Analysis

  • max time kernel
    93s
  • max time network
    132s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-10-2023 15:47

General

  • Target

    Topaz_Video_AI_3.4.3.exe

  • Size

    406.4MB

  • MD5

    00d3bb3e5a8c127a079b8976c6eb7844

  • SHA1

    e4367d2275b8b37ad1c4f559df7a0878a10280e9

  • SHA256

    65a15af7f6a66238ed04ca56f50114a42ce826d82aceecabf73acffe1becaf04

  • SHA512

    260117149b614923d8e6cd5b2c0bccbc65036676c040459d2392ce3286d51ed89f1af3f311aed17a18649c3a94a4b958c52dbb2c834ec852aaf44001370fdf78

  • SSDEEP

    6291456:o01j2RF9R7ogkthaeWqK1Bs1mbDyyxPV+5wt81GgidZF/iPQ7pqSX5gvQh6isJ2:oO6dahL6SobDJ+St0iAYFqSXDb

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 2 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Topaz_Video_AI_3.4.3.exe
    "C:\Users\Admin\AppData\Local\Temp\Topaz_Video_AI_3.4.3.exe"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2552
    • C:\Windows\System32\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX0\TopazVideoAI.msi"
      2⤵
      • Enumerates connected drives
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:1236
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4896
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding 51507861E13A152C299BF07741EEBEFC C
      2⤵
      • Loads dropped DLL
      PID:1820
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 23BA1A59C27E93879B22158E651F065C C
      2⤵
      • Loads dropped DLL
      PID:2840

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\MSI2B9B.tmp

    Filesize

    113KB

    MD5

    4fdd16752561cf585fed1506914d73e0

    SHA1

    f00023b9ae3c8ce5b7bb92f25011eaebe6f9d424

    SHA256

    aecd2d2fe766f6d439acc2bbf1346930ecc535012cf5ad7b3273d2875237b7e7

    SHA512

    3695e7eb1e35ec959243a91ab5b4454eb59aeef0f2699aa5de8e03de8fbb89f756a89130526da5c08815408cb700284a17936522ad2cad594c3e6e9d18a3f600

  • C:\Users\Admin\AppData\Local\Temp\MSI2B9B.tmp

    Filesize

    113KB

    MD5

    4fdd16752561cf585fed1506914d73e0

    SHA1

    f00023b9ae3c8ce5b7bb92f25011eaebe6f9d424

    SHA256

    aecd2d2fe766f6d439acc2bbf1346930ecc535012cf5ad7b3273d2875237b7e7

    SHA512

    3695e7eb1e35ec959243a91ab5b4454eb59aeef0f2699aa5de8e03de8fbb89f756a89130526da5c08815408cb700284a17936522ad2cad594c3e6e9d18a3f600

  • C:\Users\Admin\AppData\Local\Temp\MSI8d176.LOG

    Filesize

    342B

    MD5

    01f19c82237d0faf3ced58c85e46c875

    SHA1

    b0dd343b55d04afc224389dfca9441244c969a36

    SHA256

    5adbbe36b5b6f42e5c1a809cb403a551dc793ea93a9ef6b4dbac2fce9309afe1

    SHA512

    65179590bc15c574efb097627cd17d8c0ec534b491669c1fd6b0105b423b222c3f831740947ea8628bc8a4f298dc34a0b09c07722418c60a5270665a3fbbbb42

  • C:\Users\Admin\AppData\Local\Temp\MSICFFD.tmp

    Filesize

    1.0MB

    MD5

    f1259d876672581f45669fb816a09991

    SHA1

    fe8025d7fb369fc2db2061a7b2b73652cb8a634b

    SHA256

    e527f37b4b30183fcf33430e16d4d349c0b8be16db84262300ddd0879107c0ce

    SHA512

    b134d6f94846f731c8db1f06cf7e1ca911bbffc3790f14a057ab5c08f0911a768f2f0f922cbb61c13b5fe45acd70ed4d0eaee8a13563bcbc8a22991777d4e0da

  • C:\Users\Admin\AppData\Local\Temp\MSICFFD.tmp

    Filesize

    1.0MB

    MD5

    f1259d876672581f45669fb816a09991

    SHA1

    fe8025d7fb369fc2db2061a7b2b73652cb8a634b

    SHA256

    e527f37b4b30183fcf33430e16d4d349c0b8be16db84262300ddd0879107c0ce

    SHA512

    b134d6f94846f731c8db1f06cf7e1ca911bbffc3790f14a057ab5c08f0911a768f2f0f922cbb61c13b5fe45acd70ed4d0eaee8a13563bcbc8a22991777d4e0da

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\PFiles\Topaz Labs LLC\Topaz Video AI\QtQuick\Controls\Basic\HorizontalHeaderView.qml

    Filesize

    2KB

    MD5

    729da346822097b64b0baeefb608b23d

    SHA1

    094e9772b61cd39a985e26be881baabb987f0484

    SHA256

    94dc7303d79663e718cb80e2c4f8efe4296e674028a9fe070c6b0c1e08912a9b

    SHA512

    8c0afca49fe70f305785477fc974884beb4c8de53b066228ac061495ef5908711bc3db981178cdf5fece97991544df344262de70a19a7c3be9945d7cd78455a7

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\PFiles\Topaz Labs LLC\Topaz Video AI\QtQuick\Controls\Basic\VerticalHeaderView.qml

    Filesize

    2KB

    MD5

    786e00ad4e57b0e8ec7d6b6c3f1bb6b1

    SHA1

    fb76c671a39a8d2bfceab32496377f9128089cab

    SHA256

    99398e31b15a50b0f732df1ce57ac6188bba74cde4d8f3a1b89472f17ede8cf3

    SHA512

    008bbb35b06b8685055f688f41e942fce403fc99d3196c3fb4e1edf4f5ebb6cd961b84af85ea2991fff39fa742068d5079065161bfb75c8953a6fd0b8bcef09e

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\PFiles\Topaz Labs LLC\Topaz Video AI\QtQuick\Controls\Universal\ScrollView.qml

    Filesize

    2KB

    MD5

    f1e2efb116676f2be55544728a2c801d

    SHA1

    911007385286892ec1577383d50753614904fff1

    SHA256

    4b3d36eff8e5e2c8b50b876d5b4c426dd966d7b820412bd4e56d09c1ad17f663

    SHA512

    f2f0cdc1095dfeeae1c2a4b379c6f09f7a8c1b6f2ce1503cadd5558b2e24ee0f1ae4ad97bdf5d1f8c34954278a00461159e59b2bdca26a413c03e8616dd4da74

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\PFiles\Topaz Labs LLC\Topaz Video AI\QtQuick\Controls\Windows\plugins.qmltypes

    Filesize

    215B

    MD5

    2006d4b7d0da455aa4c7414653c0018a

    SHA1

    6685b8360b97799aa4d6b18789bf84a343e9e891

    SHA256

    a96c7bf5832767bdc9d91e2290a3920aec3abfbf2e3814bce38b49483f16f84a

    SHA512

    703804e6fab0cf44317b7292c547a1348e2e7395e4b71367c32c3b097bcfb3344d3296179bf4ba33a4c752ae58a3873af57d8cdef35a34564205356bb4e6fd84

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\PFiles\Topaz Labs LLC\Topaz Video AI\share\doc\ffmpeg\ffmpeg-all.html

    Filesize

    2.5MB

    MD5

    a7237d179b7b29cc041752430613c234

    SHA1

    d4891b42e1d24edf1a45b75a4fbf707323a1dbd3

    SHA256

    9cc838ae2dd6e26b525acad0ebe3fadc514f008b145c39ee1d558bb8224368a8

    SHA512

    75b43851ccad9b31c48b395f3e5981f6fa8d52cabe08331be9e2a1a76c394acb4ed25b10e4973914e3d118c416bad9d3c0b239a17cee4e4a786c84f6dfcaeed7

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Topaz Labs LLC\Topaz Video AI\models\ahq-11.json

    Filesize

    18KB

    MD5

    50177b134dd358cbeaf3cb6f8c0f8ef1

    SHA1

    765b863c0997f8107642eb5a3d938751c3be3c0f

    SHA256

    9cb77a23b83090d84fcc24c913ae43750af2b2a7ed507e942938d5d64f0fa139

    SHA512

    afd7154a8c5312201fdbd5513cd9d3c0f8c54ba7860f3988124a9112ff951ab4b2ae017c8b6f9b73ad2d1fd70b009f531f4818411d650f9b8f9caadafe6ac099

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Topaz Labs LLC\Topaz Video AI\models\alq-13.json

    Filesize

    17KB

    MD5

    f9b623d7c730da4094135d912a1de0ee

    SHA1

    77340190f766d33f56f3cabed07812d66dd76c17

    SHA256

    47c35bf6f06f9dd9c1d5891fd644a6f429b75d53573b2ba446904ed9bc7cb50f

    SHA512

    58aeee6b9b7d0e4ab6c522674c047436fe0b02ae42707db9840fdcefa95d6209b01fdf1446c7179db70bd5f50a7f9ea1596848de17dbfb90ab13744fc54380ee

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Topaz Labs LLC\Topaz Video AI\models\amqs-2.json

    Filesize

    17KB

    MD5

    a48a5e8159cd5107bdbc416f2ffadcb0

    SHA1

    21d76c2b90bcf8d024e5e75dca8c74c40532ba43

    SHA256

    9421b54479b00c7e92f57cc10682888338d51605e9f468b98406bccb90377a81

    SHA512

    e33ffa08f3b99d477d01dba899062194c193c8be7c52583c2734f38f2db030eb90f5a9c35c25d72b99a06062e81d38e50058d59848e27098eae4b78cdf1ae6e3

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Topaz Labs LLC\Topaz Video AI\models\apo-7.json

    Filesize

    7KB

    MD5

    8f09741fe94fb56985e2c4ab29765ac7

    SHA1

    d2c00d99b5a3bac2e20d753ffb22eb060accb05c

    SHA256

    ffd2aa0d3b7f79af0eca1466a6706bd3a48464e044c58be9017cb25bf274c5e2

    SHA512

    75e2bcff478741479b5e659a3c7d28aad9d5e1aea6e8bf10dc586bebf1bce658d154778335c48a5aa73bab13b467e9b4aab26accef11b283f327f42197b81b6c

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Topaz Labs LLC\Topaz Video AI\models\chf-1.json

    Filesize

    6KB

    MD5

    1a5e834be6288b8a20bdb3b11b32d3f3

    SHA1

    4389579b46fb980f32f701954943ec0fbb4ec74b

    SHA256

    198c91a0217515db394c711f45abbfe3929d3d893ff11f95ac677c4f8045a8c7

    SHA512

    01de4e7506b2b36cf415cb72e71d3f546606468b9e2c4df79992bf61aef808015b427a371b82b9d9868fec0ab5dc63132b8e99c791c8e1ea915a724cc60c8001

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Topaz Labs LLC\Topaz Video AI\models\gcg-5.json

    Filesize

    15KB

    MD5

    396ad0e28cc588f4904c95f5d3d67f3a

    SHA1

    053727da888f84ff53112a5f90da0ec29419f490

    SHA256

    23bc394b51bb0b915fb675227855a93027bf6673a8847f319f9d6fab67546c59

    SHA512

    9b9e92e75ebebcf1315ec3a3680c7ff73ecc82db041377f882f39b4d37d77b6abdce262a91f2c888dab61b5157364dbc0ff755a1804c3f535b8974c88775a68c

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Topaz Labs LLC\Topaz Video AI\models\prob-1.json

    Filesize

    22KB

    MD5

    c8f04b43ed28ba45080aa4181e472264

    SHA1

    a8a9a0c88ab6922b4c97396befaf1b43ba172570

    SHA256

    727c13dc13225332be70bca52396f5f4ff4c65fd6967328a5dd147b3d5554888

    SHA512

    565a2ae516f341ae823e74df61abf85d06f0218d1ee6545d6805f19f1ece5aab82e17f614e2cb40468ae5b38b3215d8f216d008341bcfce5918160797a8beeed

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Topaz Labs LLC\Topaz Video AI\models\thm-1.json

    Filesize

    6KB

    MD5

    779264efa69beccf5bb21a4136e589bc

    SHA1

    bcbbeb3e1cddb709ccae13078f5f13ac882624cf

    SHA256

    3ca317c51a2d7f3d7f0516aefdca3285ae2a453d8c9eb3ca10d34066bb671989

    SHA512

    086eb9c37a772264fd70321b76c2b2b5c9a81fec616f796fdb12261ea4876380ec1392de32e2f27a97f32c4b5f8dbb5a886481542beb6b4035a964775f88c27b

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Topaz Labs LLC\Topaz Video AI\oss-licenses.txt

    Filesize

    30KB

    MD5

    968e50270e3d9a1121470046b32f3a02

    SHA1

    687e291709e434c50e225da878c507161d5d3d1d

    SHA256

    951ad678c0a5a3d4c11e2d54c2b50784706ddc71278c033f63ab3ec603904d01

    SHA512

    d18807e56a99e53d356f5f3372ba049c7dbdd836811de539030b496ca982a75ba2489081ea159863db139356456ca9f4a0c48f9b5c954b6595c5a4fb1e73d61b

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\TopazVideoAI.msi

    Filesize

    3.0MB

    MD5

    52ee1538e4227f64c99812f3e139df88

    SHA1

    dc39887feecf012a539136e34f83744e81d86f5d

    SHA256

    689b3c5a1417322f3f4b5f6bb6f347fe722f7a2c913ff8a5e34f66d02ca5ce67

    SHA512

    f78e85bfb544a00c1e5baa1e06ce58e33393a554450f4f607d40eae76505fe9e2e528cd2782a8c3f6cf3258f4447ad270e694c909eecd19984f2d98299344d9b

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\TopazVideoAI.msi

    Filesize

    3.0MB

    MD5

    52ee1538e4227f64c99812f3e139df88

    SHA1

    dc39887feecf012a539136e34f83744e81d86f5d

    SHA256

    689b3c5a1417322f3f4b5f6bb6f347fe722f7a2c913ff8a5e34f66d02ca5ce67

    SHA512

    f78e85bfb544a00c1e5baa1e06ce58e33393a554450f4f607d40eae76505fe9e2e528cd2782a8c3f6cf3258f4447ad270e694c909eecd19984f2d98299344d9b