Overview
overview
6Static
static
3windows.10...up.exe
windows7-x64
6windows.10...up.exe
windows10-2004-x64
6$PLUGINSDI...fo.dll
windows7-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows7-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3$PLUGINSDIR/audio.ini
windows7-x64
1$PLUGINSDIR/audio.ini
windows10-2004-x64
1$PLUGINSDI...sc.dll
windows7-x64
3$PLUGINSDI...sc.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDIR/video.ini
windows7-x64
1$PLUGINSDIR/video.ini
windows10-2004-x64
1$PLUGINSDI...re.ini
windows7-x64
1$PLUGINSDI...re.ini
windows10-2004-x64
1$SYSDIR/Codecs/$0.dll
windows7-x64
1$SYSDIR/Codecs/$0.dll
windows10-2004-x64
1$SYSDIR/Co...Up.exe
windows7-x64
3$SYSDIR/Co...Up.exe
windows10-2004-x64
3$SYSDIR/Co...64.exe
windows7-x64
4$SYSDIR/Co...64.exe
windows10-2004-x64
4$SYSDIR/Co...47.dll
windows7-x64
3$SYSDIR/Co...47.dll
windows10-2004-x64
3Analysis
-
max time kernel
143s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
20-02-2024 08:02
Static task
static1
Behavioral task
behavioral1
Sample
windows.10.codec.pack.v2.2.0.setup.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
windows.10.codec.pack.v2.2.0.setup.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/HwInfo.dll
Resource
win7-20240215-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/HwInfo.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/System.dll
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/audio.ini
Resource
win7-20231215-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/audio.ini
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/cpudesc.dll
Resource
win7-20231129-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/cpudesc.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20231215-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20231215-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral21
Sample
$PLUGINSDIR/video.ini
Resource
win7-20240215-en
Behavioral task
behavioral22
Sample
$PLUGINSDIR/video.ini
Resource
win10v2004-20231215-en
Behavioral task
behavioral23
Sample
$PLUGINSDIR/video_hardware.ini
Resource
win7-20231215-en
Behavioral task
behavioral24
Sample
$PLUGINSDIR/video_hardware.ini
Resource
win10v2004-20231215-en
Behavioral task
behavioral25
Sample
$SYSDIR/Codecs/$0.dll
Resource
win7-20231215-en
Behavioral task
behavioral26
Sample
$SYSDIR/Codecs/$0.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral27
Sample
$SYSDIR/Codecs/CleanUp.exe
Resource
win7-20231215-en
Behavioral task
behavioral28
Sample
$SYSDIR/Codecs/CleanUp.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral29
Sample
$SYSDIR/Codecs/CleanUp_x64.exe
Resource
win7-20231215-en
Behavioral task
behavioral30
Sample
$SYSDIR/Codecs/CleanUp_x64.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral31
Sample
$SYSDIR/Codecs/D3DCompiler_47.dll
Resource
win7-20231215-en
Behavioral task
behavioral32
Sample
$SYSDIR/Codecs/D3DCompiler_47.dll
Resource
win10v2004-20231215-en
General
-
Target
windows.10.codec.pack.v2.2.0.setup.exe
-
Size
45.5MB
-
MD5
908ea32c938f24669728a7c026a6552b
-
SHA1
2695b6cd468636b09c1495a86a69ce4f56203a0c
-
SHA256
435506cbe66bebdfdf9a2a94b1e8f483fdf108ab308129a6eb8dfd56a8bc77bc
-
SHA512
342281df3e8823dbca8231335c17d76fbc4d0ba35a97c2d777d11c9ca33b86e689ef54c86aebbbec50a6f499b7232c4d56406f0471cce666a74203bfe95e710e
-
SSDEEP
786432:Zbe52lsoZacQr5el64WTdDUCpGnSlyXMs8AdIqCmF3kdPEcOKbBhscBpw4yTie6d:ZbpHZac09DtpI7XMvmIqoPppw4yees
Malware Config
Signatures
-
Checks for any installed AV software in registry 1 TTPs 2 IoCs
Processes:
windows.10.codec.pack.v2.2.0.setup.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\AVG\AV windows.10.codec.pack.v2.2.0.setup.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV windows.10.codec.pack.v2.2.0.setup.exe -
Downloads MZ/PE file
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Loads dropped DLL 7 IoCs
Processes:
windows.10.codec.pack.v2.2.0.setup.exepid process 3428 windows.10.codec.pack.v2.2.0.setup.exe 3428 windows.10.codec.pack.v2.2.0.setup.exe 3428 windows.10.codec.pack.v2.2.0.setup.exe 3428 windows.10.codec.pack.v2.2.0.setup.exe 3428 windows.10.codec.pack.v2.2.0.setup.exe 3428 windows.10.codec.pack.v2.2.0.setup.exe 3428 windows.10.codec.pack.v2.2.0.setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
windows.10.codec.pack.v2.2.0.setup.exepid process 3428 windows.10.codec.pack.v2.2.0.setup.exe 3428 windows.10.codec.pack.v2.2.0.setup.exe 3428 windows.10.codec.pack.v2.2.0.setup.exe 3428 windows.10.codec.pack.v2.2.0.setup.exe 3428 windows.10.codec.pack.v2.2.0.setup.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
windows.10.codec.pack.v2.2.0.setup.exedescription pid process Token: SeDebugPrivilege 3428 windows.10.codec.pack.v2.2.0.setup.exe Token: SeShutdownPrivilege 3428 windows.10.codec.pack.v2.2.0.setup.exe Token: SeCreatePagefilePrivilege 3428 windows.10.codec.pack.v2.2.0.setup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\windows.10.codec.pack.v2.2.0.setup.exe"C:\Users\Admin\AppData\Local\Temp\windows.10.codec.pack.v2.2.0.setup.exe"1⤵
- Checks for any installed AV software in registry
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3428
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14KB
MD52a03c4a7ac5ee5e0e0a683949f70971b
SHA13bd9877caaea4804c0400420494ad1143179dcec
SHA256d4f0042d8e7622b7e14395e926dd02edab3cdc77e82d88108b67a4d2cee9229b
SHA5121942cdb522859f8dba46824786e361794a62e6201279201e1e0e2e07499fb6252933c5661782fccd77291c3650cafb2a7a08eee5431c8238f0da44840ee4c476
-
Filesize
11KB
MD56f5257c0b8c0ef4d440f4f4fce85fb1b
SHA1b6ac111dfb0d1fc75ad09c56bde7830232395785
SHA256b7ccb923387cc346731471b20fc3df1ead13ec8c2e3147353c71bb0bd59bc8b1
SHA512a3cc27f1efb52fb8ecda54a7c36ada39cefeabb7b16f2112303ea463b0e1a4d745198d413eebb3551e012c84a20dcdf4359e511e51bc3f1a60b13f1e3bad1aa8
-
Filesize
4KB
MD58ef0e4eb7c89cdd2b552de746f5e2a53
SHA1820f681e7cec409a02b194a487d1c8af1038acf0
SHA25641293b9f6588e0fbdc8fcf2a9bd8e2b244cd5ff038fc13033378da337219c9dc
SHA512a68533e8a19637d0d44219549b24baba0dc4824424842f125600fda3edcafc4bb6bb340d57a00815f262d82373b440d58d6e4e5b2ceb29bb3f6bc4cbde66c3c5
-
Filesize
1KB
MD5b5e41bcf121a9b7da0270aa35b0f5852
SHA1d7a26cf9ced03c846ec7215d03afeb5a7d817a2f
SHA2568a4db2d2506afed771c8288e399422cca4d515864f327d94e6329500a5a5f256
SHA5121b92c9162dc30e1f3965021f6b8c13ec310d47aa1ade5098d1acc3506d04a842ade9d8cbf31bbd42c92561779bae59b72b137f2eb1ee43afc5176c87da94a402
-
Filesize
1KB
MD543a1a5ee65d2828841781b6b403f3a64
SHA15a3636e0aae2199f56d2b57beb2c787b92dd045c
SHA2564efdbf5ca7b648390c5d1cbf21ea6f67061a235dc54700b30c7aa321eeb037ce
SHA5129dea293900ab699e93ab0d40fda09ef95f03af1e6272ea07561b6755fbe81a0d692d2f7ec0385b3bc7ac6a667644322cdcd3770afcf0e0c7b8966b58d82accbb
-
Filesize
30KB
MD51bc3c1608ac94cf3fb4575dc96610fe0
SHA102a953629b0e272d8a9bbf5dacbb03402853bc8a
SHA25664f426601f824c9ec361755cb157d5f80499b8bbf4a29455bfca1fb65f2aae5c
SHA51263881bcdf359f22de1a7582d943ec241ab2fe32fd68e202befd940c4e2ee86092797bc2de4514685d122235465fcc992cb0b5c1b9899869f9ca5840bcd8bec05