12557803faee90fd14c0dadfb8e2ef5d0aa5f4e62c2bdb78cf5403fb3a1f4095

Reason

Machine shutdown

General

Target

Microsoft.HEVCVideoExtension_8wekyb3d8bbwe.x86.appx
Size

1.3MB
MD5

ad4806e63780cccd77bd38cf32de1911
SHA1

0f0aa0eac0473c6102b3683206e051dbea3d22d2
SHA256

778741d39a68d7ab07b9088c3057414e65c987f3dc148808283436cbaf91599a
SHA512

d190f3f1d75359cb1eeac660903371f63263a876b17679f81890018e00aac1c0809b971b72e3e42ca9b6ed8c27ec21d9219f7f7c0a3e15a50be7061a62565b79
SSDEEP

24576:HbItCPysz1tzV0TnM5tqfbnec2eVYX97VM/auOUhZp:MtCKszmnM6fbnvVYXxiJX

Score

1^/10

Malware Config

Signatures

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "74"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
900	powershell.exe
900	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	900	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5032	LogonUI.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell start shell:AppsFolder\Microsoft.HEVCVideoExtension_8wekyb3d8bbwe!App
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:900

C:\Windows\system32\Clipup.exe
"C:\Windows\system32\Clipup.exe" -p -pfm Microsoft.HEVCVideoExtension_8wekyb3d8bbwe
1⤵
PID:3652
- C:\Windows\system32\Clipup.exe
  "C:\Windows\system32\Clipup.exe" -p -pfm Microsoft.HEVCVideoExtension_8wekyb3d8bbwe -ppl C:\Windows\TEMP\temC6EA.tmp
  2⤵
  PID:1636

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3920855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wmw2hln4.1pm.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\TEMP\temC6EA.tmp

Filesize
32B

MD5
3a696dbd1a68a556870c204865719787

SHA1
161f8934ed3fc5133b1d3b93c44ee2b8a482725a

SHA256
d049946b7e31069d77406134dfcad4cdab5247777b1a560c7719b47f56dcc194

SHA512
ffabbfc291f644f9b17df375bf4a1635b584ffcea9f544168e1c5b40ad637d29b86e1e8d6c57075eead2a1e0542508cca43204d3b795d5c290ffa7cbff18e529

Download Submit
memory/900-0-0x00007FFE5E013000-0x00007FFE5E015000-memory.dmp

Filesize
8KB

Download
memory/900-10-0x000001FCEC110000-0x000001FCEC132000-memory.dmp

Filesize
136KB

Download
memory/900-11-0x00007FFE5E010000-0x00007FFE5EAD1000-memory.dmp

Filesize
10.8MB

Download
memory/900-12-0x00007FFE5E010000-0x00007FFE5EAD1000-memory.dmp

Filesize
10.8MB

Download
memory/900-14-0x000001FCEC850000-0x000001FCECA6C000-memory.dmp

Filesize
2.1MB

Download
memory/900-15-0x00007FFE5E010000-0x00007FFE5EAD1000-memory.dmp

Filesize
10.8MB

Download
memory/1636-21-0x000001C5770D0000-0x000001C5770E0000-memory.dmp

Filesize
64KB

Download
memory/1636-20-0x000001C5770D0000-0x000001C5770E0000-memory.dmp

Filesize
64KB

Download
memory/1636-19-0x000001C5770D0000-0x000001C5770E0000-memory.dmp

Filesize
64KB

Download
memory/1636-23-0x000001C5770D0000-0x000001C5770E0000-memory.dmp

Filesize
64KB

Download
memory/1636-24-0x000001C5770D0000-0x000001C5770E0000-memory.dmp

Filesize
64KB

Download
memory/3652-18-0x00000158FD6B0000-0x00000158FD6C0000-memory.dmp

Filesize
64KB

Download
memory/3652-16-0x00000158FD6B0000-0x00000158FD6C0000-memory.dmp

Filesize
64KB

Download
memory/3652-26-0x00000158FD6B0000-0x00000158FD6C0000-memory.dmp

Filesize
64KB

Download
memory/3652-27-0x00000158FD6B0000-0x00000158FD6C0000-memory.dmp

Filesize
64KB

Download
memory/3652-17-0x00000158FD6B0000-0x00000158FD6C0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

Errors