172b929bfe52afd0d081d53ffc80794182a9f847ee592aa98596b407071290ba

Analysis

max time kernel
46s
max time network
51s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22-07-2024 10:15

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

video_editor_x64.exe
Size

115.9MB
MD5

d75d43dfafcf205b58e58c4246fa1c5e
SHA1

2be837c1f51acc8df691e16718bbabf86d540e4e
SHA256

172b929bfe52afd0d081d53ffc80794182a9f847ee592aa98596b407071290ba
SHA512

c3626ae20c9cd3f2f2925e2a289d86b35dea1a63bd5e9c85ff34c5fa444303de87692e7a6382bdcfb86ad6404f1e8681af2ce0993e3c79a5b1340f2b85f7f9b7
SSDEEP

1572864:q2jCC8z87Jw5P1iZig45roXcWPcypH3L3cD0OqbbamxZnmumEsy53v:qHYi5P1iZuoBpH3LMDEZnmumEsW3v

Score

4^/10

execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2656	video_editor_x64.tmp

Loads dropped DLL 1 IoCs

pid	Process
2180	video_editor_x64.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	2164	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2164	AUDIODG.EXE
Token: 33	2164	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2164	AUDIODG.EXE

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2656	2180	video_editor_x64.exe	30
PID 2180 wrote to memory of 2656	2180	video_editor_x64.exe	30
PID 2180 wrote to memory of 2656	2180	video_editor_x64.exe	30
PID 2180 wrote to memory of 2656	2180	video_editor_x64.exe	30
PID 2180 wrote to memory of 2656	2180	video_editor_x64.exe	30
PID 2180 wrote to memory of 2656	2180	video_editor_x64.exe	30
PID 2180 wrote to memory of 2656	2180	video_editor_x64.exe	30

C:\Users\Admin\AppData\Local\Temp\video_editor_x64.exe
"C:\Users\Admin\AppData\Local\Temp\video_editor_x64.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Users\Admin\AppData\Local\Temp\is-5UETO.tmp\video_editor_x64.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-5UETO.tmp\video_editor_x64.tmp" /SL5="$4001C,120593237,832512,C:\Users\Admin\AppData\Local\Temp\video_editor_x64.exe"
  2⤵
  - Executes dropped EXE
  PID:2656

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2908

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\GetSync.js"
1⤵
PID:2872

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2888

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:1528

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x5b8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2164

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\is-5UETO.tmp\video_editor_x64.tmp

Filesize
3.1MB

MD5
6c0fc539b631ec1b0d230191c121692a

SHA1
e7efd323b40c9bdf5bd5797def9daa0eacb763f7

SHA256
aa66ccaa90328fda8662e54f64337db9f3b07072a4316aa929121c8865b488f1

SHA512
3d5830e20e7dd37be62ac3a154c393029c52c8fbaee8952fb4e1b50e75a178fd4ddd85649b8a110edb097757174dcfb0dba48590c7be06c1f0d55bd65c909c8a

Download Submit
memory/2180-0-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2180-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download
memory/2180-11-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2656-8-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/2656-9-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download