Analysis
- max time kernel
136s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
05/10/2024, 18:27
General
- Target Microsoft.HEVCVideoExtension_8wekyb3d8bbwe.x64.appx
- Size 2.4MB
- Sample241005-w37bdatejd
- SHA256 6513eb4130f3538f4ba95426fcb397cae1bdf75ca584a8e109a67b28d8cb34e1
Malware Config
Signatures
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell start shell:AppsFolder\Microsoft.HEVCVideoExtension_8wekyb3d8bbwe!App1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\Clipup.exe"C:\Windows\system32\Clipup.exe" -p -pfm Microsoft.HEVCVideoExtension_8wekyb3d8bbwe1⤵
-
C:\Windows\system32\Clipup.exe"C:\Windows\system32\Clipup.exe" -p -pfm Microsoft.HEVCVideoExtension_8wekyb3d8bbwe -ppl C:\Windows\TEMP\tem9E63.tmp2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_iiibbhyn.zpb.ps1
tem9E63.tmp
memory/1720-0-0x00007FFACED13000-0x00007FFACED15000-memory.dmp
memory/1720-10-0x000001BCB1A40000-0x000001BCB1A62000-memory.dmp
memory/1720-11-0x00007FFACED10000-0x00007FFACF7D1000-memory.dmp
memory/1720-12-0x00007FFACED10000-0x00007FFACF7D1000-memory.dmp
memory/1720-14-0x00007FFACED10000-0x00007FFACF7D1000-memory.dmp
memory/3736-22-0x000001DF12B60000-0x000001DF12B70000-memory.dmp
memory/3736-19-0x000001DF12B60000-0x000001DF12B70000-memory.dmp
memory/3736-20-0x000001DF12B60000-0x000001DF12B70000-memory.dmp
memory/3736-18-0x000001DF12B60000-0x000001DF12B70000-memory.dmp
memory/3736-23-0x000001DF12B60000-0x000001DF12B70000-memory.dmp
memory/4004-15-0x0000021957930000-0x0000021957940000-memory.dmp
memory/4004-16-0x0000021957930000-0x0000021957940000-memory.dmp
memory/4004-26-0x0000021957930000-0x0000021957940000-memory.dmp
memory/4004-25-0x0000021957930000-0x0000021957940000-memory.dmp
memory/4004-17-0x0000021957930000-0x0000021957940000-memory.dmp