high
https://docs.nvidia.com/cuda/cuda-math-api/index.html.	CUDA_Toolkit_Release_Notes.txt.12.dr	false		high
https://en.cppreference.com/w/cpp/algorithm/reverse_copy	reverse.h0.12.dr	false		high
https://docs.nvidia.com/cuda	DOCS.12.dr	false		high
http://crl.entrust.net/ts1ca.crl0	wget.exe, 00000002.00000003.5099081030.0000000000ABE000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.5099081030.0000000000AB6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://en.cppreference.com/w/cpp/algorithm/stable_sort	sort.h0.12.dr	false		high
https://docs.nvidia.com/cuda/cuda-toolkit-release-notes/index.html.	CUDA_Toolkit_Release_Notes.txt.12.dr	false		high
https://wg21.link/P1144	is_trivially_relocatable.h.12.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.nvidia.com/drivers.	CUDA_Toolkit_Release_Notes.txt.12.dr	false		high
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61414	__access_property.12.dr	false		high
https://wg21.link/P1144R0#wording-inheritance	is_trivially_relocatable.h.12.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://developer.nvidia.com/ERR_NVCMPGPU	cupti_result.h.12.dr	false		high
http://www.apache.org/licenses/LICENSE-2.0	unique.h.12.dr, tabulate.h1.12.dr, swap_ranges.h.12.dr, device_synchronize.cuh.12.dr, namespace.h.12.dr, complex.h0.12.dr, unique.h1.12.dr, assign_value.h.12.dr, memory_resource.h0.12.dr, compiler.h.12.dr, scatter.h.12.dr, ccosh.h.12.dr, copy.h2.12.dr, reduce.h.12.dr, uninitialized_fill.h0.12.dr, partition.inl.12.dr, unique.inl.12.dr, execution_policy.h1.12.dr, fill_construct_range.inl.12.dr, sequence.h1.12.dr, transform_scan.h.12.dr	false		high
http://www.ogre3d.org/	FindTBB.cmake.12.dr	false		high
https://docs.nvidia.com/cuda/cuda-c-programming-guide/index.html#stream-ordered-querying-memory-supp	CUDA_Toolkit_Release_Notes.txt.12.dr	false		high
https://en.cppreference.com/w/cpp/utility/integer_sequence	integer_sequence.h0.12.dr	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	EULA.txt.12.dr	false		high
https://en.cppreference.com/w/cpp/iterator/next	advance.h.12.dr	false		high
http://www.entrust.net/rpa03	wget.exe, 00000002.00000003.5099081030.0000000000ABE000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.5099081030.0000000000AB6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://en.cppreference.com/w/cpp/string/byte/memcpy	is_trivially_relocatable.h.12.dr	false		high
https://en.cppreference.com/w/cpp/concepts/predicate	count.h1.12.dr	false		high
https://en.cppreference.com/w/cpp/iterator/advance	advance.h.12.dr	false		high
https://en.cppreference.com/w/cpp/named_req/ContiguousIterator	is_contiguous_iterator.h.12.dr	false		high
http://aia.entrust.net/ts1-chain256.cer01	wget.exe, 00000002.00000003.5099081030.0000000000ABE000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.5099081030.0000000000AB6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://en.cppreference.com/w/cpp/named_req/LessThanComparable	sort.h0.12.dr	false		high
https://en.cppreference.com/w/cpp/named_req/BinaryPredicate	unique.h1.12.dr, is_operator_less_or_greater_function_object.h.12.dr	false		high
https://en.cppreference.com/w/cpp/algorithm/is_sorted	sort.h0.12.dr	false		high
https://docs.nvidia.com/cuda/cuda-math-api/index.html	CUDA_Toolkit_Release_Notes.txt.12.dr	false		high
https://docs.nvidia.com/cuda/cuda-installation-guide-linux/index.html#package-manager-metas	CUDA_Toolkit_Release_Notes.txt.12.dr	false		high
http://www.opensource.org/licenses/bsd-license.php)	EULA.txt.12.dr	false		high
https://developer.nvidia.com/blog/updating-the-cuda-linux-gpg-repository-key/.	CUDA_Toolkit_Release_Notes.txt.12.dr	false		high
https://en.cppreference.com/w/cpp/container/vector	vector.h0.12.dr, vector.h.12.dr	false		high
https://github.com/nvidia/cuda-samples	EULA.txt.12.dr	false		high
https://en.cppreference.com/w/cpp/named_req/BidirectionalIterator	advance.h.12.dr	false		high
http://www.eclipse.org.	EULA.txt.12.dr	false		high
https://en.cppreference.com/w/cpp/iterator/random_access_iterator	sort.h0.12.dr	false		high
http://www.gnu.org/licenses/gpl.txt	EULA.txt.12.dr	false		high
https://github.com/microsoft/Detours	README.txt.12.dr	false		high
https://developer.download.nvidia.com/compute/cuda/12.4.0/local_installers/cuda	wget.exe, 00000002.00000002.5704491020.0000000000D38000.00000004.00000020.00020000.00000000.sdmp	false		high
https://en.cppreference.com/w/cpp/types/size_t	integer_sequence.h0.12.dr	false		high
https://developer.nvidia.com.	EULA.txt.12.dr	false		high
https://docs.nvidia.com/deploy/cuda-compatibility/index.html	CUDA_Toolkit_Release_Notes.txt.12.dr	false		high
https://docs.nvidia.com/cuda/cuda-installation-guide-linux/index.html#open-gpu-kernel-modules	CUDA_Toolkit_Release_Notes.txt.12.dr	false		high
http://eel.is/c	is_trivially_relocatable.h.12.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://developer.nvidia.com/cuda-gpus.	CUDA_Toolkit_Release_Notes.txt.12.dr	false		high
https://cmake.org/cmake/help/latest/variable/MSVC_VERSION.html	FindTBB.cmake.12.dr	false		high
https://en.cppreference.com/w/cpp/named_req/InputIterator	advance.h.12.dr	false		high
https://en.cppreference.com/w/cpp/iterator/forward_iterator	sort.h0.12.dr, tabulate.h0.12.dr, uninitialized_fill.h1.12.dr	false		high
https://developer.download.nvidia.com/compute/cuda/12.4.0/local_installers/cuda_12.4.0_551.61_window	wget.exe, 00000002.00000002.5704258359.0000000000B90000.00000004.00000020.00020000.00000000.sdmp, cmdline.out.0.dr	false		high
http://crl.entrust.net/2048ca.crl0	wget.exe, 00000002.00000003.5099081030.0000000000ABE000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.5099081030.0000000000AB6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.nvidia.com/cuda/cusparse/index.html#cusparse-generic-function-spmm-op.	CUDA_Toolkit_Release_Notes.txt.12.dr	false		high
http://impact.crhc.illinois.edu	EULA.txt.12.dr	false		high
https://docs.nvidia.com/cuda/cuda-installation-guide-microsoft-windows/index.html#install-cuda-softw	CUDA_Toolkit_Release_Notes.txt.12.dr	false		high
https://www.entrust.net/rpa0	wget.exe, 00000002.00000003.5099081030.0000000000ABE000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.5099081030.0000000000AB6000.00000004.00000020.00020000.00000000.sdmp	false		high

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1419160
Start date and time:	2024-04-03 08:06:27 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 14m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	urldownload.jbs
Sample URL:	https://developer.download.nvidia.com/compute/cuda/12.4.0/local_installers/cuda_12.4.0_551.61_windows.exe
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	SUS
Classification:	sus24.win@5/1027@0/1
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Process:	C:\Users\user\Desktop\download\cuda_12.4.0_551.61_windows.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1505
Entropy (8bit):	5.2303567540248
Encrypted:	false
SSDEEP:	24:2dzlTK2IYPZd/vQXLzzGGDwzudp+feXlgcfz3Vi4PrdpWmE9vIAT7uLMqSHC37iJ:c5TK2IYkbD3dsf5AViMrnBE9vIAGLMRr
MD5:	3BDA0AFAC99B6BB28E9F958B198C968B
SHA1:	4ED2FDBED0FC90385BF077F25962D963B06CF5A4
SHA-256:	C770B9EE06C46A28F8BE2D8C6779D7C0F86C639F1939B45B157DFB3658F65D69
SHA-512:	A029EF50F31F5A4BDD08F8916687685D7F0EAC0E7B7072C8E3ADD040FA2AB03889F242A4F341711B3DC9557E2AFC28DE5D47B167EB959EA06BAB48A186848A63
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<nvi name="CUDADevelopment_${{version}}" title="${{title}}" version="${{version}}" versionText="${{version}}" timestamp="2024-02-28T16:53:14" hidden="ARP,UI" no-arp="false" disposition="demand" installerMin="2.1002.191.1621" allowsCustomPath="true" preserveCache="false">...<strings>....<string name="version" value="12.4"/>....<string name="altVersion" value="12_4"/>....<string name="DevelopmentRootDir" value="${{ProgramFiles}}\NVIDIA GPU Computing Toolkit\CUDA"/>....<string name="DevelopmentInstallDir" value="${{DevelopmentRootDir}}\v${{version}}"/>....<localized locale="0x0409">.....<string name="title" value="CUDA Development"/>.....<string name="arpDisplayName" value="NVIDIA ${{title}} ${{version}}"/>....</localized>...</strings>...<dependencies>....<package type="requires" package="CUDAToolkit_${{version}}"/>...</dependencies>...<description/>...<properties>....<bool name="FixedInstallLocation" value="true"/>....<string name="InstallLocation"

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	4982576
Entropy (8bit):	2.3019120827094253
Encrypted:	false
SSDEEP:
MD5:	ECC61526B2D5728A5A5AE983DB553EB8
SHA1:	43E378633BF4380BBB397D10A8E45C17418400A6
SHA-256:	1BA1373B332B89D096C65E0DFF564EADEE08E35A08B3141811573810275888F8
SHA-512:	EBB2BC6662D7C15AA7D2D2CB28D60822EC92A4040B3B20325E1F0ED68F4E45B481A1EBADA56527B0B969A9D47D0B286D742C7103C0D2A5F270C281E965EB5F5E
Malicious:	false
Reputation:	low
Preview:	--2024-04-03 08:07:08-- https://developer.download.nvidia.com/compute/cuda/12.4.0/local_installers/cuda_12.4.0_551.61_windows.exe..Resolving developer.download.nvidia.com (developer.download.nvidia.com)... 152.195.19.142..Connecting to developer.download.nvidia.com (developer.download.nvidia.com)\|152.195.19.142\|:443... connected...HTTP request sent, awaiting response... 200 OK..Length: 3190723024 (3.0G) [application/octet-stream]..Saving to: 'C:/Users/user/Desktop/download/cuda_12.4.0_551.61_windows.exe'.... 0K .......... .......... .......... .......... .......... 0% 339K 2h33m.. 50K .......... .......... .......... .......... .......... 0% 491K 2h9m.. 100K .......... .......... .......... .......... .......... 0% 4.27M 90m20s.. 150K .......... .......... .......... .......... .......... 0% 5.02M 70m16s.. 200K .......... .......... .......... .......... .......... 0% 465K 78m32s.. 250K .......... .......... .......... .......... .......... 0% 4.17M 67m28s..

Process:	C:\Windows\SysWOW64\wget.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3190723024
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	D41D8CD98F00B204E9800998ECF8427E
SHA1:	DA39A3EE5E6B4B0D3255BFEF95601890AFD80709
SHA-256:	E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
SHA-512:	CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E
Malicious:	false
Reputation:	low
Preview:

Target ID:	0
Start time:	08:07:08
Start date:	03/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://developer.download.nvidia.com/compute/cuda/12.4.0/local_installers/cuda_12.4.0_551.61_windows.exe" > cmdline.out 2>&1
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	12
Start time:	08:14:32
Start date:	03/04/2024
Path:	C:\Users\user\Desktop\download\cuda_12.4.0_551.61_windows.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\download\cuda_12.4.0_551.61_windows.exe"
Imagebase:	0x400000
File size:	3'190'723'024 bytes
MD5 hash:	A8324145BF4FDF5C09C76A7BFC670B93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://developer.download.nvidia.com/compute/cuda/12.4.0/local_installers/cuda_12.4.0_551.61_windows.exe

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

Compliance

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\cuda\CUDADevelopment\CUDADevelopment.nvi

C:\Users\user\AppData\Local\Temp\cuda\CUDARuntimes\CUDARuntimes.nvi

C:\Users\user\AppData\Local\Temp\cuda\CUDAToolkit\CUDAToolkit.nvi

C:\Users\user\AppData\Local\Temp\cuda\CUDAToolkit\version.json

C:\Users\user\AppData\Local\Temp\cuda\cuda_cccl\thrust\include\cub\agent\agent_adjacent_difference.cuh

C:\Users\user\AppData\Local\Temp\cuda\cuda_cccl\thrust\include\cub\agent\agent_batch_memcpy.cuh

C:\Users\user\AppData\Local\Temp\cuda\cuda_cccl\thrust\include\cub\agent\agent_histogram.cuh

C:\Users\user\AppData\Local\Temp\cuda\cuda_cccl\thrust\include\cub\agent\agent_merge_sort.cuh

C:\Users\user\AppData\Local\Temp\cuda\cuda_cccl\thrust\include\cub\agent\agent_radix_sort_downsweep.cuh

C:\Users\user\AppData\Local\Temp\cuda\cuda_cccl\thrust\include\cub\agent\agent_radix_sort_histogram.cuh

C:\Users\user\AppData\Local\Temp\cuda\cuda_cccl\thrust\include\cub\agent\agent_radix_sort_onesweep.cuh

C:\Users\user\AppData\Local\Temp\cuda\cuda_cccl\thrust\include\cub\agent\agent_radix_sort_upsweep.cuh

C:\Users\user\AppData\Local\Temp\cuda\cuda_cccl\thrust\include\cub\agent\agent_reduce.cuh

C:\Users\user\AppData\Local\Temp\cuda\cuda_cccl\thrust\include\cub\agent\agent_reduce_by_key.cuh

C:\Users\user\AppData\Local\Temp\cuda\cuda_cccl\thrust\include\cub\agent\agent_rle.cuh

C:\Users\user\AppData\Local\Temp\cuda\cuda_cccl\thrust\include\cub\agent\agent_scan.cuh

C:\Users\user\AppData\Local\Temp\cuda\cuda_cccl\thrust\include\cub\agent\agent_scan_by_key.cuh

C:\Users\user\AppData\Local\Temp\cuda\cuda_cccl\thrust\include\cub\agent\agent_segment_fixup.cuh

C:\Users\user\AppData\Local\Temp\cuda\cuda_cccl\thrust\include\cub\agent\agent_segmented_radix_sort.cuh

C:\Users\user\AppData\Local\Temp\cuda\cuda_cccl\thrust\include\cub\agent\agent_select_if.cuh

C:\Users\user\AppData\Local\Temp\cuda\cuda_cccl\thrust\include\cub\agent\agent_spmv_orig.cuh

C:\Users\user\AppData\Local\Temp\cuda\cuda_cccl\thrust\include\cub\agent\agent_sub_warp_merge_sort.cuh

C:\Users\user\AppData\Local\Temp\cuda\cuda_cccl\thrust\include\cub\agent\agent_three_way_partition.cuh

C:\Users\user\AppData\Local\Temp\cuda\cuda_cccl\thrust\include\cub\agent\agent_unique_by_key.cuh

C:\Users\user\AppData\Local\Temp\cuda\cuda_cccl\thrust\include\cub\agent\single_pass_scan_operators.cuh

Windows Analysis Report
https://developer.download.nvidia.com/compute/cuda/12.4.0/local_installers/cuda_12.4.0_551.61_windows.exe

C:\Users\user\AppData\Local\Temp\cuda\cuda_cccl\thrust\include\cuda\std\detail\libcxx\include\concepts\concept_macros.h

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre