b3688db852d9a57834ef758cd54a9507fad2de1854a2faed23bda53411000383

Reason

Machine shutdown

General

Target

patch.exe
Size

4.8MB
MD5

ff4bc7a206b856502dd647e94dec5c8f
SHA1

4a3d0e4fb6fb2a7ac633a288a0d2ce8f14286cda
SHA256

b3688db852d9a57834ef758cd54a9507fad2de1854a2faed23bda53411000383
SHA512

f93170b9fe1b06e9c48a255bede5a1150e8125d09d6c5d1fe8438525b40b648f8bcb86a79d3453d6f45f4392cc946214088ac3aa24ee298ff36579f22da1c1cc
SSDEEP

98304:8L1CNqRBQsRE+Mv2RJlmQJu6A3ty6gVLPysH:81H42RJs+ODzY

Score

9^/10

discovery persistence

Malware Config

Signatures

Detected Nirsoft tools 1 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral1/files/0x000100000002ab3b-21.dat	Nirsoft

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	patch.tmp
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable = "1"	patch.tmp

Executes dropped EXE 11 IoCs

pid	Process
4196	patch.tmp
5096	nircmd.exe
2800	nircmd.exe
2860	nircmd.exe
4124	nircmd.exe
2304	nircmd.exe
3816	nircmd.exe
4836	nircmd.exe
1092	nircmd.exe
3892	nircmd.exe
1144	nircmd.exe

Loads dropped DLL 1 IoCs

pid	Process
4196	patch.tmp

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VEGAS\VEGAS Pro 22.0\vegas220.exe.local	patch.tmp
File created	C:\Program Files\VEGAS\VEGAS Pro 22.0\Protein\is-6QSV7.tmp	patch.tmp
File created	C:\Program Files\VEGAS\VEGAS Pro 22.0\vegas220.exe.local\is-NL0TH.tmp	patch.tmp
File opened for modification	C:\Program Files\VEGAS\VEGAS Pro 22.0\Protein\Protein_x64.4.2.dll	patch.tmp
File opened for modification	C:\Program Files\VEGAS\VEGAS Pro 22.0\vegas220.exe.local\wintrust.dll	patch.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patch.tmp

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "244"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4196	patch.tmp
4196	patch.tmp

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4368	patch.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4196	patch.tmp

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2040	LogonUI.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4368 wrote to memory of 4196	4368	patch.exe	81
PID 4368 wrote to memory of 4196	4368	patch.exe	81
PID 4368 wrote to memory of 4196	4368	patch.exe	81
PID 4196 wrote to memory of 3360	4196	patch.tmp	82
PID 4196 wrote to memory of 3360	4196	patch.tmp	82
PID 3360 wrote to memory of 5096	3360	cmd.exe	84
PID 3360 wrote to memory of 5096	3360	cmd.exe	84
PID 3360 wrote to memory of 2800	3360	cmd.exe	85
PID 3360 wrote to memory of 2800	3360	cmd.exe	85
PID 3360 wrote to memory of 2860	3360	cmd.exe	86
PID 3360 wrote to memory of 2860	3360	cmd.exe	86
PID 3360 wrote to memory of 4124	3360	cmd.exe	87
PID 3360 wrote to memory of 4124	3360	cmd.exe	87
PID 3360 wrote to memory of 2304	3360	cmd.exe	88
PID 3360 wrote to memory of 2304	3360	cmd.exe	88
PID 3360 wrote to memory of 3816	3360	cmd.exe	89
PID 3360 wrote to memory of 3816	3360	cmd.exe	89
PID 3360 wrote to memory of 4836	3360	cmd.exe	90
PID 3360 wrote to memory of 4836	3360	cmd.exe	90
PID 3360 wrote to memory of 1092	3360	cmd.exe	91
PID 3360 wrote to memory of 1092	3360	cmd.exe	91
PID 3360 wrote to memory of 3892	3360	cmd.exe	92
PID 3360 wrote to memory of 3892	3360	cmd.exe	92
PID 3360 wrote to memory of 1144	3360	cmd.exe	93
PID 3360 wrote to memory of 1144	3360	cmd.exe	93

C:\Users\Admin\AppData\Local\Temp\patch.exe
"C:\Users\Admin\AppData\Local\Temp\patch.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4368
- C:\Users\Admin\AppData\Local\Temp\is-24T8G.tmp\patch.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-24T8G.tmp\patch.tmp" /SL5="$502D2,4046882,1178624,C:\Users\Admin\AppData\Local\Temp\patch.exe"
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4196
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-D7C1D.tmp\nircmd.cmd""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3360
  - - C:\Users\Admin\AppData\Local\Temp\is-D7C1D.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\VEGAS_Pro_22\installation.ini" "Serial" "string" "P3-64979-27462-07906-32757-21318-38872"
      4⤵
      Executes dropped EXE
      PID:5096
  - - C:\Users\Admin\AppData\Local\Temp\is-D7C1D.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\VEGAS_Pro_22\installation.ini" "VersionUnlock" "NumberOfStarts" "0"
      4⤵
      Executes dropped EXE
      PID:2800
  - - C:\Users\Admin\AppData\Local\Temp\is-D7C1D.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\VEGAS_Pro_22\installation.ini" "VersionUnlock" "DontShowNagBox" "1"
      4⤵
      Executes dropped EXE
      PID:2860
  - - C:\Users\Admin\AppData\Local\Temp\is-D7C1D.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\VEGAS_Pro_22\installation.ini" "VersionUnlock" "IsRegisteredUser" "1"
      4⤵
      Executes dropped EXE
      PID:4124
  - - C:\Users\Admin\AppData\Local\Temp\is-D7C1D.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\VEGAS_Pro_22\installation.ini" "VersionUnlock" "UserEMail" "uBusHTShXjdIakxgck01PRO5nuh8YfF4BDS17GWS/So3BnxxO66uwQ3meU0PEMwM"
      4⤵
      Executes dropped EXE
      PID:2304
  - - C:\Users\Admin\AppData\Local\Temp\is-D7C1D.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\DVD_Architect_Pro_7\installation.ini" "Serial" "string" "P3-77020-98979-63411-51090-66867-08191"
      4⤵
      Executes dropped EXE
      PID:3816
  - - C:\Users\Admin\AppData\Local\Temp\is-D7C1D.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\DVD_Architect_Pro_7\installation.ini" "VersionUnlock" "NumberOfStarts" "0"
      4⤵
      Executes dropped EXE
      PID:4836
  - - C:\Users\Admin\AppData\Local\Temp\is-D7C1D.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\DVD_Architect_Pro_7\installation.ini" "VersionUnlock" "DontShowNagBox" "1"
      4⤵
      Executes dropped EXE
      PID:1092
  - - C:\Users\Admin\AppData\Local\Temp\is-D7C1D.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\DVD_Architect_Pro_7\installation.ini" "VersionUnlock" "IsRegisteredUser" "1"
      4⤵
      Executes dropped EXE
      PID:3892
  - - C:\Users\Admin\AppData\Local\Temp\is-D7C1D.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\DVD_Architect_Pro_7\installation.ini" "VersionUnlock" "UserEMail" "uBusHTShXjdIakxgck01PRO5nuh8YfF4BDS17GWS/So3BnxxO66uwQ3meU0PEMwM"
      4⤵
      Executes dropped EXE
      PID:1144

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a22855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

Image File Execution Options Injection

1

T1546.012

Privilege Escalation

Event Triggered Execution

1

T1546

Image File Execution Options Injection

1

T1546.012

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-24T8G.tmp\patch.tmp

Filesize
3.5MB

MD5
cd0e5319f235a458802e284c1d7fb7c7

SHA1
716d6347b01df04b96c32db414361ae828dec3d9

SHA256
7a8924b753dbbd168b822d7c483f0150697c6bb31d19cfd1fd872f1090254fcf

SHA512
5d3873d79783e7f123f618e41087c59b59ac4e5e932057bc649415d34b4465b29ba84d6390ca2cbea9de2a33f5b7f60300fd722e5ca78d0a9b8d83a804a68406

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-D7C1D.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-D7C1D.tmp\nircmd.cmd

Filesize
1KB

MD5
14d3f2a3efbfe535fa0958da17d565fa

SHA1
958c79de8f3dc821d4c9c89e1f3b92bc7c48637a

SHA256
915357dfb71b907b64b18a198160e8962ffaaed4d5278d5ac4ee0208b6f089c0

SHA512
79ae0e1c73558546d7f61ae5ff0576ddb303e15f3a2be549a0bf32b54f0336bb20357203796341646a53b6c8a6449ccbd9c63174db16b5310ebdbe976aadae75

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-D7C1D.tmp\nircmd.exe

Filesize
114KB

MD5
b417238213efb0d2a23562674406cdf9

SHA1
04bf7acc7d0aa74fa750f7c32fdebbbe1daf46f8

SHA256
5bfa034f7555a38e64c078af71b4ff8c49511579fa826a87661940b7e9a6e333

SHA512
881b420af6e7104ac1f2edf03fc905f30af8ee264d8279f7eeb18e6178e210e063ac3c3d9a47f0c7c36ad04b51773e28595f965b037b0a0305d6c9fdf18e96a3

Download Submit
memory/2040-62-0x00007FF86FD40000-0x00007FF86FD71000-memory.dmp

Filesize
196KB

Download
memory/2040-59-0x00007FF86FD10000-0x00007FF86FD39000-memory.dmp

Filesize
164KB

Download
memory/2040-52-0x00007FF86F6B0000-0x00007FF86FA28000-memory.dmp

Filesize
3.5MB

Download
memory/4196-10-0x0000000000400000-0x000000000078B000-memory.dmp

Filesize
3.5MB

Download
memory/4196-44-0x0000000000400000-0x000000000078B000-memory.dmp

Filesize
3.5MB

Download
memory/4368-0-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download
memory/4368-2-0x0000000000401000-0x00000000004C1000-memory.dmp

Filesize
768KB

Download
memory/4368-46-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads