73f5eee95f0d5250f5d2f7a29702700537ebe6c08861d4ddfefc09d485f0f65e

Analysis

max time kernel
7s
max time network
8s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22/06/2024, 00:35

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

patch.exe
Size

4.6MB
MD5

4a027f5b895f161a0d0e26f8ec6f31a7
SHA1

2d8aa07828c92d4d9d85fc62ba82f0fe0bb5a789
SHA256

73f5eee95f0d5250f5d2f7a29702700537ebe6c08861d4ddfefc09d485f0f65e
SHA512

9b12840d6f2f9a277e7edded5830daf70713ea3f90ddf324bece98616d716400dc0247a47dc9d016fb02f9803fb0a2e2853f4a56e752b13a704132d4acfa23cb
SSDEEP

98304:0kLEAGg00ojGjm4EC/qQb4zldELsSqr7jkie3t:DEzg7AGUqqXHPjze3t

Score

9^/10

persistence

Malware Config

Signatures

Nirsoft 1 IoCs

resource	yara_rule
behavioral1/files/0x0006000000015682-23.dat	Nirsoft

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	patch.tmp
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable = "1"	patch.tmp

Executes dropped EXE 11 IoCs

pid	Process
3048	patch.tmp
2760	nircmd.exe
2680	nircmd.exe
2656	nircmd.exe
2640	nircmd.exe
2556	nircmd.exe
2920	nircmd.exe
3068	nircmd.exe
2688	nircmd.exe
1668	nircmd.exe
2532	nircmd.exe

Loads dropped DLL 22 IoCs

pid	Process
2984	patch.exe
3048	patch.tmp
2652	cmd.exe
2652	cmd.exe
2652	cmd.exe
2652	cmd.exe
2652	cmd.exe
2652	cmd.exe
2652	cmd.exe
2652	cmd.exe
2652	cmd.exe
2652	cmd.exe
2652	cmd.exe
2652	cmd.exe
2652	cmd.exe
2652	cmd.exe
2652	cmd.exe
2652	cmd.exe
2652	cmd.exe
2652	cmd.exe
2652	cmd.exe
2652	cmd.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VEGAS\VEGAS Pro 21.0\vegas210.exe.local	patch.tmp
File created	C:\Program Files\VEGAS\VEGAS Pro 21.0\Protein\is-K15R8.tmp	patch.tmp
File created	C:\Program Files\VEGAS\VEGAS Pro 21.0\vegas210.exe.local\is-SSTH5.tmp	patch.tmp
File opened for modification	C:\Program Files\VEGAS\VEGAS Pro 21.0\Protein\Protein_x64.4.2.dll	patch.tmp
File opened for modification	C:\Program Files\VEGAS\VEGAS Pro 21.0\vegas210.exe.local\wintrust.dll	patch.tmp

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3048	patch.tmp
3048	patch.tmp

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2984	patch.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3048	patch.tmp

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 3048	2984	patch.exe	28
PID 2984 wrote to memory of 3048	2984	patch.exe	28
PID 2984 wrote to memory of 3048	2984	patch.exe	28
PID 2984 wrote to memory of 3048	2984	patch.exe	28
PID 2984 wrote to memory of 3048	2984	patch.exe	28
PID 2984 wrote to memory of 3048	2984	patch.exe	28
PID 2984 wrote to memory of 3048	2984	patch.exe	28
PID 3048 wrote to memory of 2652	3048	patch.tmp	29
PID 3048 wrote to memory of 2652	3048	patch.tmp	29
PID 3048 wrote to memory of 2652	3048	patch.tmp	29
PID 3048 wrote to memory of 2652	3048	patch.tmp	29
PID 2652 wrote to memory of 2760	2652	cmd.exe	31
PID 2652 wrote to memory of 2760	2652	cmd.exe	31
PID 2652 wrote to memory of 2760	2652	cmd.exe	31
PID 2652 wrote to memory of 2680	2652	cmd.exe	32
PID 2652 wrote to memory of 2680	2652	cmd.exe	32
PID 2652 wrote to memory of 2680	2652	cmd.exe	32
PID 2652 wrote to memory of 2656	2652	cmd.exe	33
PID 2652 wrote to memory of 2656	2652	cmd.exe	33
PID 2652 wrote to memory of 2656	2652	cmd.exe	33
PID 2652 wrote to memory of 2640	2652	cmd.exe	34
PID 2652 wrote to memory of 2640	2652	cmd.exe	34
PID 2652 wrote to memory of 2640	2652	cmd.exe	34
PID 2652 wrote to memory of 2556	2652	cmd.exe	35
PID 2652 wrote to memory of 2556	2652	cmd.exe	35
PID 2652 wrote to memory of 2556	2652	cmd.exe	35
PID 2652 wrote to memory of 2920	2652	cmd.exe	36
PID 2652 wrote to memory of 2920	2652	cmd.exe	36
PID 2652 wrote to memory of 2920	2652	cmd.exe	36
PID 2652 wrote to memory of 3068	2652	cmd.exe	37
PID 2652 wrote to memory of 3068	2652	cmd.exe	37
PID 2652 wrote to memory of 3068	2652	cmd.exe	37
PID 2652 wrote to memory of 2688	2652	cmd.exe	38
PID 2652 wrote to memory of 2688	2652	cmd.exe	38
PID 2652 wrote to memory of 2688	2652	cmd.exe	38
PID 2652 wrote to memory of 1668	2652	cmd.exe	39
PID 2652 wrote to memory of 1668	2652	cmd.exe	39
PID 2652 wrote to memory of 1668	2652	cmd.exe	39
PID 2652 wrote to memory of 2532	2652	cmd.exe	40
PID 2652 wrote to memory of 2532	2652	cmd.exe	40
PID 2652 wrote to memory of 2532	2652	cmd.exe	40

C:\Users\Admin\AppData\Local\Temp\patch.exe
"C:\Users\Admin\AppData\Local\Temp\patch.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Users\Admin\AppData\Local\Temp\is-VOAUJ.tmp\patch.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-VOAUJ.tmp\patch.tmp" /SL5="$30150,4018567,1141760,C:\Users\Admin\AppData\Local\Temp\patch.exe"
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3048
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-KJ7D4.tmp\nircmd.cmd""
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2652
  - - C:\Users\Admin\AppData\Local\Temp\is-KJ7D4.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\VEGAS_Pro_21\installation.ini" "Serial" "string" "P3-64979-27462-07906-32757-21318-38872"
      4⤵
      Executes dropped EXE
      PID:2760
  - - C:\Users\Admin\AppData\Local\Temp\is-KJ7D4.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\VEGAS_Pro_21\installation.ini" "VersionUnlock" "NumberOfStarts" "0"
      4⤵
      Executes dropped EXE
      PID:2680
  - - C:\Users\Admin\AppData\Local\Temp\is-KJ7D4.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\VEGAS_Pro_21\installation.ini" "VersionUnlock" "DontShowNagBox" "1"
      4⤵
      Executes dropped EXE
      PID:2656
  - - C:\Users\Admin\AppData\Local\Temp\is-KJ7D4.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\VEGAS_Pro_21\installation.ini" "VersionUnlock" "IsRegisteredUser" "1"
      4⤵
      Executes dropped EXE
      PID:2640
  - - C:\Users\Admin\AppData\Local\Temp\is-KJ7D4.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\VEGAS_Pro_21\installation.ini" "VersionUnlock" "UserEMail" "uBusHTShXjdIakxgck01PRO5nuh8YfF4BDS17GWS/So3BnxxO66uwQ3meU0PEMwM"
      4⤵
      Executes dropped EXE
      PID:2556
  - - C:\Users\Admin\AppData\Local\Temp\is-KJ7D4.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\DVD_Architect_Pro_7\installation.ini" "Serial" "string" "P3-77020-98979-63411-51090-66867-08191"
      4⤵
      Executes dropped EXE
      PID:2920
  - - C:\Users\Admin\AppData\Local\Temp\is-KJ7D4.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\DVD_Architect_Pro_7\installation.ini" "VersionUnlock" "NumberOfStarts" "0"
      4⤵
      Executes dropped EXE
      PID:3068
  - - C:\Users\Admin\AppData\Local\Temp\is-KJ7D4.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\DVD_Architect_Pro_7\installation.ini" "VersionUnlock" "DontShowNagBox" "1"
      4⤵
      Executes dropped EXE
      PID:2688
  - - C:\Users\Admin\AppData\Local\Temp\is-KJ7D4.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\DVD_Architect_Pro_7\installation.ini" "VersionUnlock" "IsRegisteredUser" "1"
      4⤵
      Executes dropped EXE
      PID:1668
  - - C:\Users\Admin\AppData\Local\Temp\is-KJ7D4.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\DVD_Architect_Pro_7\installation.ini" "VersionUnlock" "UserEMail" "uBusHTShXjdIakxgck01PRO5nuh8YfF4BDS17GWS/So3BnxxO66uwQ3meU0PEMwM"
      4⤵
      Executes dropped EXE
      PID:2532

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:2584

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:1940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-KJ7D4.tmp\nircmd.cmd

Filesize
1KB

MD5
e153c13ea7e1ef949a96e82f8e8b8cd8

SHA1
c0ae954eaa465daad882dc1c85ce1b55bb40ad3c

SHA256
2589c520e0e088fb5813d187b46be8a4e28ffbdf138faa4fcaffaa09d3c86268

SHA512
2ae5d7fcb89ad1d25d6444635b43fc36be529779962a52bf6ad40f0dd6b445e58e20ecc5bf472c01002a5a938ca076f431c221ee23557d2903f7bed8f107c803

Download Submit
\Users\Admin\AppData\Local\Temp\is-KJ7D4.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
\Users\Admin\AppData\Local\Temp\is-KJ7D4.tmp\nircmd.exe

Filesize
114KB

MD5
b417238213efb0d2a23562674406cdf9

SHA1
04bf7acc7d0aa74fa750f7c32fdebbbe1daf46f8

SHA256
5bfa034f7555a38e64c078af71b4ff8c49511579fa826a87661940b7e9a6e333

SHA512
881b420af6e7104ac1f2edf03fc905f30af8ee264d8279f7eeb18e6178e210e063ac3c3d9a47f0c7c36ad04b51773e28595f965b037b0a0305d6c9fdf18e96a3

Download Submit
\Users\Admin\AppData\Local\Temp\is-VOAUJ.tmp\patch.tmp

Filesize
3.3MB

MD5
90f19922d1ac82552f5e95036ea90ccb

SHA1
94ef714ab9c01d20371142d34cef56b7886138cd

SHA256
fca2fada59c1a0d1cd30c2023933036af4d3247b1bc0449d439be2d53771fd94

SHA512
39ee8a7e9f534807c1ee06fa0f145ef23990cb278f45a0fc22f71f474c7394540ce4040fa59ced9a0336e2f4fe0bb7603067208d15bc9f9bef1ec45f1adc316e

Download Submit
memory/2984-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download
memory/2984-0-0x0000000000400000-0x0000000000524000-memory.dmp

Filesize
1.1MB

Download
memory/2984-58-0x0000000000400000-0x0000000000524000-memory.dmp

Filesize
1.1MB

Download
memory/3048-10-0x0000000000400000-0x0000000000760000-memory.dmp

Filesize
3.4MB

Download
memory/3048-56-0x0000000000400000-0x0000000000760000-memory.dmp

Filesize
3.4MB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads