73f5eee95f0d5250f5d2f7a29702700537ebe6c08861d4ddfefc09d485f0f65e

General

Target

Patch.exe
Size

4.6MB
MD5

4a027f5b895f161a0d0e26f8ec6f31a7
SHA1

2d8aa07828c92d4d9d85fc62ba82f0fe0bb5a789
SHA256

73f5eee95f0d5250f5d2f7a29702700537ebe6c08861d4ddfefc09d485f0f65e
SHA512

9b12840d6f2f9a277e7edded5830daf70713ea3f90ddf324bece98616d716400dc0247a47dc9d016fb02f9803fb0a2e2853f4a56e752b13a704132d4acfa23cb
SSDEEP

98304:0kLEAGg00ojGjm4EC/qQb4zldELsSqr7jkie3t:DEzg7AGUqqXHPjze3t

Score

9^/10

persistence

Malware Config

Signatures

Detected Nirsoft tools 1 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/files/0x000700000002349c-26.dat	Nirsoft

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	Patch.tmp
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable = "1"	Patch.tmp

Executes dropped EXE 11 IoCs

pid	Process
2256	Patch.tmp
3796	nircmd.exe
3448	nircmd.exe
3584	nircmd.exe
4836	nircmd.exe
1536	nircmd.exe
4568	nircmd.exe
1108	nircmd.exe
2060	nircmd.exe
4220	nircmd.exe
3576	nircmd.exe

Loads dropped DLL 1 IoCs

pid	Process
2256	Patch.tmp

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\VEGAS\VEGAS Pro 21.0\vegas210.exe.local\is-U678Q.tmp	Patch.tmp
File opened for modification	C:\Program Files\VEGAS\VEGAS Pro 21.0\Protein\Protein_x64.4.2.dll	Patch.tmp
File opened for modification	C:\Program Files\VEGAS\VEGAS Pro 21.0\vegas210.exe.local\wintrust.dll	Patch.tmp
File opened for modification	C:\Program Files\VEGAS\VEGAS Pro 21.0\vegas210.exe.local	Patch.tmp
File created	C:\Program Files\VEGAS\VEGAS Pro 21.0\Protein\is-EMHLE.tmp	Patch.tmp

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2256	Patch.tmp
2256	Patch.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2256	Patch.tmp

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 2256	1644	Patch.exe	85
PID 1644 wrote to memory of 2256	1644	Patch.exe	85
PID 1644 wrote to memory of 2256	1644	Patch.exe	85
PID 2256 wrote to memory of 912	2256	Patch.tmp	90
PID 2256 wrote to memory of 912	2256	Patch.tmp	90
PID 912 wrote to memory of 3796	912	cmd.exe	92
PID 912 wrote to memory of 3796	912	cmd.exe	92
PID 912 wrote to memory of 3448	912	cmd.exe	93
PID 912 wrote to memory of 3448	912	cmd.exe	93
PID 912 wrote to memory of 3584	912	cmd.exe	94
PID 912 wrote to memory of 3584	912	cmd.exe	94
PID 912 wrote to memory of 4836	912	cmd.exe	95
PID 912 wrote to memory of 4836	912	cmd.exe	95
PID 912 wrote to memory of 1536	912	cmd.exe	96
PID 912 wrote to memory of 1536	912	cmd.exe	96
PID 912 wrote to memory of 4568	912	cmd.exe	97
PID 912 wrote to memory of 4568	912	cmd.exe	97
PID 912 wrote to memory of 1108	912	cmd.exe	98
PID 912 wrote to memory of 1108	912	cmd.exe	98
PID 912 wrote to memory of 2060	912	cmd.exe	99
PID 912 wrote to memory of 2060	912	cmd.exe	99
PID 912 wrote to memory of 4220	912	cmd.exe	100
PID 912 wrote to memory of 4220	912	cmd.exe	100
PID 912 wrote to memory of 3576	912	cmd.exe	101
PID 912 wrote to memory of 3576	912	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\Patch.exe
"C:\Users\Admin\AppData\Local\Temp\Patch.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Users\Admin\AppData\Local\Temp\is-K4C3O.tmp\Patch.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-K4C3O.tmp\Patch.tmp" /SL5="$80238,4018567,1141760,C:\Users\Admin\AppData\Local\Temp\Patch.exe"
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2256
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-8BKCD.tmp\nircmd.cmd""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:912
  - - C:\Users\Admin\AppData\Local\Temp\is-8BKCD.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\VEGAS_Pro_21\installation.ini" "Serial" "string" "P3-64979-27462-07906-32757-21318-38872"
      4⤵
      Executes dropped EXE
      PID:3796
  - - C:\Users\Admin\AppData\Local\Temp\is-8BKCD.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\VEGAS_Pro_21\installation.ini" "VersionUnlock" "NumberOfStarts" "0"
      4⤵
      Executes dropped EXE
      PID:3448
  - - C:\Users\Admin\AppData\Local\Temp\is-8BKCD.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\VEGAS_Pro_21\installation.ini" "VersionUnlock" "DontShowNagBox" "1"
      4⤵
      Executes dropped EXE
      PID:3584
  - - C:\Users\Admin\AppData\Local\Temp\is-8BKCD.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\VEGAS_Pro_21\installation.ini" "VersionUnlock" "IsRegisteredUser" "1"
      4⤵
      Executes dropped EXE
      PID:4836
  - - C:\Users\Admin\AppData\Local\Temp\is-8BKCD.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\VEGAS_Pro_21\installation.ini" "VersionUnlock" "UserEMail" "uBusHTShXjdIakxgck01PRO5nuh8YfF4BDS17GWS/So3BnxxO66uwQ3meU0PEMwM"
      4⤵
      Executes dropped EXE
      PID:1536
  - - C:\Users\Admin\AppData\Local\Temp\is-8BKCD.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\DVD_Architect_Pro_7\installation.ini" "Serial" "string" "P3-77020-98979-63411-51090-66867-08191"
      4⤵
      Executes dropped EXE
      PID:4568
  - - C:\Users\Admin\AppData\Local\Temp\is-8BKCD.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\DVD_Architect_Pro_7\installation.ini" "VersionUnlock" "NumberOfStarts" "0"
      4⤵
      Executes dropped EXE
      PID:1108
  - - C:\Users\Admin\AppData\Local\Temp\is-8BKCD.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\DVD_Architect_Pro_7\installation.ini" "VersionUnlock" "DontShowNagBox" "1"
      4⤵
      Executes dropped EXE
      PID:2060
  - - C:\Users\Admin\AppData\Local\Temp\is-8BKCD.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\DVD_Architect_Pro_7\installation.ini" "VersionUnlock" "IsRegisteredUser" "1"
      4⤵
      Executes dropped EXE
      PID:4220
  - - C:\Users\Admin\AppData\Local\Temp\is-8BKCD.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\DVD_Architect_Pro_7\installation.ini" "VersionUnlock" "UserEMail" "uBusHTShXjdIakxgck01PRO5nuh8YfF4BDS17GWS/So3BnxxO66uwQ3meU0PEMwM"
      4⤵
      Executes dropped EXE
      PID:3576

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

Image File Execution Options Injection

1

T1546.012

Privilege Escalation

Event Triggered Execution

1

T1546

Image File Execution Options Injection

1

T1546.012

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-8BKCD.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-8BKCD.tmp\nircmd.cmd

Filesize
1KB

MD5
e153c13ea7e1ef949a96e82f8e8b8cd8

SHA1
c0ae954eaa465daad882dc1c85ce1b55bb40ad3c

SHA256
2589c520e0e088fb5813d187b46be8a4e28ffbdf138faa4fcaffaa09d3c86268

SHA512
2ae5d7fcb89ad1d25d6444635b43fc36be529779962a52bf6ad40f0dd6b445e58e20ecc5bf472c01002a5a938ca076f431c221ee23557d2903f7bed8f107c803

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-8BKCD.tmp\nircmd.exe

Filesize
114KB

MD5
b417238213efb0d2a23562674406cdf9

SHA1
04bf7acc7d0aa74fa750f7c32fdebbbe1daf46f8

SHA256
5bfa034f7555a38e64c078af71b4ff8c49511579fa826a87661940b7e9a6e333

SHA512
881b420af6e7104ac1f2edf03fc905f30af8ee264d8279f7eeb18e6178e210e063ac3c3d9a47f0c7c36ad04b51773e28595f965b037b0a0305d6c9fdf18e96a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-K4C3O.tmp\Patch.tmp

Filesize
3.3MB

MD5
90f19922d1ac82552f5e95036ea90ccb

SHA1
94ef714ab9c01d20371142d34cef56b7886138cd

SHA256
fca2fada59c1a0d1cd30c2023933036af4d3247b1bc0449d439be2d53771fd94

SHA512
39ee8a7e9f534807c1ee06fa0f145ef23990cb278f45a0fc22f71f474c7394540ce4040fa59ced9a0336e2f4fe0bb7603067208d15bc9f9bef1ec45f1adc316e

Download Submit
memory/1644-0-0x0000000000400000-0x0000000000524000-memory.dmp

Filesize
1.1MB

Download
memory/1644-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download
memory/1644-11-0x0000000000400000-0x0000000000524000-memory.dmp

Filesize
1.1MB

Download
memory/1644-51-0x0000000000400000-0x0000000000524000-memory.dmp

Filesize
1.1MB

Download
memory/2256-6-0x0000000000400000-0x0000000000760000-memory.dmp

Filesize
3.4MB

Download
memory/2256-12-0x0000000000400000-0x0000000000760000-memory.dmp

Filesize
3.4MB

Download
memory/2256-23-0x0000000000400000-0x0000000000760000-memory.dmp

Filesize
3.4MB

Download
memory/2256-49-0x0000000000400000-0x0000000000760000-memory.dmp

Filesize
3.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads