Analysis
-
max time kernel
103s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
15-02-2024 21:13
General
-
Target
HandBrake-1.7.3-x86_64-Win_GUI.exe
-
Size
22.6MB
-
MD5
1a1598a4f8a2d8d6b1925cb22a74d5aa
-
SHA1
ce693673a6f207be639fc07d21f90833dc386072
-
SHA256
f80829d30029ba255675929587f2b6665de2790e52b24845b92d1427c8893264
-
SHA512
63706b168aa11c6370a36fce9d73b585486f2a9e396c183eb725430f70a67d5c301701823b1e566b70a601443b748ad428de2c91e507b4a8f8d14e344571a18f
-
SSDEEP
393216:Xx4SBEeiv1+mx9BQNCX3fjSfy05s+EwWAa4ND046BsZdCu17QCnqXd:X3BE9l1XLSf9ZE5iD04RZD2d
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 6 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 5 IoCs
-
Registers COM server for autorun 1 TTPs 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies registry class 17 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\HandBrake-1.7.3-x86_64-Win_GUI.exe"C:\Users\Admin\AppData\Local\Temp\HandBrake-1.7.3-x86_64-Win_GUI.exe"1⤵
- Drops file in Program Files directory
- Loads dropped DLL
-
C:\Program Files\HandBrake\HandBrake.exe"C:\Program Files\HandBrake\HandBrake.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Program Files\HandBrake\HandBrake.exe"C:\Program Files\HandBrake\HandBrake.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.2MB
MD58b141a97d90cc5b30085302ae7fc6bfd
SHA1fafcca7c9b84f2d6e25d4469732085fc4fc56d54
SHA2564f609dfcadaaa93baa3a56279535662bea5e8ca8f7a0d95c898b86218351f967
SHA512af98d3fb316ba379cc4b461c154a481370a374b03408fb66ee930f3c4b62a1b4c76292a92560f6d26d615ae77738085de06601cc9406cb11701af09f8bdb6aa8
-
Filesize
1024KB
MD599e5f923e1ebe2a8f0cdb69337135306
SHA1052a6abcfa81f92dc6712a9af1f2558fade92898
SHA25655f3b305e836fce79fadb99afb023995cf5444f63cb699b139dab7bfec3058bc
SHA512c71285f22af97f0e5a90c69b9412c7df0f219d9f289b0a506d2df0a37e5bc4c2e3934169a3403c9cebbefc8c365de4f6fa4f3508bdfbbde8878e5a91dda39bf7
-
Filesize
5.2MB
MD5cf0c191fe9dff3be696e4e00fa51784f
SHA1bc1aa8d9c438032fab0563f4f71951c16c1ff588
SHA2567ab233601f8b707daec0e60ad8dfa769c8b512b6d6bcfc035ded770e354c1938
SHA5123dfeddafca4ff011d195b16535e459b0f6cb192bb4846bd030cfd453f3dfb515ddd0c393dc742503d19dc6d33470eeadf9fa15a7512231d04fd560a8dc3a2dc5
-
Filesize
13.0MB
MD57fdc5a733f3e10ed3dedffdf0e2282b6
SHA1bfd978e0bb80bd5ee90639a8e4f949773e5babf1
SHA2562be97624ef07cf1f12cf914a8c8d9c64b98a237e3bbbe55a76595edfefeac4b1
SHA5124e78428d46caaa791d0334e3b6bff8e3991911d4a83c016699f652facbff5b4893f0e28cf2803d4a43801f15c870f2c3d83c0d6ad36af377c80ac0e44fd7470f
-
Filesize
11.8MB
MD5a49b478ecb92f3807e9af9f63f12a365
SHA1760bf1d29e8e83c34dc6338222e81d04408fe76e
SHA2566997b5fd4b16159c1a0272f7fd0f4c40c2bde05c6f4010ed3320e3561fe77895
SHA512c79dcdc6736999e3edc9396db093af68dddd3e3cc5f13cc6edda93640d9c94f38cf1b621a16b8cdd0f40fb05d87900190cfac899c2cd86b1a97aa576d50dd4f0
-
Filesize
704KB
MD51e689a738e9fba86d69584ecab4a76dc
SHA15aa00d606a40a669101faa55a4de298f351cf1a7
SHA2560e728b89064b860e12d10417cfe0afb4c5ce5c5134850a6120bfcbb137172cd2
SHA5128f371a11c0e00829a03a737493e22a4d2d0a2a3a8dc85382013440a07bbdbbf87a1aa4bad8b52cb3d0c4efc7c3eb82e4822ea79d5c9760a69b3852be8fbf49a2
-
Filesize
898B
MD5a655f45cc5afda069c653f0687d582f9
SHA1e9c2bc489e4be431e7c48fb6215525dbd70d7e59
SHA256999340bda6f0295f33a113ef1b3186e4611588aed37cef2a2718dfe4c4b22a5a
SHA512658e3e9da7dc213293c65bbc23e1753d6e32809746eeaf1d2097182e1b33fc261324e36f5f19f9a560eff0a3ae01544032be75101239b8f8fbbc5fab6aa330d3
-
Filesize
15KB
MD5d095b082b7c5ba4665d40d9c5042af6d
SHA12220277304af105ca6c56219f56f04e894b28d27
SHA256b2091205e225fc07daf1101218c64ce62a4690cacac9c3d0644d12e93e4c213c
SHA51261fb5cf84028437d8a63d0fda53d9fe0f521d8fe04e96853a5b7a22050c4c4fb5528ff0cdbb3ae6bc74a5033563fc417fc7537e4778227c9fd6633ae844c47d9
-
Filesize
12KB
MD54add245d4ba34b04f213409bfe504c07
SHA1ef756d6581d70e87d58cc4982e3f4d18e0ea5b09
SHA2569111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706
SHA5121bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d
-
Filesize
1KB
MD50f2017d3fd7dbd903ab6dfa93a21a54f
SHA1b4a709a84f0a1967fe9636a7eeff1f72410f61de
SHA2564d9ea566f4d6b539a25088883acfd3e3a66fc65e2d666997a41f62ae803346ad
SHA512af47c3287a1aa7aa7af5315b67f1158af50df28a4967c258feba06a7b3b923aeec8a452b4b0ef136837bccc81fd979bccdcb155efc402f6924d78e4f72fa77b1
-
Filesize
1KB
MD5e9056c0623111c79c92e20b42c59efe7
SHA1a42e7709de24af1352dd4c2360313dd1b6b080fc
SHA256b4fd34d82e304a920d82079d4fe82fbb8a926be4f4d010e3bf9b149b030299c2
SHA5122648369aed6baa355cc64bfbe0dfc5058e4a70d82d5da1660390ca261bac1c4728123f5490e3e1e262e20fffb797db7f1d1f5a38f5cb4bc2daf0ae31587aca13
-
Filesize
1KB
MD53dd28a92d829b309458e2c6bc6ba2997
SHA1c8bca9a7984ca16b1549c5f4c18f562ef7db647a
SHA2569b93820700aea59b6ed68b2d8db37d94e4fe8b7654452b67d6af515f0f05d7bc
SHA512eff6d8453f2e8afdda4a64cab61c80a5f046a7f00f0ebaa1bc5f844e74b61e6ca2e04b42d7726fa7715a21e592d3e3cbea0d7538ded2996104424d33c8ecd56a
-
Filesize
362KB
MD5896744217ce8c5eba843c34cd7275c2c
SHA1693ebcdef3137f4b54ccb81412afe396822768a7
SHA256eee6fe1ebc50c8d5550413005a23f126abab52ceb04b63291b92a44160eebc12
SHA51250d380362e40ca494202852d492ae53d4671bd4d92325783b2334617b48c233efbf5fe958aad4c1f495bb5ca0c62a67e9ead07ccbe9d807a42e80fb49ffb12dc
-
Filesize
1KB
MD53971ed05777ff97980ddf3cebb5e6b50
SHA1f960197c28192718416655efde4ee53e19241d80
SHA2563937126b4a054412a35f7f03872fe53930b46c583e9f5075672734e3356875a4
SHA5128d18e0f5b42e9d7fb51ae1928bc39c05e94b3b800313bacbff76641b36ed4468ed43986167aa8d0a4c2fbf3ac1e31a78dd90d2c7fd2420322022cd77aede75f7
-
Filesize
2KB
MD591a8b7d47427f05df7b41fb9e98ae18f
SHA1c21f6e1acd977a05e231eaa79374f6f768066f7e
SHA25615aeac4c77b8a6f3eb1dd6416f16fdd39cb22bd3f8468f693bd4ebddc8c2ff20
SHA512dde293e4bef61eb30e85e325f84adcc5f0575b239765acabd6d7cca3dab0378c185021f4eb09ef585ffcdd920f07b86627144754e991e9c94882528fba6857e5
-
Filesize
880B
MD5ca056b64494327d24dfdb596509e38e8
SHA1a49af039c7bf259584540c45bcbec4895f5eefe1
SHA256300b5edcecde4176b8d68f203a6adc6369891da6ee3ad5b2f9c3818130694508
SHA51219c6b9a1fe7d0a6fe7339cbce0f7ffde85a113f90d96281348ea8b0536c4bf564ed8196279e25767d7006d5b5cedb66ddf32d058a170fafa3d72541010374076
-
Filesize
89.8MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
2.7MB
-
Filesize
89.8MB
-
Filesize
332KB
-
Filesize
824KB
-
Filesize
332KB
-
Filesize
544KB
-
Filesize
52KB
-
Filesize
89.8MB
-
Filesize
1.8MB
-
Filesize
360KB
-
Filesize
268KB
-
Filesize
840KB
-
Filesize
4.2MB
-
Filesize
5.0MB
-
Filesize
5.0MB