1173af60b8b0b350632ded58fd89429fd9457840f418ffa214f57487768ab19a

Analysis

max time kernel
295s
max time network
204s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
12/10/2024, 00:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VideoThumbnailsMaker.exe
Size

3.7MB
MD5

dced938a33439b5e42a3cea767e54085
SHA1

182f398c003ab78adda33e2f8df6e87acc48eb43
SHA256

b1df30dae2829ee8ff1959eb2351b24b3c51242aa0cea5d1d38f06c8d16f7614
SHA512

1465cc568ff79579ac50abc430e1a18387fec030210a79be484f5289fcf49285b139bc00e984dbd5e49188392be0403a8d60e80fe02eaae196a3402695b21b0b
SSDEEP

49152:FJAHOWqn3X+2Zr8uuLib1GPQnxmefxsqIf:PWaPuLib4PC

Score

1^/10

Malware Config

Signatures

Modifies registry class 57 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\WebP\Shell	VideoThumbnailsMaker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\.vts\Content Type = "application/myprogram"	VideoThumbnailsMaker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\VTM Picture File\Shell\open\Command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PicturesThumbnailsViewer.exe \"%1\""	VideoThumbnailsMaker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\.ptx\ = "PTM Picture File"	VideoThumbnailsMaker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\PTM Picture File\ = "Pictures Thumbnails Maker Picture File"	VideoThumbnailsMaker.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\PTM Picture File\Shell\open	VideoThumbnailsMaker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\WebP\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PicturesThumbnailsViewer.exe,0"	VideoThumbnailsMaker.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\.vts	VideoThumbnailsMaker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\VTM Settings File\Shell\open\Command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VideoThumbnailsMaker.exe \"%1\""	VideoThumbnailsMaker.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\.vtx	VideoThumbnailsMaker.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\VTM Picture File\DefaultIcon	VideoThumbnailsMaker.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\VTM Options File\Shell	VideoThumbnailsMaker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\VTM Options File\Shell\open\Command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VideoThumbnailsMaker.exe \"%1\""	VideoThumbnailsMaker.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\.webp\OpenWithProgids	VideoThumbnailsMaker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\.vtm\ = "VTM Options File"	VideoThumbnailsMaker.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\VTM Settings File\Shell\open	VideoThumbnailsMaker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\.vtx\ = "VTM Picture File"	VideoThumbnailsMaker.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\WebP\Shell\open	VideoThumbnailsMaker.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\WebP\Shell\open\Command	VideoThumbnailsMaker.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\VTM Options File\Shell\open\Command	VideoThumbnailsMaker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\VTM Picture File\ = "Video Thumbnails File"	VideoThumbnailsMaker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\VTM Picture File\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PicturesThumbnailsViewer.exe,0"	VideoThumbnailsMaker.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\WebP	VideoThumbnailsMaker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\VTM Settings File\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VideoThumbnailsMaker.exe,0"	VideoThumbnailsMaker.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\VTM Settings File\Shell	VideoThumbnailsMaker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\.vtx\Content Type = "application/myprogram"	VideoThumbnailsMaker.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\VTM Picture File\Shell	VideoThumbnailsMaker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\VTM Options File\ = "Video Thumbnails Maker Options File"	VideoThumbnailsMaker.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\VTM Options File\Shell\open	VideoThumbnailsMaker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\.vts\ = "VTM Settings File"	VideoThumbnailsMaker.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\.ptx	VideoThumbnailsMaker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\.webp\ = "WebP"	VideoThumbnailsMaker.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\.webp	VideoThumbnailsMaker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\.vtm\Content Type = "application/myprogram"	VideoThumbnailsMaker.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\VTM Picture File	VideoThumbnailsMaker.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\PTM Picture File\Shell	VideoThumbnailsMaker.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\.webp	VideoThumbnailsMaker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\PTM Picture File\Shell\open\Command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PicturesThumbnailsViewer.exe \"%1\""	VideoThumbnailsMaker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\.webp\Content Type = "image/webp"	VideoThumbnailsMaker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\WebP\Shell\open\Command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PicturesThumbnailsViewer.exe \"%1\""	VideoThumbnailsMaker.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\VTM Options File	VideoThumbnailsMaker.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\VTM Picture File\Shell\open\Command	VideoThumbnailsMaker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\.ptx\Content Type = "application/myprogram"	VideoThumbnailsMaker.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\PTM Picture File	VideoThumbnailsMaker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\VTM Settings File\ = "Video Thumbnails Maker Settings File"	VideoThumbnailsMaker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\PTM Picture File\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PicturesThumbnailsViewer.exe,0"	VideoThumbnailsMaker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\WebP\ = "WebP File"	VideoThumbnailsMaker.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\VTM Options File\DefaultIcon	VideoThumbnailsMaker.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\PTM Picture File\Shell\open\Command	VideoThumbnailsMaker.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\.vtm	VideoThumbnailsMaker.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\VTM Settings File	VideoThumbnailsMaker.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\VTM Picture File\Shell\open	VideoThumbnailsMaker.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\WebP\DefaultIcon	VideoThumbnailsMaker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\VTM Options File\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VideoThumbnailsMaker.exe,0"	VideoThumbnailsMaker.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\VTM Settings File\DefaultIcon	VideoThumbnailsMaker.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\PTM Picture File\DefaultIcon	VideoThumbnailsMaker.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\VTM Settings File\Shell\open\Command	VideoThumbnailsMaker.exe

Suspicious behavior: EnumeratesProcesses 62 IoCs

pid	Process
4264	VideoThumbnailsMaker.exe
4264	VideoThumbnailsMaker.exe
4264	VideoThumbnailsMaker.exe
4264	VideoThumbnailsMaker.exe
4264	VideoThumbnailsMaker.exe
4264	VideoThumbnailsMaker.exe
4264	VideoThumbnailsMaker.exe
4264	VideoThumbnailsMaker.exe
4264	VideoThumbnailsMaker.exe
4264	VideoThumbnailsMaker.exe
4264	VideoThumbnailsMaker.exe
4264	VideoThumbnailsMaker.exe
4264	VideoThumbnailsMaker.exe
4264	VideoThumbnailsMaker.exe
4264	VideoThumbnailsMaker.exe
4264	VideoThumbnailsMaker.exe
4264	VideoThumbnailsMaker.exe
4264	VideoThumbnailsMaker.exe
4264	VideoThumbnailsMaker.exe
4264	VideoThumbnailsMaker.exe
4264	VideoThumbnailsMaker.exe
4264	VideoThumbnailsMaker.exe
4264	VideoThumbnailsMaker.exe
4264	VideoThumbnailsMaker.exe
4264	VideoThumbnailsMaker.exe
4264	VideoThumbnailsMaker.exe
4264	VideoThumbnailsMaker.exe
4264	VideoThumbnailsMaker.exe
4264	VideoThumbnailsMaker.exe
4264	VideoThumbnailsMaker.exe
4264	VideoThumbnailsMaker.exe
4264	VideoThumbnailsMaker.exe
4264	VideoThumbnailsMaker.exe
4264	VideoThumbnailsMaker.exe
4264	VideoThumbnailsMaker.exe
4264	VideoThumbnailsMaker.exe
4264	VideoThumbnailsMaker.exe
4264	VideoThumbnailsMaker.exe
4264	VideoThumbnailsMaker.exe
4264	VideoThumbnailsMaker.exe
4264	VideoThumbnailsMaker.exe
4264	VideoThumbnailsMaker.exe
4264	VideoThumbnailsMaker.exe
4264	VideoThumbnailsMaker.exe
4264	VideoThumbnailsMaker.exe
4264	VideoThumbnailsMaker.exe
4264	VideoThumbnailsMaker.exe
4264	VideoThumbnailsMaker.exe
4264	VideoThumbnailsMaker.exe
4264	VideoThumbnailsMaker.exe
4264	VideoThumbnailsMaker.exe
4264	VideoThumbnailsMaker.exe
4264	VideoThumbnailsMaker.exe
4264	VideoThumbnailsMaker.exe
4264	VideoThumbnailsMaker.exe
4264	VideoThumbnailsMaker.exe
4264	VideoThumbnailsMaker.exe
4264	VideoThumbnailsMaker.exe
4264	VideoThumbnailsMaker.exe
4264	VideoThumbnailsMaker.exe
4264	VideoThumbnailsMaker.exe
4264	VideoThumbnailsMaker.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4264	VideoThumbnailsMaker.exe

C:\Users\Admin\AppData\Local\Temp\VideoThumbnailsMaker.exe
"C:\Users\Admin\AppData\Local\Temp\VideoThumbnailsMaker.exe"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4264

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4264-0-0x00007FF914D73000-0x00007FF914D75000-memory.dmp

Filesize
8KB

Download
memory/4264-1-0x00000224327C0000-0x0000022432B7A000-memory.dmp

Filesize
3.7MB

Download
memory/4264-2-0x000002244D400000-0x000002244D6AE000-memory.dmp

Filesize
2.7MB

Download
memory/4264-3-0x0000022433030000-0x0000022433078000-memory.dmp

Filesize
288KB

Download
memory/4264-4-0x00007FF914D70000-0x00007FF915832000-memory.dmp

Filesize
10.8MB

Download
memory/4264-5-0x000002244FA40000-0x000002244FAE0000-memory.dmp

Filesize
640KB

Download
memory/4264-6-0x00007FF914D70000-0x00007FF915832000-memory.dmp

Filesize
10.8MB

Download
memory/4264-7-0x00000224758E0000-0x0000022475902000-memory.dmp

Filesize
136KB

Download
memory/4264-8-0x00007FF914D70000-0x00007FF915832000-memory.dmp

Filesize
10.8MB

Download
memory/4264-9-0x00007FF914D70000-0x00007FF915832000-memory.dmp

Filesize
10.8MB

Download
memory/4264-10-0x00007FF914D70000-0x00007FF915832000-memory.dmp

Filesize
10.8MB

Download
memory/4264-11-0x00007FF914D70000-0x00007FF915832000-memory.dmp

Filesize
10.8MB

Download
memory/4264-12-0x00007FF914D70000-0x00007FF915832000-memory.dmp

Filesize
10.8MB

Download
memory/4264-13-0x00007FF914D73000-0x00007FF914D75000-memory.dmp

Filesize
8KB

Download
memory/4264-14-0x00007FF914D70000-0x00007FF915832000-memory.dmp

Filesize
10.8MB

Download
memory/4264-15-0x00007FF914D70000-0x00007FF915832000-memory.dmp

Filesize
10.8MB

Download
memory/4264-16-0x00007FF914D70000-0x00007FF915832000-memory.dmp

Filesize
10.8MB

Download
memory/4264-17-0x00007FF914D70000-0x00007FF915832000-memory.dmp

Filesize
10.8MB

Download
memory/4264-18-0x00007FF914D70000-0x00007FF915832000-memory.dmp

Filesize
10.8MB

Download
memory/4264-19-0x00007FF90EBF0000-0x00007FF90FD8A000-memory.dmp

Filesize
17.6MB

Download
memory/4264-22-0x00007FF90DA90000-0x00007FF90DE79000-memory.dmp

Filesize
3.9MB

Download
memory/4264-20-0x00007FF926D30000-0x00007FF926D6C000-memory.dmp

Filesize
240KB

Download
memory/4264-21-0x00007FF909150000-0x00007FF90B583000-memory.dmp

Filesize
36.2MB

Download
memory/4264-23-0x00007FF914D70000-0x00007FF915832000-memory.dmp

Filesize
10.8MB

Download
memory/4264-132-0x00007FF914D70000-0x00007FF915832000-memory.dmp

Filesize
10.8MB

Download
memory/4264-137-0x00007FF914D70000-0x00007FF915832000-memory.dmp

Filesize
10.8MB

Download