Overview
overview
7Static
static
3HandBrake-...UI.exe
windows7-x64
4HandBrake-...UI.exe
windows10-2004-x64
5$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3HandBrake.Worker.exe
windows7-x64
1HandBrake.Worker.exe
windows10-2004-x64
1HandBrake.exe
windows7-x64
1HandBrake.exe
windows10-2004-x64
7hb.dll
windows7-x64
1hb.dll
windows10-2004-x64
1Analysis
-
max time kernel
143s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
15-02-2024 21:13
Static task
static1
Behavioral task
behavioral1
Sample
HandBrake-1.7.3-x86_64-Win_GUI.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
HandBrake-1.7.3-x86_64-Win_GUI.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral7
Sample
HandBrake.Worker.exe
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
HandBrake.Worker.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral9
Sample
HandBrake.exe
Resource
win7-20231129-en
Behavioral task
behavioral10
Sample
HandBrake.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
hb.dll
Resource
win7-20231129-en
Behavioral task
behavioral12
Sample
hb.dll
Resource
win10v2004-20231215-en
General
-
Target
HandBrake.exe
-
Size
35.6MB
-
MD5
ee3cbf592c24b1bf04d906ded5c7d1a9
-
SHA1
1931bdd5d120635c357b3000dff08ec9110ce1e3
-
SHA256
ee818fe194c29f1f31d6edffeb8256405618dab251f3765bbbacfb91ea666336
-
SHA512
97b52abf6cab8540bb7e6467eddaf02199c34fb40eb561ee022e626f9976e9a6d5b1006d053f2f1234c4a8760d686a6dfece1c5fd25483ff2d67bae43e38d8ac
-
SSDEEP
196608:cGSU8sdauO4miemcjYXCe5njhhKt39VxwgTluwKqVWyAAh:1SybLnJX/9jhhKtNDwgTluwKo5
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation HandBrake.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString HandBrake.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 HandBrake.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4416 HandBrake.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4416 HandBrake.exe
Processes
Network
-
Remote address:8.8.8.8:53Request97.17.167.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request182.178.17.96.in-addr.arpaIN PTRResponse182.178.17.96.in-addr.arpaIN PTRa96-17-178-182deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request71.159.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request209.205.72.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request149.220.183.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request157.123.68.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request206.23.85.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request23.160.77.104.in-addr.arpaIN PTRResponse23.160.77.104.in-addr.arpaIN PTRa104-77-160-23deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request179.178.17.96.in-addr.arpaIN PTRResponse179.178.17.96.in-addr.arpaIN PTRa96-17-178-179deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request14.227.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request207.178.17.96.in-addr.arpaIN PTRResponse207.178.17.96.in-addr.arpaIN PTRa96-17-178-207deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request209.143.182.52.in-addr.arpaIN PTRResponse
-
71 B 145 B 1 1
DNS Request
97.17.167.52.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
182.178.17.96.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
71.159.190.20.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
209.205.72.20.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
149.220.183.52.in-addr.arpa
-
72 B 146 B 1 1
DNS Request
157.123.68.40.in-addr.arpa
-
71 B 145 B 1 1
DNS Request
206.23.85.13.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
23.160.77.104.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
179.178.17.96.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
14.227.111.52.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
207.178.17.96.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
209.143.182.52.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5064807540e2e268c6e434da9e6205528
SHA1a6019147747e46c9ab689a167de0fb1d622e564e
SHA2568c1ec733778ca66505ef7afa77b0ac335db7a1a381e77492fbde37d53d33073e
SHA512c251463b096d68445754cbe732be13697aa59383e004858c49ab743fc971597ff63d7930800e7080cb10dc611250a81aba7b2b9236f705dae60bda4e2207b244
-
Filesize
1KB
MD51b3980a81eed4a54741aa088924dd6d2
SHA1852855903c8063a5f917ee3b02d0fc862b24bd49
SHA25642acbbde0eb4336f6015151faa965c93b7924544ee4445d26069ae8d4530c07a
SHA5126d046d276c72e6fe2e06a6b0fa2c44c2bf47e9293a9b914915cbc2a161b6e7c0b37bc31d43328c6392e2c9496144cb746f381ce0e5f21a8bf25b7ad8b9dde35c