Overview
overview
3Static
static
1Microsoft....we.zip
windows7-x64
1Microsoft....we.zip
windows10-2004-x64
1AppxBlockMap.xml
windows7-x64
1AppxBlockMap.xml
windows10-2004-x64
1AppxMetada...st.xml
windows7-x64
1AppxMetada...st.xml
windows10-2004-x64
1AppxSignature.p7x
windows7-x64
3AppxSignature.p7x
windows10-2004-x64
3Microsoft....4.appx
windows7-x64
Microsoft....4.appx
windows10-2004-x64
Microsoft....4.appx
windows7-x64
Microsoft....4.appx
windows10-2004-x64
1Microsoft....6.appx
windows7-x64
Microsoft....6.appx
windows10-2004-x64
1[Content_Types].xml
windows7-x64
1[Content_Types].xml
windows10-2004-x64
1Resubmissions
25/10/2023, 13:58
231025-q979cshd42 125/10/2023, 13:54
231025-q72c2ahc87 325/10/2023, 13:53
231025-q6ywhshc46 1Analysis
-
max time kernel
131s -
max time network
165s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
25/10/2023, 13:54
Static task
static1
Behavioral task
behavioral1
Sample
Microsoft.HEVCVideoExtension_2.0.61931.0_neutral_~_8wekyb3d8bbwe.zip
Resource
win7-20231020-en
windows7-x64
Behavioral task
behavioral2
Sample
Microsoft.HEVCVideoExtension_2.0.61931.0_neutral_~_8wekyb3d8bbwe.zip
Resource
win10v2004-20231023-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
AppxBlockMap.xml
Resource
win7-20231023-en
windows7-x64
Behavioral task
behavioral4
Sample
AppxBlockMap.xml
Resource
win10v2004-20231023-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
AppxMetadata/AppxBundleManifest.xml
Resource
win7-20231020-en
windows7-x64
Behavioral task
behavioral6
Sample
AppxMetadata/AppxBundleManifest.xml
Resource
win10v2004-20231023-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
AppxSignature.p7x
Resource
win7-20231020-en
windows7-x64
Behavioral task
behavioral8
Sample
AppxSignature.p7x
Resource
win10v2004-20231020-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Microsoft.HEVCVideoExtension_8wekyb3d8bbwe.arm64.appx
Resource
win7-20231020-en
windows7-x64
Behavioral task
behavioral10
Sample
Microsoft.HEVCVideoExtension_8wekyb3d8bbwe.arm64.appx
Resource
win10v2004-20231023-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Microsoft.HEVCVideoExtension_8wekyb3d8bbwe.x64.appx
Resource
win7-20231023-en
windows7-x64
Behavioral task
behavioral12
Sample
Microsoft.HEVCVideoExtension_8wekyb3d8bbwe.x64.appx
Resource
win10v2004-20231020-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Microsoft.HEVCVideoExtension_8wekyb3d8bbwe.x86.appx
Resource
win7-20231023-en
windows7-x64
Behavioral task
behavioral14
Sample
Microsoft.HEVCVideoExtension_8wekyb3d8bbwe.x86.appx
Resource
win10v2004-20231023-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
[Content_Types].xml
Resource
win7-20231020-en
windows7-x64
Behavioral task
behavioral16
Sample
[Content_Types].xml
Resource
win10v2004-20231023-en
windows10-2004-x64
General
-
Target
Microsoft.HEVCVideoExtension_2.0.61931.0_neutral_~_8wekyb3d8bbwe.zip
-
Size
8.1MB
-
MD5
66c42eaf72fb5778ef9eec0609f13070
-
SHA1
4e747e31ccd2f883486f2fb76e35cbd3e49b84e6
-
SHA256
fbcfbc9ed5c1777946b0dad7a5813377960a134e9907d3e0669804d273defe90
-
SHA512
98d70e19ea07546484a42d22b8b82a724f67c88c383935aa697e1c256c668794962bafb29b2881c0e5e675a07c2c0660aaf24dfe8c42cf851ad59fe0b710cbd5
-
SSDEEP
196608:Rw3gZStNz0/Wdo1gY1HVYEpGupq0/Wdo1FY1RVYEeupuGVYEbup17:hMti/Wyzxoupr/Wy4reupfbuph
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 56 IoCs
pid Process 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe -
Suspicious behavior: LoadsDriver 6 IoCs
pid Process 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 668 Process not Found -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1444 taskmgr.exe Token: SeSystemProfilePrivilege 1444 taskmgr.exe Token: SeCreateGlobalPrivilege 1444 taskmgr.exe Token: 33 1444 taskmgr.exe Token: SeIncBasePriorityPrivilege 1444 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Microsoft.HEVCVideoExtension_2.0.61931.0_neutral_~_8wekyb3d8bbwe.zip1⤵PID:2140
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1444