Overview

overview

7

Static

static

1

FFmpeg_5.0...64.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    10s
  • max time network
    11s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/03/2024, 18:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    FFmpeg_5.0.0_for_Audacity_on_Windows_x86_64.exe

  • Size

    8.2MB

  • MD5

    e3b14eb23cfd1bc602b59aba03a18876

  • SHA1

    f03490d4c4bbb2e50177b08418276483d9b5732e

  • SHA256

    9b31e2402cb27c76d56f252e3d6e1bbb4d82526eb93a0ffab7b25193f25de072

  • SHA512

    7779be7e7f1944e8d9579a6650f62cf882c511a3521e877c9f156fef43ad65098e694e1f433da9ae47ad9c592a0063a0048c6614277ad7fd068b56cbc26d547c

  • SSDEEP

    196608:v3whhv+OyNIAYTG3Bc8WOaEreiQpu1svc6482OQcUjEWwzd5txa:hhrImBc8W7Ew8KKjEWwzd5txa

Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 13 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\FFmpeg_5.0.0_for_Audacity_on_Windows_x86_64.exe
    "C:\Users\Admin\AppData\Local\Temp\FFmpeg_5.0.0_for_Audacity_on_Windows_x86_64.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2980
    • C:\Users\Admin\AppData\Local\Temp\is-IA6E3.tmp\FFmpeg_5.0.0_for_Audacity_on_Windows_x86_64.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-IA6E3.tmp\FFmpeg_5.0.0_for_Audacity_on_Windows_x86_64.tmp" /SL5="$C0066,7726391,831488,C:\Users\Admin\AppData\Local\Temp\FFmpeg_5.0.0_for_Audacity_on_Windows_x86_64.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      PID:4568

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-IA6E3.tmp\FFmpeg_5.0.0_for_Audacity_on_Windows_x86_64.tmp
    Filesize

    3.0MB

    MD5

    b7b68701fda6f9f8ca9aa987647e2e45

    SHA1

    40cc2fff3b2ed1b9480aa0422748ef87729154c5

    SHA256

    633bb75dd6bb3712c00e9746aa69a755c64c1ed4402bc5ba01b443e9437fff86

    SHA512

    467b5d3fd0e718f39cc33b45fff2486fdc7ae93d7d8ce57ab23e9f07812223be44f4cd63e34e9142d6961f791ef881d5a4b04baf8b86a0d826ba552420cc6f18

    Download Submit

  • memory/2980-1-0x0000000000400000-0x00000000004D8000-memory.dmp

    Filesize

    864KB

    Download

  • memory/2980-28-0x0000000000400000-0x00000000004D8000-memory.dmp

    Filesize

    864KB

    Download

  • memory/4568-6-0x0000000000D30000-0x0000000000D31000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4568-27-0x0000000000400000-0x000000000071A000-memory.dmp

    Filesize

    3.1MB

    Download