Analysis

  • max time kernel
    0s
  • max time network
    37s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/10/2023, 16:33

General

  • Target

    Microsoft.HEVCVideoExtension_8wekyb3d8bbwe.x64.appx

  • Size

    2.8MB

  • MD5

    09c88618e906359c2cd954cf17d93d20

  • SHA1

    c1d33c313522f786aca03f14a3b964e7317dc359

  • SHA256

    34725c932f8182e94d7dbe71fb1d9be1e97fabefb69c91cc52410b34d5f71db0

  • SHA512

    7950d13180f1682305fc7e1ab8ce7b4ccb8e85181b0eb339a330d59a4f9eb0e247abb477dcd547b1759a5f056c58ba3b8051e28e312fd6429d6832a7dedb239a

  • SSDEEP

    49152:8Ny40/+o2dsR13K8FKYThb+HWa/ihnus4RLr1YtGqDlebvFYzuWgccnA:8Ny40/Wdo6WTFa/iQ1RVYIi4beupcf

Score
1/10

Malware Config

Signatures

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell start shell:AppsFolder\Microsoft.HEVCVideoExtension_8wekyb3d8bbwe!App
    1⤵
      PID:3068
    • C:\Windows\system32\Clipup.exe
      "C:\Windows\system32\Clipup.exe" -p -pfm Microsoft.HEVCVideoExtension_8wekyb3d8bbwe
      1⤵
        PID:1964
        • C:\Windows\system32\Clipup.exe
          "C:\Windows\system32\Clipup.exe" -p -pfm Microsoft.HEVCVideoExtension_8wekyb3d8bbwe -ppl C:\Windows\TEMP\tem5C25.tmp
          2⤵
            PID:2312

        Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vjzfdw2u.u44.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • C:\Windows\TEMP\tem5C25.tmp

          Filesize

          32B

          MD5

          3a696dbd1a68a556870c204865719787

          SHA1

          161f8934ed3fc5133b1d3b93c44ee2b8a482725a

          SHA256

          d049946b7e31069d77406134dfcad4cdab5247777b1a560c7719b47f56dcc194

          SHA512

          ffabbfc291f644f9b17df375bf4a1635b584ffcea9f544168e1c5b40ad637d29b86e1e8d6c57075eead2a1e0542508cca43204d3b795d5c290ffa7cbff18e529

        • memory/1964-15-0x000001D03D090000-0x000001D03D0A0000-memory.dmp

          Filesize

          64KB

        • memory/1964-18-0x000001D03D090000-0x000001D03D0A0000-memory.dmp

          Filesize

          64KB

        • memory/1964-28-0x000001D03D090000-0x000001D03D0A0000-memory.dmp

          Filesize

          64KB

        • memory/1964-29-0x000001D03D090000-0x000001D03D0A0000-memory.dmp

          Filesize

          64KB

        • memory/1964-17-0x000001D03D090000-0x000001D03D0A0000-memory.dmp

          Filesize

          64KB

        • memory/2312-26-0x0000019E72200000-0x0000019E72210000-memory.dmp

          Filesize

          64KB

        • memory/2312-22-0x0000019E72200000-0x0000019E72210000-memory.dmp

          Filesize

          64KB

        • memory/2312-19-0x0000019E72200000-0x0000019E72210000-memory.dmp

          Filesize

          64KB

        • memory/2312-25-0x0000019E72200000-0x0000019E72210000-memory.dmp

          Filesize

          64KB

        • memory/2312-24-0x0000019E72200000-0x0000019E72210000-memory.dmp

          Filesize

          64KB

        • memory/2312-21-0x0000019E72200000-0x0000019E72210000-memory.dmp

          Filesize

          64KB

        • memory/3068-14-0x00007FF801750000-0x00007FF802211000-memory.dmp

          Filesize

          10.8MB

        • memory/3068-12-0x0000027A7F310000-0x0000027A7F320000-memory.dmp

          Filesize

          64KB

        • memory/3068-5-0x0000027A7F220000-0x0000027A7F242000-memory.dmp

          Filesize

          136KB

        • memory/3068-11-0x0000027A7F310000-0x0000027A7F320000-memory.dmp

          Filesize

          64KB

        • memory/3068-10-0x00007FF801750000-0x00007FF802211000-memory.dmp

          Filesize

          10.8MB