f80829d30029ba255675929587f2b6665de2790e52b24845b92d1427c8893264

Analysis

max time kernel
158s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28-02-2024 20:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

HandBrake-1.7.3-x86_64-Win_GUI.exe
Size

22.6MB
MD5

1a1598a4f8a2d8d6b1925cb22a74d5aa
SHA1

ce693673a6f207be639fc07d21f90833dc386072
SHA256

f80829d30029ba255675929587f2b6665de2790e52b24845b92d1427c8893264
SHA512

63706b168aa11c6370a36fce9d73b585486f2a9e396c183eb725430f70a67d5c301701823b1e566b70a601443b748ad428de2c91e507b4a8f8d14e344571a18f
SSDEEP

393216:Xx4SBEeiv1+mx9BQNCX3fjSfy05s+EwWAa4ND046BsZdCu17QCnqXd:X3BE9l1XLSf9ZE5iD04RZD2d

Score

5^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	HandBrake.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\HandBrake\HandBrake.exe	HandBrake-1.7.3-x86_64-Win_GUI.exe
File created	C:\Program Files\HandBrake\hb.dll	HandBrake-1.7.3-x86_64-Win_GUI.exe
File created	C:\Program Files\HandBrake\portable.ini.template	HandBrake-1.7.3-x86_64-Win_GUI.exe
File created	C:\Program Files\HandBrake\doc\COPYING	HandBrake-1.7.3-x86_64-Win_GUI.exe
File created	C:\Program Files\HandBrake\uninst.exe	HandBrake-1.7.3-x86_64-Win_GUI.exe
File created	C:\Program Files\HandBrake\HandBrake.Worker.exe	HandBrake-1.7.3-x86_64-Win_GUI.exe

Executes dropped EXE 1 IoCs

pid	Process
3604	HandBrake.exe

Loads dropped DLL 4 IoCs

pid	Process
4700	HandBrake-1.7.3-x86_64-Win_GUI.exe
4700	HandBrake-1.7.3-x86_64-Win_GUI.exe
4700	HandBrake-1.7.3-x86_64-Win_GUI.exe
3604	HandBrake.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	HandBrake.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	HandBrake.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3604	HandBrake.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3604	HandBrake.exe

C:\Users\Admin\AppData\Local\Temp\HandBrake-1.7.3-x86_64-Win_GUI.exe
"C:\Users\Admin\AppData\Local\Temp\HandBrake-1.7.3-x86_64-Win_GUI.exe"
1⤵
- Drops file in Program Files directory
- Loads dropped DLL
PID:4700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4064 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:8
1⤵
PID:1996

C:\Program Files\HandBrake\HandBrake.exe
"C:\Program Files\HandBrake\HandBrake.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\HandBrake\HandBrake.exe

Filesize
1.4MB

MD5
0b93bfe2bc0f11bde1d47db7c208f3a0

SHA1
b5258f4eb8a5a287de513ad84d9c4417caed0c96

SHA256
8326ecdc54209708731350507ae96697ab3443f6643b568f96163ac353865760

SHA512
f71c3878ffbee47498cabe833caaceeb6bd47dc1b2701dd5429b3c1339a1a3a3e6d3539bbe3e7beb20514bcee5f3225ad90ca193a5760a642b1270c0fb4b7086

Download Submit
C:\Program Files\HandBrake\HandBrake.exe

Filesize
6.0MB

MD5
f50fe479d4ab0568cf70028c2137463d

SHA1
edb09b575766568d55b72f70ec633570fd9bca1e

SHA256
35afd91986c1425644c63738ed870519e421110e2a93672cafe414f8c193e387

SHA512
a27cb5e839f9e60fae6fa9334739809a88c50600636b4d5031c4d8f877742687e56bbc309df58c0b9f209fd9a7ef18d6c1fab64992b5d994e6ce0b8c8a543d9a

Download Submit
C:\Program Files\HandBrake\HandBrake.exe

Filesize
5.4MB

MD5
ce2057ca18a44ae8b16a882025d0fa90

SHA1
4cde1b1ed7b8b4a1d3aed36ad03aa35e5e86a4a4

SHA256
5730d66b0255bb09b1a2f64bcb4467cb4b88a057894c6203a2a4ba375b37e4db

SHA512
e29d525cb3e4a1d78802d677eb8d88fd62b3b829379dfe2b28970cef868489c72d6c6e87790b14f4e77e656ec5ae171794b1f1cfd2ae46ef6d65f77252830e71

Download Submit
C:\Program Files\HandBrake\hb.DLL

Filesize
7.5MB

MD5
f2bfcecc553d814bb95f475e47deb57f

SHA1
4815a961646d899624b5e1f9aa9fb9f8291a97df

SHA256
0c78ef8faa50d26c74c8db3476966cabe9f48f0cedb420bec30c18c7bfd879fe

SHA512
3b0f3e9a568f7844eecc37a7114ca9c43c08b46f2b6c7f927af4a2b29bc2172399b3a312be9f2b875a8402077e7331b5d133f28d5399e4cb1906e523d609f2c5

Download Submit
C:\Program Files\HandBrake\hb.dll

Filesize
7.9MB

MD5
3937a6eeb32803615a310b246c270eac

SHA1
d8ad641b38a65e3110764cf201d4a1924180ecb5

SHA256
e5127e8bce9be55f702141435c120d6e2cc9c80a12eb467e5ad88bb53aef16b9

SHA512
6eb6599eb18ee76a8e0dccb3572ead4eb88d1a0e3f5d72e372076e8d7bcdbb01dabbbcbd41a8cb3010925a44dc2dca2e34900cd39ce7b67f2fd042077bf49060

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso28D1.tmp\InstallOptions.dll

Filesize
15KB

MD5
d095b082b7c5ba4665d40d9c5042af6d

SHA1
2220277304af105ca6c56219f56f04e894b28d27

SHA256
b2091205e225fc07daf1101218c64ce62a4690cacac9c3d0644d12e93e4c213c

SHA512
61fb5cf84028437d8a63d0fda53d9fe0f521d8fe04e96853a5b7a22050c4c4fb5528ff0cdbb3ae6bc74a5033563fc417fc7537e4778227c9fd6633ae844c47d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso28D1.tmp\System.dll

Filesize
12KB

MD5
4add245d4ba34b04f213409bfe504c07

SHA1
ef756d6581d70e87d58cc4982e3f4d18e0ea5b09

SHA256
9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706

SHA512
1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso28D1.tmp\ioSpecial.ini

Filesize
1KB

MD5
ece12747850989133b15457a0cf5d95a

SHA1
79b1b6ae3f4bbb3e687208e14a1dce3d81dee7f0

SHA256
083f44a3108b3a1037d50d732b830b2a8b3858c826a8a0814199e228d385755e

SHA512
50ff1061cec90f243b0187583079ab731e303d42d25f2003840b4cfafe958ed8597910d57d8bd9a69193f80d6e7fb74d84ae8f2b8a42e81cdb0198078e512290

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso28D1.tmp\ioSpecial.ini

Filesize
1KB

MD5
ea080c8c9079ae0cb0dd670c98824567

SHA1
ac56bcdd1b3046b44f9e4ece4ecbb67e05d4bc47

SHA256
ab62b7ab0983230cbd20b27f267cc0283b1c933aaa7f185ea2cd00fb776e9439

SHA512
333bf7fb879a4f4fe0189bdc3f8ed988e11d2d2e0a44410e1f283fd41f019dfcf4c2c9d7b23c7b2c1ee457be3efffa9bd436fd99b8cd0847a85869b0d0917ad7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso28D1.tmp\ioSpecial.ini

Filesize
1KB

MD5
0e728b9b519065032d9221c1ac575a7a

SHA1
0fc3174f782267f6a3c2d78578d27370f252267b

SHA256
4a752cb57ff433905d7d20be0acdab08676a062aebf5e3fe06ab0a8473a0cf09

SHA512
612b86095dbdc4cb9728c4d0315e3bb12fe908d47038af758c4abced163aea29721ce966a4ff8ee475a0a524d0eb143094e8ea3d74f65c7628e96e98c96217a5

Download Submit
C:\Users\Admin\AppData\Roaming\HandBrake\settings.json

Filesize
425B

MD5
ad578625b2fff402ffdbd00e7316c47f

SHA1
f57b13c127270c8c7e03910bf3639c18f252f826

SHA256
99dd76f150f39d0a183f8e1828a34b58e3f86662bafe6c414ee6dac808d91e7a

SHA512
bf21f6631f92f2b9ddf910a21d06f43c37226bad96be6d98b0d8e480161af9977a7cc47de53b20855e6cfe8e06555d12f1e147ea064187a81a0ca52ac58092f5

Download Submit
C:\Users\Admin\AppData\Roaming\HandBrake\settings.json

Filesize
2KB

MD5
950253ea8d018c34f94705024310bc73

SHA1
ab7702021eb34bdf87f320aca6c59c0b2ce298f6

SHA256
0d78c5eb19e2d5fcecae39fb5a07eaef1b5b24f1bdbfb60be208082a6c440da8

SHA512
4748bbb4ee73972e76dccbb0808eca39345179e855b2bb4f993e80557082e90cd50449503ad48671bb3bede9f52aca1e2c3c51c788eb122b22609fbe2a50255e

Download Submit
memory/3604-202-0x00007FFFA44B0000-0x00007FFFA49AE000-memory.dmp

Filesize
5.0MB

Download
memory/3604-293-0x00007FFF80820000-0x00007FFF861E9000-memory.dmp

Filesize
89.8MB

Download
memory/3604-209-0x00000177D0E30000-0x00000177D0F02000-memory.dmp

Filesize
840KB

Download
memory/3604-206-0x00000177D11A0000-0x00000177D15E0000-memory.dmp

Filesize
4.2MB

Download
memory/3604-203-0x0000000180000000-0x00000001802B4000-memory.dmp

Filesize
2.7MB

Download
memory/3604-212-0x00000177D0D50000-0x00000177D0D93000-memory.dmp

Filesize
268KB

Download
memory/3604-215-0x00000177D0DA0000-0x00000177D0DFA000-memory.dmp

Filesize
360KB

Download
memory/3604-218-0x00000177D0E00000-0x00000177D0E0D000-memory.dmp

Filesize
52KB

Download
memory/3604-294-0x00000177D1A00000-0x00000177D1ACE000-memory.dmp

Filesize
824KB

Download
memory/3604-297-0x00007FFFA44B0000-0x00007FFFA49AE000-memory.dmp

Filesize
5.0MB

Download
memory/3604-298-0x00000177D20D0000-0x00000177D2123000-memory.dmp

Filesize
332KB

Download
memory/3604-302-0x00007FFF80820000-0x00007FFF861E9000-memory.dmp

Filesize
89.8MB

Download
memory/3604-303-0x00000177AE680000-0x00000177AE6D3000-memory.dmp

Filesize
332KB

Download
memory/3604-306-0x00000177D3990000-0x00000177D3A18000-memory.dmp

Filesize
544KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads