Analysis
-
max time kernel
93s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
16-10-2023 15:47
Static task
static1
Behavioral task
behavioral1
Sample
Topaz_Video_AI_3.4.3.exe
Resource
win10v2004-20230915-en
General
-
Target
Topaz_Video_AI_3.4.3.exe
-
Size
406.4MB
-
MD5
00d3bb3e5a8c127a079b8976c6eb7844
-
SHA1
e4367d2275b8b37ad1c4f559df7a0878a10280e9
-
SHA256
65a15af7f6a66238ed04ca56f50114a42ce826d82aceecabf73acffe1becaf04
-
SHA512
260117149b614923d8e6cd5b2c0bccbc65036676c040459d2392ce3286d51ed89f1af3f311aed17a18649c3a94a4b958c52dbb2c834ec852aaf44001370fdf78
-
SSDEEP
6291456:o01j2RF9R7ogkthaeWqK1Bs1mbDyyxPV+5wt81GgidZF/iPQ7pqSX5gvQh6isJ2:oO6dahL6SobDJ+St0iAYFqSXDb
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation Topaz_Video_AI_3.4.3.exe -
Loads dropped DLL 2 IoCs
pid Process 1820 MsiExec.exe 2840 MsiExec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000_Classes\Local Settings Topaz_Video_AI_3.4.3.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1236 msiexec.exe Token: SeIncreaseQuotaPrivilege 1236 msiexec.exe Token: SeSecurityPrivilege 4896 msiexec.exe Token: SeCreateTokenPrivilege 1236 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1236 msiexec.exe Token: SeLockMemoryPrivilege 1236 msiexec.exe Token: SeIncreaseQuotaPrivilege 1236 msiexec.exe Token: SeMachineAccountPrivilege 1236 msiexec.exe Token: SeTcbPrivilege 1236 msiexec.exe Token: SeSecurityPrivilege 1236 msiexec.exe Token: SeTakeOwnershipPrivilege 1236 msiexec.exe Token: SeLoadDriverPrivilege 1236 msiexec.exe Token: SeSystemProfilePrivilege 1236 msiexec.exe Token: SeSystemtimePrivilege 1236 msiexec.exe Token: SeProfSingleProcessPrivilege 1236 msiexec.exe Token: SeIncBasePriorityPrivilege 1236 msiexec.exe Token: SeCreatePagefilePrivilege 1236 msiexec.exe Token: SeCreatePermanentPrivilege 1236 msiexec.exe Token: SeBackupPrivilege 1236 msiexec.exe Token: SeRestorePrivilege 1236 msiexec.exe Token: SeShutdownPrivilege 1236 msiexec.exe Token: SeDebugPrivilege 1236 msiexec.exe Token: SeAuditPrivilege 1236 msiexec.exe Token: SeSystemEnvironmentPrivilege 1236 msiexec.exe Token: SeChangeNotifyPrivilege 1236 msiexec.exe Token: SeRemoteShutdownPrivilege 1236 msiexec.exe Token: SeUndockPrivilege 1236 msiexec.exe Token: SeSyncAgentPrivilege 1236 msiexec.exe Token: SeEnableDelegationPrivilege 1236 msiexec.exe Token: SeManageVolumePrivilege 1236 msiexec.exe Token: SeImpersonatePrivilege 1236 msiexec.exe Token: SeCreateGlobalPrivilege 1236 msiexec.exe Token: SeCreateTokenPrivilege 1236 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1236 msiexec.exe Token: SeLockMemoryPrivilege 1236 msiexec.exe Token: SeIncreaseQuotaPrivilege 1236 msiexec.exe Token: SeMachineAccountPrivilege 1236 msiexec.exe Token: SeTcbPrivilege 1236 msiexec.exe Token: SeSecurityPrivilege 1236 msiexec.exe Token: SeTakeOwnershipPrivilege 1236 msiexec.exe Token: SeLoadDriverPrivilege 1236 msiexec.exe Token: SeSystemProfilePrivilege 1236 msiexec.exe Token: SeSystemtimePrivilege 1236 msiexec.exe Token: SeProfSingleProcessPrivilege 1236 msiexec.exe Token: SeIncBasePriorityPrivilege 1236 msiexec.exe Token: SeCreatePagefilePrivilege 1236 msiexec.exe Token: SeCreatePermanentPrivilege 1236 msiexec.exe Token: SeBackupPrivilege 1236 msiexec.exe Token: SeRestorePrivilege 1236 msiexec.exe Token: SeShutdownPrivilege 1236 msiexec.exe Token: SeDebugPrivilege 1236 msiexec.exe Token: SeAuditPrivilege 1236 msiexec.exe Token: SeSystemEnvironmentPrivilege 1236 msiexec.exe Token: SeChangeNotifyPrivilege 1236 msiexec.exe Token: SeRemoteShutdownPrivilege 1236 msiexec.exe Token: SeUndockPrivilege 1236 msiexec.exe Token: SeSyncAgentPrivilege 1236 msiexec.exe Token: SeEnableDelegationPrivilege 1236 msiexec.exe Token: SeManageVolumePrivilege 1236 msiexec.exe Token: SeImpersonatePrivilege 1236 msiexec.exe Token: SeCreateGlobalPrivilege 1236 msiexec.exe Token: SeCreateTokenPrivilege 1236 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1236 msiexec.exe Token: SeLockMemoryPrivilege 1236 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1236 msiexec.exe 1236 msiexec.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2552 wrote to memory of 1236 2552 Topaz_Video_AI_3.4.3.exe 91 PID 2552 wrote to memory of 1236 2552 Topaz_Video_AI_3.4.3.exe 91 PID 4896 wrote to memory of 1820 4896 msiexec.exe 94 PID 4896 wrote to memory of 1820 4896 msiexec.exe 94 PID 4896 wrote to memory of 2840 4896 msiexec.exe 95 PID 4896 wrote to memory of 2840 4896 msiexec.exe 95 PID 4896 wrote to memory of 2840 4896 msiexec.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\Topaz_Video_AI_3.4.3.exe"C:\Users\Admin\AppData\Local\Temp\Topaz_Video_AI_3.4.3.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX0\TopazVideoAI.msi"2⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1236
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 51507861E13A152C299BF07741EEBEFC C2⤵
- Loads dropped DLL
PID:1820
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 23BA1A59C27E93879B22158E651F065C C2⤵
- Loads dropped DLL
PID:2840
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
113KB
MD54fdd16752561cf585fed1506914d73e0
SHA1f00023b9ae3c8ce5b7bb92f25011eaebe6f9d424
SHA256aecd2d2fe766f6d439acc2bbf1346930ecc535012cf5ad7b3273d2875237b7e7
SHA5123695e7eb1e35ec959243a91ab5b4454eb59aeef0f2699aa5de8e03de8fbb89f756a89130526da5c08815408cb700284a17936522ad2cad594c3e6e9d18a3f600
-
Filesize
113KB
MD54fdd16752561cf585fed1506914d73e0
SHA1f00023b9ae3c8ce5b7bb92f25011eaebe6f9d424
SHA256aecd2d2fe766f6d439acc2bbf1346930ecc535012cf5ad7b3273d2875237b7e7
SHA5123695e7eb1e35ec959243a91ab5b4454eb59aeef0f2699aa5de8e03de8fbb89f756a89130526da5c08815408cb700284a17936522ad2cad594c3e6e9d18a3f600
-
Filesize
342B
MD501f19c82237d0faf3ced58c85e46c875
SHA1b0dd343b55d04afc224389dfca9441244c969a36
SHA2565adbbe36b5b6f42e5c1a809cb403a551dc793ea93a9ef6b4dbac2fce9309afe1
SHA51265179590bc15c574efb097627cd17d8c0ec534b491669c1fd6b0105b423b222c3f831740947ea8628bc8a4f298dc34a0b09c07722418c60a5270665a3fbbbb42
-
Filesize
1.0MB
MD5f1259d876672581f45669fb816a09991
SHA1fe8025d7fb369fc2db2061a7b2b73652cb8a634b
SHA256e527f37b4b30183fcf33430e16d4d349c0b8be16db84262300ddd0879107c0ce
SHA512b134d6f94846f731c8db1f06cf7e1ca911bbffc3790f14a057ab5c08f0911a768f2f0f922cbb61c13b5fe45acd70ed4d0eaee8a13563bcbc8a22991777d4e0da
-
Filesize
1.0MB
MD5f1259d876672581f45669fb816a09991
SHA1fe8025d7fb369fc2db2061a7b2b73652cb8a634b
SHA256e527f37b4b30183fcf33430e16d4d349c0b8be16db84262300ddd0879107c0ce
SHA512b134d6f94846f731c8db1f06cf7e1ca911bbffc3790f14a057ab5c08f0911a768f2f0f922cbb61c13b5fe45acd70ed4d0eaee8a13563bcbc8a22991777d4e0da
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\PFiles\Topaz Labs LLC\Topaz Video AI\QtQuick\Controls\Basic\HorizontalHeaderView.qml
Filesize2KB
MD5729da346822097b64b0baeefb608b23d
SHA1094e9772b61cd39a985e26be881baabb987f0484
SHA25694dc7303d79663e718cb80e2c4f8efe4296e674028a9fe070c6b0c1e08912a9b
SHA5128c0afca49fe70f305785477fc974884beb4c8de53b066228ac061495ef5908711bc3db981178cdf5fece97991544df344262de70a19a7c3be9945d7cd78455a7
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\PFiles\Topaz Labs LLC\Topaz Video AI\QtQuick\Controls\Basic\VerticalHeaderView.qml
Filesize2KB
MD5786e00ad4e57b0e8ec7d6b6c3f1bb6b1
SHA1fb76c671a39a8d2bfceab32496377f9128089cab
SHA25699398e31b15a50b0f732df1ce57ac6188bba74cde4d8f3a1b89472f17ede8cf3
SHA512008bbb35b06b8685055f688f41e942fce403fc99d3196c3fb4e1edf4f5ebb6cd961b84af85ea2991fff39fa742068d5079065161bfb75c8953a6fd0b8bcef09e
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\PFiles\Topaz Labs LLC\Topaz Video AI\QtQuick\Controls\Universal\ScrollView.qml
Filesize2KB
MD5f1e2efb116676f2be55544728a2c801d
SHA1911007385286892ec1577383d50753614904fff1
SHA2564b3d36eff8e5e2c8b50b876d5b4c426dd966d7b820412bd4e56d09c1ad17f663
SHA512f2f0cdc1095dfeeae1c2a4b379c6f09f7a8c1b6f2ce1503cadd5558b2e24ee0f1ae4ad97bdf5d1f8c34954278a00461159e59b2bdca26a413c03e8616dd4da74
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\PFiles\Topaz Labs LLC\Topaz Video AI\QtQuick\Controls\Windows\plugins.qmltypes
Filesize215B
MD52006d4b7d0da455aa4c7414653c0018a
SHA16685b8360b97799aa4d6b18789bf84a343e9e891
SHA256a96c7bf5832767bdc9d91e2290a3920aec3abfbf2e3814bce38b49483f16f84a
SHA512703804e6fab0cf44317b7292c547a1348e2e7395e4b71367c32c3b097bcfb3344d3296179bf4ba33a4c752ae58a3873af57d8cdef35a34564205356bb4e6fd84
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\PFiles\Topaz Labs LLC\Topaz Video AI\share\doc\ffmpeg\ffmpeg-all.html
Filesize2.5MB
MD5a7237d179b7b29cc041752430613c234
SHA1d4891b42e1d24edf1a45b75a4fbf707323a1dbd3
SHA2569cc838ae2dd6e26b525acad0ebe3fadc514f008b145c39ee1d558bb8224368a8
SHA51275b43851ccad9b31c48b395f3e5981f6fa8d52cabe08331be9e2a1a76c394acb4ed25b10e4973914e3d118c416bad9d3c0b239a17cee4e4a786c84f6dfcaeed7
-
Filesize
18KB
MD550177b134dd358cbeaf3cb6f8c0f8ef1
SHA1765b863c0997f8107642eb5a3d938751c3be3c0f
SHA2569cb77a23b83090d84fcc24c913ae43750af2b2a7ed507e942938d5d64f0fa139
SHA512afd7154a8c5312201fdbd5513cd9d3c0f8c54ba7860f3988124a9112ff951ab4b2ae017c8b6f9b73ad2d1fd70b009f531f4818411d650f9b8f9caadafe6ac099
-
Filesize
17KB
MD5f9b623d7c730da4094135d912a1de0ee
SHA177340190f766d33f56f3cabed07812d66dd76c17
SHA25647c35bf6f06f9dd9c1d5891fd644a6f429b75d53573b2ba446904ed9bc7cb50f
SHA51258aeee6b9b7d0e4ab6c522674c047436fe0b02ae42707db9840fdcefa95d6209b01fdf1446c7179db70bd5f50a7f9ea1596848de17dbfb90ab13744fc54380ee
-
Filesize
17KB
MD5a48a5e8159cd5107bdbc416f2ffadcb0
SHA121d76c2b90bcf8d024e5e75dca8c74c40532ba43
SHA2569421b54479b00c7e92f57cc10682888338d51605e9f468b98406bccb90377a81
SHA512e33ffa08f3b99d477d01dba899062194c193c8be7c52583c2734f38f2db030eb90f5a9c35c25d72b99a06062e81d38e50058d59848e27098eae4b78cdf1ae6e3
-
Filesize
7KB
MD58f09741fe94fb56985e2c4ab29765ac7
SHA1d2c00d99b5a3bac2e20d753ffb22eb060accb05c
SHA256ffd2aa0d3b7f79af0eca1466a6706bd3a48464e044c58be9017cb25bf274c5e2
SHA51275e2bcff478741479b5e659a3c7d28aad9d5e1aea6e8bf10dc586bebf1bce658d154778335c48a5aa73bab13b467e9b4aab26accef11b283f327f42197b81b6c
-
Filesize
6KB
MD51a5e834be6288b8a20bdb3b11b32d3f3
SHA14389579b46fb980f32f701954943ec0fbb4ec74b
SHA256198c91a0217515db394c711f45abbfe3929d3d893ff11f95ac677c4f8045a8c7
SHA51201de4e7506b2b36cf415cb72e71d3f546606468b9e2c4df79992bf61aef808015b427a371b82b9d9868fec0ab5dc63132b8e99c791c8e1ea915a724cc60c8001
-
Filesize
15KB
MD5396ad0e28cc588f4904c95f5d3d67f3a
SHA1053727da888f84ff53112a5f90da0ec29419f490
SHA25623bc394b51bb0b915fb675227855a93027bf6673a8847f319f9d6fab67546c59
SHA5129b9e92e75ebebcf1315ec3a3680c7ff73ecc82db041377f882f39b4d37d77b6abdce262a91f2c888dab61b5157364dbc0ff755a1804c3f535b8974c88775a68c
-
Filesize
22KB
MD5c8f04b43ed28ba45080aa4181e472264
SHA1a8a9a0c88ab6922b4c97396befaf1b43ba172570
SHA256727c13dc13225332be70bca52396f5f4ff4c65fd6967328a5dd147b3d5554888
SHA512565a2ae516f341ae823e74df61abf85d06f0218d1ee6545d6805f19f1ece5aab82e17f614e2cb40468ae5b38b3215d8f216d008341bcfce5918160797a8beeed
-
Filesize
6KB
MD5779264efa69beccf5bb21a4136e589bc
SHA1bcbbeb3e1cddb709ccae13078f5f13ac882624cf
SHA2563ca317c51a2d7f3d7f0516aefdca3285ae2a453d8c9eb3ca10d34066bb671989
SHA512086eb9c37a772264fd70321b76c2b2b5c9a81fec616f796fdb12261ea4876380ec1392de32e2f27a97f32c4b5f8dbb5a886481542beb6b4035a964775f88c27b
-
Filesize
30KB
MD5968e50270e3d9a1121470046b32f3a02
SHA1687e291709e434c50e225da878c507161d5d3d1d
SHA256951ad678c0a5a3d4c11e2d54c2b50784706ddc71278c033f63ab3ec603904d01
SHA512d18807e56a99e53d356f5f3372ba049c7dbdd836811de539030b496ca982a75ba2489081ea159863db139356456ca9f4a0c48f9b5c954b6595c5a4fb1e73d61b
-
Filesize
3.0MB
MD552ee1538e4227f64c99812f3e139df88
SHA1dc39887feecf012a539136e34f83744e81d86f5d
SHA256689b3c5a1417322f3f4b5f6bb6f347fe722f7a2c913ff8a5e34f66d02ca5ce67
SHA512f78e85bfb544a00c1e5baa1e06ce58e33393a554450f4f607d40eae76505fe9e2e528cd2782a8c3f6cf3258f4447ad270e694c909eecd19984f2d98299344d9b
-
Filesize
3.0MB
MD552ee1538e4227f64c99812f3e139df88
SHA1dc39887feecf012a539136e34f83744e81d86f5d
SHA256689b3c5a1417322f3f4b5f6bb6f347fe722f7a2c913ff8a5e34f66d02ca5ce67
SHA512f78e85bfb544a00c1e5baa1e06ce58e33393a554450f4f607d40eae76505fe9e2e528cd2782a8c3f6cf3258f4447ad270e694c909eecd19984f2d98299344d9b