12557803faee90fd14c0dadfb8e2ef5d0aa5f4e62c2bdb78cf5403fb3a1f4095

Reason

Machine shutdown

General

Target

Microsoft.HEVCVideoExtension_8wekyb3d8bbwe.x64.appx
Size

2.4MB
MD5

36805f5285de9518999891faa52bee57
SHA1

54c2e9d8ee62b2cf871d6bfdf16ac28001c99f9f
SHA256

61a7ff3895181e5185d175aa9bb1c7bed8bfac36bb788eaeed3fb5869f391764
SHA512

02fc3cd0683e8bbd6b381e5964672c4b6ac2ba9ee60d40d70fb0ef05fd9031e52188404cfd0b022511f527151007f01664f967fe37cd357624203e22fcc86f1d
SSDEEP

49152:VMAIqPpAv4j+xcd8oRjaJ7szmnM6fbnshDsX0VYXxiJUFROT:VMAIE+AjIcWoJaQ2pnGDsX0vU3OT

Score

1^/10

Malware Config

Signatures

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "88"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1232	powershell.exe
1232	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1232	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3824	LogonUI.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell start shell:AppsFolder\Microsoft.HEVCVideoExtension_8wekyb3d8bbwe!App
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1232

C:\Windows\system32\Clipup.exe
"C:\Windows\system32\Clipup.exe" -p -pfm Microsoft.HEVCVideoExtension_8wekyb3d8bbwe
1⤵
PID:4740
- C:\Windows\system32\Clipup.exe
  "C:\Windows\system32\Clipup.exe" -p -pfm Microsoft.HEVCVideoExtension_8wekyb3d8bbwe -ppl C:\Windows\TEMP\temD050.tmp
  2⤵
  PID:4420

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa392c055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lvrmyznv.ujn.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\TEMP\temD050.tmp

Filesize
32B

MD5
3a696dbd1a68a556870c204865719787

SHA1
161f8934ed3fc5133b1d3b93c44ee2b8a482725a

SHA256
d049946b7e31069d77406134dfcad4cdab5247777b1a560c7719b47f56dcc194

SHA512
ffabbfc291f644f9b17df375bf4a1635b584ffcea9f544168e1c5b40ad637d29b86e1e8d6c57075eead2a1e0542508cca43204d3b795d5c290ffa7cbff18e529

Download Submit
memory/1232-0-0x00007FFCB4EC3000-0x00007FFCB4EC5000-memory.dmp

Filesize
8KB

Download
memory/1232-10-0x00000249B7EC0000-0x00000249B7EE2000-memory.dmp

Filesize
136KB

Download
memory/1232-11-0x00007FFCB4EC0000-0x00007FFCB5981000-memory.dmp

Filesize
10.8MB

Download
memory/1232-12-0x00007FFCB4EC0000-0x00007FFCB5981000-memory.dmp

Filesize
10.8MB

Download
memory/1232-14-0x00007FFCB4EC0000-0x00007FFCB5981000-memory.dmp

Filesize
10.8MB

Download
memory/4420-23-0x000002B99A050000-0x000002B99A060000-memory.dmp

Filesize
64KB

Download
memory/4420-19-0x000002B99A050000-0x000002B99A060000-memory.dmp

Filesize
64KB

Download
memory/4420-18-0x000002B99A050000-0x000002B99A060000-memory.dmp

Filesize
64KB

Download
memory/4420-20-0x000002B99A050000-0x000002B99A060000-memory.dmp

Filesize
64KB

Download
memory/4420-22-0x000002B99A050000-0x000002B99A060000-memory.dmp

Filesize
64KB

Download
memory/4740-15-0x0000022E114A0000-0x0000022E114B0000-memory.dmp

Filesize
64KB

Download
memory/4740-16-0x0000022E114A0000-0x0000022E114B0000-memory.dmp

Filesize
64KB

Download
memory/4740-26-0x0000022E114A0000-0x0000022E114B0000-memory.dmp

Filesize
64KB

Download
memory/4740-25-0x0000022E114A0000-0x0000022E114B0000-memory.dmp

Filesize
64KB

Download
memory/4740-17-0x0000022E114A0000-0x0000022E114B0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

Errors