Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
16-03-2024 21:23
Behavioral task
behavioral1
Sample
Premiere_Pro_Set-Up.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Premiere_Pro_Set-Up.exe
Resource
win10v2004-20240226-en
General
-
Target
Premiere_Pro_Set-Up.exe
-
Size
2.0MB
-
MD5
aef9c419a9d62014d404d6fbc918206f
-
SHA1
da844993536c5b811754c78676662f705c2fec07
-
SHA256
8d66b4fd8b8031e419b2393ab86ee7846a580ebb97a6d6fa56a68adaa5374c73
-
SHA512
910d6135fc8e9657f23c17b905ff67570ac31ab6ec7980aaeef315d5a23078483045d672cf3991b831d876eb63ba9bb99e54a5701a9debef72e275743a0a8d4c
-
SSDEEP
49152:zqmy6gSCuaUoCOpbw3n0ocq4DGSdYTLHryG6HzhgtredQWF+mq:/2Fu3oCOcn07dtArylLZq
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/2280-0-0x0000000000400000-0x0000000000927000-memory.dmp upx behavioral2/memory/2280-99-0x0000000000400000-0x0000000000927000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3412 2280 WerFault.exe Premiere_Pro_Set-Up.exe -
Processes:
Premiere_Pro_Set-Up.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION Premiere_Pro_Set-Up.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Premiere_Pro_Set-Up.exe = "11001" Premiere_Pro_Set-Up.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
Premiere_Pro_Set-Up.exepid process 2280 Premiere_Pro_Set-Up.exe 2280 Premiere_Pro_Set-Up.exe 2280 Premiere_Pro_Set-Up.exe 2280 Premiere_Pro_Set-Up.exe 2280 Premiere_Pro_Set-Up.exe 2280 Premiere_Pro_Set-Up.exe 2280 Premiere_Pro_Set-Up.exe 2280 Premiere_Pro_Set-Up.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
Premiere_Pro_Set-Up.exedescription pid process Token: SeIncreaseQuotaPrivilege 2280 Premiere_Pro_Set-Up.exe Token: SeIncreaseQuotaPrivilege 2280 Premiere_Pro_Set-Up.exe Token: SeIncreaseQuotaPrivilege 2280 Premiere_Pro_Set-Up.exe Token: SeIncreaseQuotaPrivilege 2280 Premiere_Pro_Set-Up.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
Premiere_Pro_Set-Up.exepid process 2280 Premiere_Pro_Set-Up.exe 2280 Premiere_Pro_Set-Up.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Premiere_Pro_Set-Up.exe"C:\Users\Admin\AppData\Local\Temp\Premiere_Pro_Set-Up.exe"1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 22722⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2280 -ip 22801⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\{2280AD57-8765-450F-AE3B-F8DF7835149B}\js\main.jsFilesize
7KB
MD5a2ecc3bba3a5033720dd046cc6cf64d3
SHA149665f0f09e9d4ed4900706f74676c95e89e049d
SHA256fc1bba3a598af6605a402ad2552cd8d7605e51a019af119f25f30dfbd67e63c0
SHA512607a68fc046fd97c125cce992a3d3bcee2cef3db1e782ede497ed945677b3b32af953496444dc10312df815168fb9c9c2484a884fb320f5c8663a51edd7f7932
-
C:\Users\Admin\AppData\Local\Temp\{2280AD57-8765-450F-AE3B-F8DF7835149B}\js\mainController.jsFilesize
18KB
MD551bdcc0e7d53c59ff20ff2f6e276e321
SHA110cbb35c2c714f940ee5d58a1cda84504471c764
SHA256ec5b0cede51f5fd48c341cd27d42433bb9a2adb04836433fee5a90b101e4b1b2
SHA5129ea5117d9a7862971947f7ece47dcbc2701b3ec61586f068a4cdc5d33c25e51b99dc4475fe9b2b33595f32d8d2c37e93310eb10638669b941f16b3d44d5c1a10
-
C:\Users\Admin\AppData\Local\Temp\{2280AD57-8765-450F-AE3B-F8DF7835149B}\js\overlayController.jsFilesize
19KB
MD5b610650c4d826b14c225cfbeca89b8c1
SHA105da2853feb6ec81fe44ef2c2d934878e48fb85b
SHA25679d00458b49a02acee141b53dcf026aa1302ab6b48a745b57e1215bd3b20501c
SHA512403d9f5f15e8a1ef438924327c1f8fe698a372ca0bcfbba7a1970005622c32468de89cbf13220aa33f6b0f44757c2f00c1f7291f45bf5e86bef9aa32586336d6
-
C:\Users\Admin\AppData\Local\Temp\{2280AD57-8765-450F-AE3B-F8DF7835149B}\js\utils.jsFilesize
4KB
MD511671543588b007e7be2af6c784cb8ac
SHA184c86bb07a59ea951a510a7a7ac816b478598bd2
SHA256bc354f2e25fe40ae21745c51b06d8f34643e238ee67fb94f5cd59c9b56ac17f5
SHA51231af704991693747a74a32bdcfebabf31d98e2a47e69fe21a53c852b4c30de1c526ab602c530010e37751b59f6ff308c46443bb48fa30ed688c384fa0df35afd
-
C:\Users\Admin\AppData\Local\Temp\{2280AD57-8765-450F-AE3B-F8DF7835149B}\lib\angular.min.jsFilesize
172KB
MD53be66f7f7b86956bc5e5abd64cadf924
SHA17d9e1d61541acfa6a0fdfc8f1932bd734fa61cb3
SHA256b1a45f28aed77e38fb5ff62393f6c6573c6bea7f6089e83ed5e2e1fa025a6b2e
SHA5122a72569fd512a2bf49d6667353530ab5bb2ff04b5579d007c4b5615ef128345d4dddd460cf1ec91daf775c40b15b9368ec1e815bfcdcf9e0abe94e8003fda947
-
C:\Users\Admin\AppData\Local\Temp\{2280AD57-8765-450F-AE3B-F8DF7835149B}\lib\jquery.custom-scrollbar.min.jsFilesize
14KB
MD5ab3adf4aff09a1c562a29db05795c8ab
SHA1f6c3f470aea0678945cb889f518a0e9a5ce44342
SHA256d05e193674c6fc31de0503cbc0b152600f22689ad7ad72adb35fcc7c25d4b01b
SHA51244dfc748d0bd84f123f9d3f62d5ea137d9128d5bdbe45da9a8666d09039eb179acf0dbb3030e09896fd61e7aa5ae6dfaffe9258d80949a64d0a7e45037791fb4
-
C:\Users\Admin\AppData\Local\Temp\{2280AD57-8765-450F-AE3B-F8DF7835149B}\lib\jquery.min.jsFilesize
87KB
MD59ac39dc31635a363e377eda0f6fbe03f
SHA129fa5ad995e9ec866ece1d3d0b698fc556580eee
SHA2569a2723c21fb1b7dff0e2aa5dc6be24a9670220a17ae21f70fdbc602d1f8acd38
SHA5120799ae01799707b444fca518c3af9b91fda40d0a2c114e84bc52bd1f756b5e0d60f6fd239f04bd4d5bc37b6cdbf02d299185cd62410f2a514a7b3bd4d60b49fc
-
C:\Users\Admin\AppData\Local\Temp\{2280AD57-8765-450F-AE3B-F8DF7835149B}\lib\jquery.placeholder.min.jsFilesize
3KB
MD5e13f16e89fff39422bbb2cb08a015d30
SHA1e7cacaf84f53997dd096afd1c5f350fd3e7c6ce9
SHA25624320add10244d1834052c7e75b853aa2d164601c9d09220a9f9ac1f0ae44afe
SHA512aad811f03f59f799da4b8fc4f859b51c39f132b7ddbffadabe4ec2373bd340617d6fe98761d1fb86d77606791663b387d98a60fba9cee5d99c34f683bcb8d1f9
-
C:\Users\Admin\AppData\Local\Temp\{2280AD57-8765-450F-AE3B-F8DF7835149B}\main.htmlFilesize
20KB
MD5a501355e23582cbc6c8c2835fe076f52
SHA15dea00de3c163b2f4a2807f65b81f07fc957031f
SHA2564be92dee71936c52319d441434992895818586acab859000341af74d0175ab54
SHA5126e59cd5cc629a24fd0bacd42734937df779417fea595488d37f9923631f4b59abe7e24e9075e55e4313ea197c30f0bd44fd1663d9e6a4f9308b5ed7e3d5a62b0
-
memory/2280-0-0x0000000000400000-0x0000000000927000-memory.dmpFilesize
5.2MB
-
memory/2280-99-0x0000000000400000-0x0000000000927000-memory.dmpFilesize
5.2MB