Analysis

  • max time kernel
    141s
  • max time network
    130s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    09/09/2024, 19:58

General

  • Target

    HA_MagicVideoStudio8.0420_LRH.exe

  • Size

    15.2MB

  • MD5

    56077787ab963f2ae209219b24848158

  • SHA1

    cae00c559768062107541a5218f8f6e14b90c40e

  • SHA256

    2d45e579fa576678827ce536f47f656c823f56f50ca9c0b9a9d8ac989debf22d

  • SHA512

    6395d4424f1b35d7517aab44f46ff6ece207acd971450e9d5437e1e9158d562e9f74b1898915bb19edf23f1a7325418fcdc8214271be35c834aa32b26746eee9

  • SSDEEP

    393216:ntyFmKhV3tsZwGs/KQXk/Zu0BG55uH46zK6:omKhhtsC/KuZIGfh6zK6

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\HA_MagicVideoStudio8.0420_LRH.exe
    "C:\Users\Admin\AppData\Local\Temp\HA_MagicVideoStudio8.0420_LRH.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: GetForegroundWindowSpam
    PID:2260

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsz5821.tmp\ioSpecial.ini

    Filesize

    675B

    MD5

    73b084c869dc0b01d3f17d1455efac3d

    SHA1

    faeace58bd194b3de21dc47fea520d01b2ee5fe2

    SHA256

    a746533b6bbc17054c92cf3161c845854bc2f40d346e5f0ce838497a1aea868a

    SHA512

    32146543577aaa8bcab7a5ccc8417273723fb4400e322895ebd477be7f72259c18da37d5b73af58a855cdb83c7e8463a1a75a11dd8792b44de722c739cd24816

  • C:\Users\Admin\AppData\Local\Temp\nsz5821.tmp\ioSpecial.ini

    Filesize

    688B

    MD5

    62d63ce3aa02e9a1cafbd8da1243b6e1

    SHA1

    68bc7334b956fb6b4974d41274191f04148fd8b4

    SHA256

    e6e688b0971ee520f8c2c912408811e0cc8009b4c417e30aa2e1775bd4c0875c

    SHA512

    4ae112db58d76a426db754ac3ef6d9e158b3dc08c4f33a85cc8e1c9552d71f7f992098b3a51a6a7191b635ed96d0ff1111174e82749562554e318d838bf66fc5

  • \Users\Admin\AppData\Local\Temp\nsz5821.tmp\brandingurl.dll

    Filesize

    3KB

    MD5

    9c3488b5e9655d1837c3963ecec33f70

    SHA1

    f0fa9b4c29e75c6e4419c4633d09f2797aee2ef3

    SHA256

    05ef4beb7fab9d04c1fb251874166fa2d73a34b4a7f2b145d37a2fd00c88979a

    SHA512

    6af9f88d65d2279a71620f2a656062b1737b3a9a1692ed4e5887bdee891ce08d21c5c0b25ab3acbe6da9fe255dcd7f8a517c2751e73dc56add216740c945e4a7

  • \Users\Admin\AppData\Local\Temp\nsz5821.tmp\installoptions.dll

    Filesize

    14KB

    MD5

    99a01229bfad8d31bf0ccf636f993393

    SHA1

    699c225ac447723d20bb786d18f4c95f5fd8951c

    SHA256

    58b6827090451254627c340ddc941cfdd87930606e3859bd29495ece878ca115

    SHA512

    bbf78a03004347cae25fab552e846dfd4873b39a2cc3613bc05a328a5a6cff026b13fa0653d3607197faccbabd4a9d97df2948bcf2ef5414e7d08cdfad6bbe15

  • memory/2260-0-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2260-89-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB