Analysis
- max time kernel
91s - max time network
159s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
05/10/2024, 18:27
General
- Target Microsoft.HEVCVideoExtension_8wekyb3d8bbwe.x86.appx
- Size 1.3MB
- Sample241005-w37bdatejd
- SHA256 5645773f3c485c4b7fffa7b29eb827fb6c71e1a9cbdcf770cd9f70e4c504095b
Malware Config
Signatures
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell start shell:AppsFolder\Microsoft.HEVCVideoExtension_8wekyb3d8bbwe!App1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\Clipup.exe"C:\Windows\system32\Clipup.exe" -p -pfm Microsoft.HEVCVideoExtension_8wekyb3d8bbwe1⤵
-
C:\Windows\system32\Clipup.exe"C:\Windows\system32\Clipup.exe" -p -pfm Microsoft.HEVCVideoExtension_8wekyb3d8bbwe -ppl C:\Windows\TEMP\temD84F.tmp2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_igbxp0ox.nb5.ps1
temD84F.tmp
memory/688-17-0x000002173F7F0000-0x000002173F800000-memory.dmp
memory/688-27-0x000002173F7F0000-0x000002173F800000-memory.dmp
memory/688-26-0x000002173F7F0000-0x000002173F800000-memory.dmp
memory/688-15-0x000002173F7F0000-0x000002173F800000-memory.dmp
memory/688-16-0x000002173F7F0000-0x000002173F800000-memory.dmp
memory/1948-22-0x0000027986D60000-0x0000027986D70000-memory.dmp
memory/1948-18-0x0000027986D60000-0x0000027986D70000-memory.dmp
memory/1948-20-0x0000027986D60000-0x0000027986D70000-memory.dmp
memory/1948-19-0x0000027986D60000-0x0000027986D70000-memory.dmp
memory/1948-23-0x0000027986D60000-0x0000027986D70000-memory.dmp
memory/1948-24-0x0000027986D60000-0x0000027986D70000-memory.dmp
memory/2584-14-0x00007FFDA2370000-0x00007FFDA2E31000-memory.dmp
memory/2584-0-0x00007FFDA2373000-0x00007FFDA2375000-memory.dmp
memory/2584-12-0x00007FFDA2370000-0x00007FFDA2E31000-memory.dmp
memory/2584-11-0x00007FFDA2370000-0x00007FFDA2E31000-memory.dmp
memory/2584-1-0x000001F242220000-0x000001F242242000-memory.dmp