Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-1703_x64 -
resource
win10-20231023-en -
resource tags
arch:x64arch:x86image:win10-20231023-enlocale:en-usos:windows10-1703-x64system -
submitted
29-10-2023 15:45
Behavioral task
behavioral1
Sample
Sony Vegas Pro 19.exe
Resource
win10-20231023-en
4 signatures
150 seconds
General
-
Target
Sony Vegas Pro 19.exe
-
Size
36KB
-
MD5
32520b16f67a75d2ebae63c1f2a08512
-
SHA1
3f35fb6bd7ae2c8bee68aadcae3beb423be31d7d
-
SHA256
b6805cae76c347c964fb6e5e2fad475d0fd7aeb6a7c0e19b336d5e3e10fbc47b
-
SHA512
8b89f9dc228acf11e5ac3d1bc925c9f8656daaa47733482cc5858f17deff069ced0d850388f968f1fb8dbd834997c5afbfedde6edacfb9b499845f019990053e
-
SSDEEP
384:GLJuxgLXeA03/lvHWtfequqP9BR3MpAQk93vmhm7UMKmIEecKdbXTzm9bVhcau6s:gJ6kuPsOpA/vMHTi9bD0DjwQdG/Q
Score
7/10
Malware Config
Signatures
-
Drops startup file 3 IoCs
Processes:
Sony Vegas Pro 19.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk Sony Vegas Pro 19.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe Sony Vegas Pro 19.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe Sony Vegas Pro 19.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
Sony Vegas Pro 19.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL" Sony Vegas Pro 19.exe Set value (str) \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows2 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL" Sony Vegas Pro 19.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows2 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL" Sony Vegas Pro 19.exe Set value (str) \REGISTRY\USER\S-1-5-21-2184424523-918736138-622003966-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL" Sony Vegas Pro 19.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 33 IoCs
Processes:
Sony Vegas Pro 19.exedescription pid process Token: SeDebugPrivilege 1776 Sony Vegas Pro 19.exe Token: 33 1776 Sony Vegas Pro 19.exe Token: SeIncBasePriorityPrivilege 1776 Sony Vegas Pro 19.exe Token: 33 1776 Sony Vegas Pro 19.exe Token: SeIncBasePriorityPrivilege 1776 Sony Vegas Pro 19.exe Token: 33 1776 Sony Vegas Pro 19.exe Token: SeIncBasePriorityPrivilege 1776 Sony Vegas Pro 19.exe Token: 33 1776 Sony Vegas Pro 19.exe Token: SeIncBasePriorityPrivilege 1776 Sony Vegas Pro 19.exe Token: 33 1776 Sony Vegas Pro 19.exe Token: SeIncBasePriorityPrivilege 1776 Sony Vegas Pro 19.exe Token: 33 1776 Sony Vegas Pro 19.exe Token: SeIncBasePriorityPrivilege 1776 Sony Vegas Pro 19.exe Token: 33 1776 Sony Vegas Pro 19.exe Token: SeIncBasePriorityPrivilege 1776 Sony Vegas Pro 19.exe Token: 33 1776 Sony Vegas Pro 19.exe Token: SeIncBasePriorityPrivilege 1776 Sony Vegas Pro 19.exe Token: 33 1776 Sony Vegas Pro 19.exe Token: SeIncBasePriorityPrivilege 1776 Sony Vegas Pro 19.exe Token: 33 1776 Sony Vegas Pro 19.exe Token: SeIncBasePriorityPrivilege 1776 Sony Vegas Pro 19.exe Token: 33 1776 Sony Vegas Pro 19.exe Token: SeIncBasePriorityPrivilege 1776 Sony Vegas Pro 19.exe Token: 33 1776 Sony Vegas Pro 19.exe Token: SeIncBasePriorityPrivilege 1776 Sony Vegas Pro 19.exe Token: 33 1776 Sony Vegas Pro 19.exe Token: SeIncBasePriorityPrivilege 1776 Sony Vegas Pro 19.exe Token: 33 1776 Sony Vegas Pro 19.exe Token: SeIncBasePriorityPrivilege 1776 Sony Vegas Pro 19.exe Token: 33 1776 Sony Vegas Pro 19.exe Token: SeIncBasePriorityPrivilege 1776 Sony Vegas Pro 19.exe Token: 33 1776 Sony Vegas Pro 19.exe Token: SeIncBasePriorityPrivilege 1776 Sony Vegas Pro 19.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1776-0-0x00000000736A0000-0x0000000073C50000-memory.dmpFilesize
5.7MB
-
memory/1776-1-0x00000000736A0000-0x0000000073C50000-memory.dmpFilesize
5.7MB
-
memory/1776-2-0x0000000002A80000-0x0000000002A90000-memory.dmpFilesize
64KB
-
memory/1776-5-0x00000000736A0000-0x0000000073C50000-memory.dmpFilesize
5.7MB
-
memory/1776-6-0x0000000002A80000-0x0000000002A90000-memory.dmpFilesize
64KB