--- Name: Nvudisp.exe Description: Execute, Copy, Add registry, Create shortcut, kill process Author: '' Created: 2018-05-25 Commands: - Command: Nvudisp.exe System calc.exe Description: Execute calc.exe as a subprocess. - Command: Nvudisp.exe Copy test.txt,test-2.txt Description: Copy fila A to file B. - Command: Nvudisp.exe SetReg HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\malware=malware.exe Description: Add/Edit a Registry key value. - Command: Nvudisp.exe CreateShortcut test.lnk,"Test","c:\windows\system32\calc.exe\","","c:\windows\system32\" Description: Create shortcut file. - Command: Nvudisp.exe KillApp calculator.exe Description: Kill a process. - Command: Nvudisp.exe Run foo Description: Run process Full_Path: - C:\windows\system32\nvuDisp.exe Code_Sample: [] Detection: [] Resources: - http://sysadminconcombre.blogspot.ca/2018/04/run-system-commands-through-nvidia.html Acknowledgement: - Person: Pierre-Alexandre Braeken Handle: '@pabraeken'