b3688db852d9a57834ef758cd54a9507fad2de1854a2faed23bda53411000383

General

Target

patch.exe
Size

4.8MB
MD5

ff4bc7a206b856502dd647e94dec5c8f
SHA1

4a3d0e4fb6fb2a7ac633a288a0d2ce8f14286cda
SHA256

b3688db852d9a57834ef758cd54a9507fad2de1854a2faed23bda53411000383
SHA512

f93170b9fe1b06e9c48a255bede5a1150e8125d09d6c5d1fe8438525b40b648f8bcb86a79d3453d6f45f4392cc946214088ac3aa24ee298ff36579f22da1c1cc
SSDEEP

98304:8L1CNqRBQsRE+Mv2RJlmQJu6A3ty6gVLPysH:81H42RJs+ODzY

Score

9^/10

discovery persistence

Malware Config

Signatures

Detected Nirsoft tools 1 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral1/files/0x000100000002ab53-22.dat	Nirsoft

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable = "1"	patch.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	patch.tmp

Executes dropped EXE 11 IoCs

pid	Process
2200	patch.tmp
4992	nircmd.exe
3796	nircmd.exe
4204	nircmd.exe
2480	nircmd.exe
4676	nircmd.exe
2820	nircmd.exe
2232	nircmd.exe
1920	nircmd.exe
1108	nircmd.exe
3568	nircmd.exe

Loads dropped DLL 1 IoCs

pid	Process
2200	patch.tmp

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VEGAS\VEGAS Pro 22.0\Protein\Protein_x64.4.2.dll	patch.tmp
File opened for modification	C:\Program Files\VEGAS\VEGAS Pro 22.0\vegas220.exe.local\wintrust.dll	patch.tmp
File opened for modification	C:\Program Files\VEGAS\VEGAS Pro 22.0\vegas220.exe.local	patch.tmp
File created	C:\Program Files\VEGAS\VEGAS Pro 22.0\Protein\is-D5FES.tmp	patch.tmp
File created	C:\Program Files\VEGAS\VEGAS Pro 22.0\vegas220.exe.local\is-JQA3P.tmp	patch.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patch.tmp

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2200	patch.tmp
2200	patch.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2200	patch.tmp

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 2200	1868	patch.exe	81
PID 1868 wrote to memory of 2200	1868	patch.exe	81
PID 1868 wrote to memory of 2200	1868	patch.exe	81
PID 2200 wrote to memory of 2380	2200	patch.tmp	83
PID 2200 wrote to memory of 2380	2200	patch.tmp	83
PID 2380 wrote to memory of 4992	2380	cmd.exe	85
PID 2380 wrote to memory of 4992	2380	cmd.exe	85
PID 2380 wrote to memory of 3796	2380	cmd.exe	86
PID 2380 wrote to memory of 3796	2380	cmd.exe	86
PID 2380 wrote to memory of 4204	2380	cmd.exe	87
PID 2380 wrote to memory of 4204	2380	cmd.exe	87
PID 2380 wrote to memory of 2480	2380	cmd.exe	88
PID 2380 wrote to memory of 2480	2380	cmd.exe	88
PID 2380 wrote to memory of 4676	2380	cmd.exe	89
PID 2380 wrote to memory of 4676	2380	cmd.exe	89
PID 2380 wrote to memory of 2820	2380	cmd.exe	90
PID 2380 wrote to memory of 2820	2380	cmd.exe	90
PID 2380 wrote to memory of 2232	2380	cmd.exe	91
PID 2380 wrote to memory of 2232	2380	cmd.exe	91
PID 2380 wrote to memory of 1920	2380	cmd.exe	92
PID 2380 wrote to memory of 1920	2380	cmd.exe	92
PID 2380 wrote to memory of 1108	2380	cmd.exe	93
PID 2380 wrote to memory of 1108	2380	cmd.exe	93
PID 2380 wrote to memory of 3568	2380	cmd.exe	94
PID 2380 wrote to memory of 3568	2380	cmd.exe	94

C:\Users\Admin\AppData\Local\Temp\patch.exe
"C:\Users\Admin\AppData\Local\Temp\patch.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Users\Admin\AppData\Local\Temp\is-CBKH1.tmp\patch.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-CBKH1.tmp\patch.tmp" /SL5="$90298,4046882,1178624,C:\Users\Admin\AppData\Local\Temp\patch.exe"
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2200
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-RVHPB.tmp\nircmd.cmd""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2380
  - - C:\Users\Admin\AppData\Local\Temp\is-RVHPB.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\VEGAS_Pro_22\installation.ini" "Serial" "string" "P3-64979-27462-07906-32757-21318-38872"
      4⤵
      Executes dropped EXE
      PID:4992
  - - C:\Users\Admin\AppData\Local\Temp\is-RVHPB.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\VEGAS_Pro_22\installation.ini" "VersionUnlock" "NumberOfStarts" "0"
      4⤵
      Executes dropped EXE
      PID:3796
  - - C:\Users\Admin\AppData\Local\Temp\is-RVHPB.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\VEGAS_Pro_22\installation.ini" "VersionUnlock" "DontShowNagBox" "1"
      4⤵
      Executes dropped EXE
      PID:4204
  - - C:\Users\Admin\AppData\Local\Temp\is-RVHPB.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\VEGAS_Pro_22\installation.ini" "VersionUnlock" "IsRegisteredUser" "1"
      4⤵
      Executes dropped EXE
      PID:2480
  - - C:\Users\Admin\AppData\Local\Temp\is-RVHPB.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\VEGAS_Pro_22\installation.ini" "VersionUnlock" "UserEMail" "uBusHTShXjdIakxgck01PRO5nuh8YfF4BDS17GWS/So3BnxxO66uwQ3meU0PEMwM"
      4⤵
      Executes dropped EXE
      PID:4676
  - - C:\Users\Admin\AppData\Local\Temp\is-RVHPB.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\DVD_Architect_Pro_7\installation.ini" "Serial" "string" "P3-77020-98979-63411-51090-66867-08191"
      4⤵
      Executes dropped EXE
      PID:2820
  - - C:\Users\Admin\AppData\Local\Temp\is-RVHPB.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\DVD_Architect_Pro_7\installation.ini" "VersionUnlock" "NumberOfStarts" "0"
      4⤵
      Executes dropped EXE
      PID:2232
  - - C:\Users\Admin\AppData\Local\Temp\is-RVHPB.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\DVD_Architect_Pro_7\installation.ini" "VersionUnlock" "DontShowNagBox" "1"
      4⤵
      Executes dropped EXE
      PID:1920
  - - C:\Users\Admin\AppData\Local\Temp\is-RVHPB.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\DVD_Architect_Pro_7\installation.ini" "VersionUnlock" "IsRegisteredUser" "1"
      4⤵
      Executes dropped EXE
      PID:1108
  - - C:\Users\Admin\AppData\Local\Temp\is-RVHPB.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\DVD_Architect_Pro_7\installation.ini" "VersionUnlock" "UserEMail" "uBusHTShXjdIakxgck01PRO5nuh8YfF4BDS17GWS/So3BnxxO66uwQ3meU0PEMwM"
      4⤵
      Executes dropped EXE
      PID:3568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

Image File Execution Options Injection

1

T1546.012

Privilege Escalation

Event Triggered Execution

1

T1546

Image File Execution Options Injection

1

T1546.012

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-CBKH1.tmp\patch.tmp

Filesize
3.5MB

MD5
cd0e5319f235a458802e284c1d7fb7c7

SHA1
716d6347b01df04b96c32db414361ae828dec3d9

SHA256
7a8924b753dbbd168b822d7c483f0150697c6bb31d19cfd1fd872f1090254fcf

SHA512
5d3873d79783e7f123f618e41087c59b59ac4e5e932057bc649415d34b4465b29ba84d6390ca2cbea9de2a33f5b7f60300fd722e5ca78d0a9b8d83a804a68406

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-RVHPB.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-RVHPB.tmp\nircmd.cmd

Filesize
1KB

MD5
14d3f2a3efbfe535fa0958da17d565fa

SHA1
958c79de8f3dc821d4c9c89e1f3b92bc7c48637a

SHA256
915357dfb71b907b64b18a198160e8962ffaaed4d5278d5ac4ee0208b6f089c0

SHA512
79ae0e1c73558546d7f61ae5ff0576ddb303e15f3a2be549a0bf32b54f0336bb20357203796341646a53b6c8a6449ccbd9c63174db16b5310ebdbe976aadae75

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-RVHPB.tmp\nircmd.exe

Filesize
114KB

MD5
b417238213efb0d2a23562674406cdf9

SHA1
04bf7acc7d0aa74fa750f7c32fdebbbe1daf46f8

SHA256
5bfa034f7555a38e64c078af71b4ff8c49511579fa826a87661940b7e9a6e333

SHA512
881b420af6e7104ac1f2edf03fc905f30af8ee264d8279f7eeb18e6178e210e063ac3c3d9a47f0c7c36ad04b51773e28595f965b037b0a0305d6c9fdf18e96a3

Download Submit
memory/1868-0-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download
memory/1868-2-0x0000000000401000-0x00000000004C1000-memory.dmp

Filesize
768KB

Download
memory/1868-47-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download
memory/2200-8-0x0000000000400000-0x000000000078B000-memory.dmp

Filesize
3.5MB

Download
memory/2200-45-0x0000000000400000-0x000000000078B000-memory.dmp

Filesize
3.5MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads