73f5eee95f0d5250f5d2f7a29702700537ebe6c08861d4ddfefc09d485f0f65e

General

Target

Patch.exe
Size

4.6MB
MD5

4a027f5b895f161a0d0e26f8ec6f31a7
SHA1

2d8aa07828c92d4d9d85fc62ba82f0fe0bb5a789
SHA256

73f5eee95f0d5250f5d2f7a29702700537ebe6c08861d4ddfefc09d485f0f65e
SHA512

9b12840d6f2f9a277e7edded5830daf70713ea3f90ddf324bece98616d716400dc0247a47dc9d016fb02f9803fb0a2e2853f4a56e752b13a704132d4acfa23cb
SSDEEP

98304:0kLEAGg00ojGjm4EC/qQb4zldELsSqr7jkie3t:DEzg7AGUqqXHPjze3t

Score

9^/10

persistence

Malware Config

Signatures

Detected Nirsoft tools 1 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral1/files/0x000700000001ac4b-22.dat	Nirsoft

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	Patch.tmp
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable = "1"	Patch.tmp

Executes dropped EXE 11 IoCs

pid	Process
4264	Patch.tmp
2696	nircmd.exe
1216	nircmd.exe
1316	nircmd.exe
4980	nircmd.exe
1440	nircmd.exe
3724	nircmd.exe
392	nircmd.exe
704	nircmd.exe
3600	nircmd.exe
3920	nircmd.exe

Loads dropped DLL 1 IoCs

pid	Process
4264	Patch.tmp

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VEGAS\VEGAS Pro 21.0\vegas210.exe.local	Patch.tmp
File created	C:\Program Files\VEGAS\VEGAS Pro 21.0\Protein\is-TNKT0.tmp	Patch.tmp
File created	C:\Program Files\VEGAS\VEGAS Pro 21.0\vegas210.exe.local\is-LAJOM.tmp	Patch.tmp
File opened for modification	C:\Program Files\VEGAS\VEGAS Pro 21.0\Protein\Protein_x64.4.2.dll	Patch.tmp
File opened for modification	C:\Program Files\VEGAS\VEGAS Pro 21.0\vegas210.exe.local\wintrust.dll	Patch.tmp

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4264	Patch.tmp
4264	Patch.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4264	Patch.tmp

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4568 wrote to memory of 4264	4568	Patch.exe	73
PID 4568 wrote to memory of 4264	4568	Patch.exe	73
PID 4568 wrote to memory of 4264	4568	Patch.exe	73
PID 4264 wrote to memory of 1708	4264	Patch.tmp	74
PID 4264 wrote to memory of 1708	4264	Patch.tmp	74
PID 1708 wrote to memory of 2696	1708	cmd.exe	76
PID 1708 wrote to memory of 2696	1708	cmd.exe	76
PID 1708 wrote to memory of 1216	1708	cmd.exe	77
PID 1708 wrote to memory of 1216	1708	cmd.exe	77
PID 1708 wrote to memory of 1316	1708	cmd.exe	78
PID 1708 wrote to memory of 1316	1708	cmd.exe	78
PID 1708 wrote to memory of 4980	1708	cmd.exe	79
PID 1708 wrote to memory of 4980	1708	cmd.exe	79
PID 1708 wrote to memory of 1440	1708	cmd.exe	80
PID 1708 wrote to memory of 1440	1708	cmd.exe	80
PID 1708 wrote to memory of 3724	1708	cmd.exe	81
PID 1708 wrote to memory of 3724	1708	cmd.exe	81
PID 1708 wrote to memory of 392	1708	cmd.exe	82
PID 1708 wrote to memory of 392	1708	cmd.exe	82
PID 1708 wrote to memory of 704	1708	cmd.exe	83
PID 1708 wrote to memory of 704	1708	cmd.exe	83
PID 1708 wrote to memory of 3600	1708	cmd.exe	84
PID 1708 wrote to memory of 3600	1708	cmd.exe	84
PID 1708 wrote to memory of 3920	1708	cmd.exe	85
PID 1708 wrote to memory of 3920	1708	cmd.exe	85

C:\Users\Admin\AppData\Local\Temp\Patch.exe
"C:\Users\Admin\AppData\Local\Temp\Patch.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4568
- C:\Users\Admin\AppData\Local\Temp\is-45T3S.tmp\Patch.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-45T3S.tmp\Patch.tmp" /SL5="$300E2,4018567,1141760,C:\Users\Admin\AppData\Local\Temp\Patch.exe"
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4264
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-3OP0N.tmp\nircmd.cmd""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1708
  - - C:\Users\Admin\AppData\Local\Temp\is-3OP0N.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\VEGAS_Pro_21\installation.ini" "Serial" "string" "P3-64979-27462-07906-32757-21318-38872"
      4⤵
      Executes dropped EXE
      PID:2696
  - - C:\Users\Admin\AppData\Local\Temp\is-3OP0N.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\VEGAS_Pro_21\installation.ini" "VersionUnlock" "NumberOfStarts" "0"
      4⤵
      Executes dropped EXE
      PID:1216
  - - C:\Users\Admin\AppData\Local\Temp\is-3OP0N.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\VEGAS_Pro_21\installation.ini" "VersionUnlock" "DontShowNagBox" "1"
      4⤵
      Executes dropped EXE
      PID:1316
  - - C:\Users\Admin\AppData\Local\Temp\is-3OP0N.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\VEGAS_Pro_21\installation.ini" "VersionUnlock" "IsRegisteredUser" "1"
      4⤵
      Executes dropped EXE
      PID:4980
  - - C:\Users\Admin\AppData\Local\Temp\is-3OP0N.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\VEGAS_Pro_21\installation.ini" "VersionUnlock" "UserEMail" "uBusHTShXjdIakxgck01PRO5nuh8YfF4BDS17GWS/So3BnxxO66uwQ3meU0PEMwM"
      4⤵
      Executes dropped EXE
      PID:1440
  - - C:\Users\Admin\AppData\Local\Temp\is-3OP0N.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\DVD_Architect_Pro_7\installation.ini" "Serial" "string" "P3-77020-98979-63411-51090-66867-08191"
      4⤵
      Executes dropped EXE
      PID:3724
  - - C:\Users\Admin\AppData\Local\Temp\is-3OP0N.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\DVD_Architect_Pro_7\installation.ini" "VersionUnlock" "NumberOfStarts" "0"
      4⤵
      Executes dropped EXE
      PID:392
  - - C:\Users\Admin\AppData\Local\Temp\is-3OP0N.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\DVD_Architect_Pro_7\installation.ini" "VersionUnlock" "DontShowNagBox" "1"
      4⤵
      Executes dropped EXE
      PID:704
  - - C:\Users\Admin\AppData\Local\Temp\is-3OP0N.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\DVD_Architect_Pro_7\installation.ini" "VersionUnlock" "IsRegisteredUser" "1"
      4⤵
      Executes dropped EXE
      PID:3600
  - - C:\Users\Admin\AppData\Local\Temp\is-3OP0N.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\DVD_Architect_Pro_7\installation.ini" "VersionUnlock" "UserEMail" "uBusHTShXjdIakxgck01PRO5nuh8YfF4BDS17GWS/So3BnxxO66uwQ3meU0PEMwM"
      4⤵
      Executes dropped EXE
      PID:3920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

Image File Execution Options Injection

1

T1546.012

Privilege Escalation

Event Triggered Execution

1

T1546

Image File Execution Options Injection

1

T1546.012

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-3OP0N.tmp\nircmd.cmd

Filesize
1KB

MD5
e153c13ea7e1ef949a96e82f8e8b8cd8

SHA1
c0ae954eaa465daad882dc1c85ce1b55bb40ad3c

SHA256
2589c520e0e088fb5813d187b46be8a4e28ffbdf138faa4fcaffaa09d3c86268

SHA512
2ae5d7fcb89ad1d25d6444635b43fc36be529779962a52bf6ad40f0dd6b445e58e20ecc5bf472c01002a5a938ca076f431c221ee23557d2903f7bed8f107c803

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-3OP0N.tmp\nircmd.exe

Filesize
114KB

MD5
b417238213efb0d2a23562674406cdf9

SHA1
04bf7acc7d0aa74fa750f7c32fdebbbe1daf46f8

SHA256
5bfa034f7555a38e64c078af71b4ff8c49511579fa826a87661940b7e9a6e333

SHA512
881b420af6e7104ac1f2edf03fc905f30af8ee264d8279f7eeb18e6178e210e063ac3c3d9a47f0c7c36ad04b51773e28595f965b037b0a0305d6c9fdf18e96a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-45T3S.tmp\Patch.tmp

Filesize
3.3MB

MD5
90f19922d1ac82552f5e95036ea90ccb

SHA1
94ef714ab9c01d20371142d34cef56b7886138cd

SHA256
fca2fada59c1a0d1cd30c2023933036af4d3247b1bc0449d439be2d53771fd94

SHA512
39ee8a7e9f534807c1ee06fa0f145ef23990cb278f45a0fc22f71f474c7394540ce4040fa59ced9a0336e2f4fe0bb7603067208d15bc9f9bef1ec45f1adc316e

Download Submit
\Users\Admin\AppData\Local\Temp\is-3OP0N.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
memory/4264-6-0x0000000000400000-0x0000000000760000-memory.dmp

Filesize
3.4MB

Download
memory/4264-44-0x0000000000400000-0x0000000000760000-memory.dmp

Filesize
3.4MB

Download
memory/4568-0-0x0000000000400000-0x0000000000524000-memory.dmp

Filesize
1.1MB

Download
memory/4568-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download
memory/4568-46-0x0000000000400000-0x0000000000524000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads