Evidence and analysis
Evidence index
Selected screenshots, their source tools and the findings they support.
Identity anchors
Recorded hashes identify the studied malware and runtime dumps. Those artifacts are not redistributed.
| Artifact | SHA-256 |
|---|---|
| Campaign ZIP Not republished | 7108FF29916D064216AA2ECE7FB395F1E3A73D12D19895BFFC0BD46806CBF85A |
| Staged IMG Not republished | 38EC1F5E23F65B10AE3027BEABFA0BF7F9FB686355A9E33C7E7E44E6A998E04C |
| Tax_Notice_23665.exe 120,984 bytes | 93DD8B7B393289F88493596FAA4AE70054D9EB4FE47F2DD334F0C6BB5262F2A8 |
| nvdaHelperRemote.dll 455,527 bytes | 7295090C2CB63EBC43F932451971C41F9D015D2741E97AE3D9855F5AE87CFF94 |
| Reconstructed image B PE32 launcher | 46B34789196733FAB62193F0AAEDB198B09F1362F9B10CA1DD70CF81D68B01AD |
| PID 5812 dump 42,481,455 bytes | B67AA7F4176AF9793C0D2C53C12B757C95C213BF827108697ED5B60D2C1ED663 |
| PID 3696 dump 38,687,630 bytes | E635CC1F72112E10FEA9B9B9574FD7D2F7A5D101EDBF3C33B61FDD12071FA49E |
Selected figures
Cropped source screenshots use editorial callouts to identify the relevant regions. Captions identify the observation; the linked technical references explain its interpretation. Diagrams are labelled as reconstructions.
Figure 01 / runtime observation
The installed pair uses a signed host and a separate companion DLL.
Explorer shows Tax_Notice_23665.exe beside nvdaHelperRemote.dll under C:\ProgramData\NVIDIA Corporation\NvSvc. A separate properties view lists an embedded NV Access Limited signature for the host. The signature belongs to the host; this view does not authenticate the companion DLL.
Source: Explorer directory listing and host Digital Signatures properties, captured separately.
Figure 03 / static reconstruction
The recovered B image has a concrete identity.
The image summary identifies the imported PE and its PackClientLauncher PDB name. The recorded SHA-256 identifies recovered image B.
Source: Ghidra program information for recovered image B.
Figure 04 / static reconstruction
The worker opens an existing endpoint.
1. CreateFileW receives the supplied endpoint, read/write access and disposition 3 (OPEN_EXISTING). 2. The READY header uses magic 0x50435231 and type 1. The endpoint namespace and external peer are not recovered.
Source: Ghidra decompilation of the worker endpoint-open and READY path.
Figure 07 / static reconstruction
The recapture branch constructs a type-2 response.
The literal type 2 and the send-helper call are visible in the recovered recapture path. The field semantics and BGRX payload layout come from the linked static dataflow analysis. This is reconstructed code, not a captured live framebuffer.
Source: Ghidra disassembly of the recapture response in image B.
Figure 09 / static reconstruction
Authentication gates decryption.
1. Compute the envelope MAC. 2. Compare the received tag. 3. Enter the decrypt helper only after the comparison succeeds. Helper roles are established in the transport analysis; the screenshot shows their control-flow order.
Source: Ghidra decompilation of the authenticated receive path in image B.
Figure 11 / static reconstruction
The plaintext must pass digest verification, cache save and cache reload.
The recovered transfer body checks the plaintext digest, requires Save to succeed, and immediately requires TryLoad to return a nonempty vector. The visible failure branches are SHA256 mismatch, disk_cache_save_failed and disk_cache_reload_failed. This is statically reconstructed control flow, not evidence of successful delivery.
Source: Ghidra decompilation of image B’s PLK1 acceptance and cache-return path.
Figure 12 / static reconstruction
The active-session path retries a token-based launch.
The recovered call uses CreateProcessAsUserW with flags 0x09000400. The loop sleeps for 1,000 ms after failure and stops after at most 0x1E attempts. This is the active-session helper, not proof of the original chain's elevation API.
Source: Ghidra decompilation of the active-session spawn loop in image B.
Figure 13 / runtime observation
Private executable allocation in svchost.exe, PID 5812.
VMMap shows a 408 KiB Execute/Read allocation at 0x002E0000. Corresponding dump analysis identifies its contents as the transformed A/B package.
Source: VMMap allocation views from the PID 5812 evidence set.
Figure 15 / runtime observation
One parent creates two siblings.
Process Monitor records parent PID 2116 creating svchost PID 3696 and schtasks PID 4600; schtasks then creates conhost PID 8248. SUCCESS is the Process Create result, not the child's exit code.
Source: Process Monitor process-creation rows from the PID 3696 evidence set.
Figure 16 / runtime observation
NvSvc combines an at-logon trigger with a ProgramData action.
Task Scheduler shows NvSvc's enabled at-logon trigger, ProgramData action and configured principal. Highest available privileges for this user do not establish SYSTEM execution.
Source: Task Scheduler action, trigger and principal settings for NvSvc.
Figure 17 / runtime observation
The surviving surrogate has a bare command line.
1. Bare SysWOW64 svchost command line. 2. Parent 2116 has exited. 3. The process is x86. The Downloads\PackClient current directory supplies additional context. These properties support an anomalous surrogate, without identifying an injection subtype.
Source: Process Explorer properties for PID 3696.
Figure 18 / runtime observation
Connection attempts from svchost.exe, PID 3696.
Process Explorer shows two SYN_SENT attempts to 154.36.188.201:443, from local ports 54581 and 50275.
Source: Process Explorer TCP/IP views associated with PID 3696.
Figure 19 / observation · causality unresolved
The debugger is stopped before deletion.
This is the PID 8148 pre-call stop. EAX at this point is not DeleteObject's return value. The image supplies call-site context; it does not prove successful deletion or establish the cause of the later PID 8040 failure.
Source: Debugger breakpoint capture from the PID 8148 attempt.
Figure 20 / observation · causality unresolved
The final worker attempt failed before READY.
The saved record shows an access violation at RVA 0xA567 with EDI=0x13C, followed by a zero-byte READY timeout. The attempt included manual debugger changes, so the crash does not establish a failure in unmodified execution or a causal use-after-free diagnosis.
Source: Debugger and peer-output captures from the PID 8040 attempt.