Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13/11/2024, 08:30
Static task
static1
Behavioral task
behavioral1
Sample
MAGIX VEGAS Pro v22.0 patch.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
MAGIX VEGAS Pro v22.0 patch.exe
Resource
win10v2004-20241007-en
General
-
Target
MAGIX VEGAS Pro v22.0 patch.exe
-
Size
4.8MB
-
MD5
ff4bc7a206b856502dd647e94dec5c8f
-
SHA1
4a3d0e4fb6fb2a7ac633a288a0d2ce8f14286cda
-
SHA256
b3688db852d9a57834ef758cd54a9507fad2de1854a2faed23bda53411000383
-
SHA512
f93170b9fe1b06e9c48a255bede5a1150e8125d09d6c5d1fe8438525b40b648f8bcb86a79d3453d6f45f4392cc946214088ac3aa24ee298ff36579f22da1c1cc
-
SSDEEP
98304:8L1CNqRBQsRE+Mv2RJlmQJu6A3ty6gVLPysH:81H42RJs+ODzY
Malware Config
Signatures
-
Detected Nirsoft tools 1 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
resource yara_rule behavioral2/files/0x0007000000023cae-22.dat Nirsoft -
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable = "1" MAGIX VEGAS Pro v22.0 patch.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options MAGIX VEGAS Pro v22.0 patch.tmp -
Executes dropped EXE 11 IoCs
pid Process 1756 MAGIX VEGAS Pro v22.0 patch.tmp 4372 nircmd.exe 4508 nircmd.exe 3476 nircmd.exe 5000 nircmd.exe 2536 nircmd.exe 1600 nircmd.exe 4440 nircmd.exe 3688 nircmd.exe 2220 nircmd.exe 3276 nircmd.exe -
Loads dropped DLL 1 IoCs
pid Process 1756 MAGIX VEGAS Pro v22.0 patch.tmp -
Drops file in Program Files directory 5 IoCs
description ioc Process File opened for modification C:\Program Files\VEGAS\VEGAS Pro 22.0\Protein\Protein_x64.4.2.dll MAGIX VEGAS Pro v22.0 patch.tmp File opened for modification C:\Program Files\VEGAS\VEGAS Pro 22.0\vegas220.exe.local\wintrust.dll MAGIX VEGAS Pro v22.0 patch.tmp File opened for modification C:\Program Files\VEGAS\VEGAS Pro 22.0\vegas220.exe.local MAGIX VEGAS Pro v22.0 patch.tmp File created C:\Program Files\VEGAS\VEGAS Pro 22.0\Protein\is-9DEDI.tmp MAGIX VEGAS Pro v22.0 patch.tmp File created C:\Program Files\VEGAS\VEGAS Pro 22.0\vegas220.exe.local\is-N12OI.tmp MAGIX VEGAS Pro v22.0 patch.tmp -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MAGIX VEGAS Pro v22.0 patch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MAGIX VEGAS Pro v22.0 patch.tmp -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1756 MAGIX VEGAS Pro v22.0 patch.tmp 1756 MAGIX VEGAS Pro v22.0 patch.tmp -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1756 MAGIX VEGAS Pro v22.0 patch.tmp -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 636 wrote to memory of 1756 636 MAGIX VEGAS Pro v22.0 patch.exe 83 PID 636 wrote to memory of 1756 636 MAGIX VEGAS Pro v22.0 patch.exe 83 PID 636 wrote to memory of 1756 636 MAGIX VEGAS Pro v22.0 patch.exe 83 PID 1756 wrote to memory of 1060 1756 MAGIX VEGAS Pro v22.0 patch.tmp 92 PID 1756 wrote to memory of 1060 1756 MAGIX VEGAS Pro v22.0 patch.tmp 92 PID 1060 wrote to memory of 4372 1060 cmd.exe 94 PID 1060 wrote to memory of 4372 1060 cmd.exe 94 PID 1060 wrote to memory of 4508 1060 cmd.exe 95 PID 1060 wrote to memory of 4508 1060 cmd.exe 95 PID 1060 wrote to memory of 3476 1060 cmd.exe 96 PID 1060 wrote to memory of 3476 1060 cmd.exe 96 PID 1060 wrote to memory of 5000 1060 cmd.exe 97 PID 1060 wrote to memory of 5000 1060 cmd.exe 97 PID 1060 wrote to memory of 2536 1060 cmd.exe 98 PID 1060 wrote to memory of 2536 1060 cmd.exe 98 PID 1060 wrote to memory of 1600 1060 cmd.exe 99 PID 1060 wrote to memory of 1600 1060 cmd.exe 99 PID 1060 wrote to memory of 4440 1060 cmd.exe 100 PID 1060 wrote to memory of 4440 1060 cmd.exe 100 PID 1060 wrote to memory of 3688 1060 cmd.exe 101 PID 1060 wrote to memory of 3688 1060 cmd.exe 101 PID 1060 wrote to memory of 2220 1060 cmd.exe 102 PID 1060 wrote to memory of 2220 1060 cmd.exe 102 PID 1060 wrote to memory of 3276 1060 cmd.exe 103 PID 1060 wrote to memory of 3276 1060 cmd.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\MAGIX VEGAS Pro v22.0 patch.exe"C:\Users\Admin\AppData\Local\Temp\MAGIX VEGAS Pro v22.0 patch.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Users\Admin\AppData\Local\Temp\is-9B2HL.tmp\MAGIX VEGAS Pro v22.0 patch.tmp"C:\Users\Admin\AppData\Local\Temp\is-9B2HL.tmp\MAGIX VEGAS Pro v22.0 patch.tmp" /SL5="$701DC,4046882,1178624,C:\Users\Admin\AppData\Local\Temp\MAGIX VEGAS Pro v22.0 patch.exe"2⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-BHJ8K.tmp\nircmd.cmd""3⤵
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\is-BHJ8K.tmp\nircmd.exenircmd inisetval "c:\ProgramData\VEGAS\VEGAS_Pro_22\installation.ini" "Serial" "string" "P3-64979-27462-07906-32757-21318-38872"4⤵
- Executes dropped EXE
PID:4372
-
-
C:\Users\Admin\AppData\Local\Temp\is-BHJ8K.tmp\nircmd.exenircmd inisetval "c:\ProgramData\VEGAS\VEGAS_Pro_22\installation.ini" "VersionUnlock" "NumberOfStarts" "0"4⤵
- Executes dropped EXE
PID:4508
-
-
C:\Users\Admin\AppData\Local\Temp\is-BHJ8K.tmp\nircmd.exenircmd inisetval "c:\ProgramData\VEGAS\VEGAS_Pro_22\installation.ini" "VersionUnlock" "DontShowNagBox" "1"4⤵
- Executes dropped EXE
PID:3476
-
-
C:\Users\Admin\AppData\Local\Temp\is-BHJ8K.tmp\nircmd.exenircmd inisetval "c:\ProgramData\VEGAS\VEGAS_Pro_22\installation.ini" "VersionUnlock" "IsRegisteredUser" "1"4⤵
- Executes dropped EXE
PID:5000
-
-
C:\Users\Admin\AppData\Local\Temp\is-BHJ8K.tmp\nircmd.exenircmd inisetval "c:\ProgramData\VEGAS\VEGAS_Pro_22\installation.ini" "VersionUnlock" "UserEMail" "uBusHTShXjdIakxgck01PRO5nuh8YfF4BDS17GWS/So3BnxxO66uwQ3meU0PEMwM"4⤵
- Executes dropped EXE
PID:2536
-
-
C:\Users\Admin\AppData\Local\Temp\is-BHJ8K.tmp\nircmd.exenircmd inisetval "c:\ProgramData\VEGAS\DVD_Architect_Pro_7\installation.ini" "Serial" "string" "P3-77020-98979-63411-51090-66867-08191"4⤵
- Executes dropped EXE
PID:1600
-
-
C:\Users\Admin\AppData\Local\Temp\is-BHJ8K.tmp\nircmd.exenircmd inisetval "c:\ProgramData\VEGAS\DVD_Architect_Pro_7\installation.ini" "VersionUnlock" "NumberOfStarts" "0"4⤵
- Executes dropped EXE
PID:4440
-
-
C:\Users\Admin\AppData\Local\Temp\is-BHJ8K.tmp\nircmd.exenircmd inisetval "c:\ProgramData\VEGAS\DVD_Architect_Pro_7\installation.ini" "VersionUnlock" "DontShowNagBox" "1"4⤵
- Executes dropped EXE
PID:3688
-
-
C:\Users\Admin\AppData\Local\Temp\is-BHJ8K.tmp\nircmd.exenircmd inisetval "c:\ProgramData\VEGAS\DVD_Architect_Pro_7\installation.ini" "VersionUnlock" "IsRegisteredUser" "1"4⤵
- Executes dropped EXE
PID:2220
-
-
C:\Users\Admin\AppData\Local\Temp\is-BHJ8K.tmp\nircmd.exenircmd inisetval "c:\ProgramData\VEGAS\DVD_Architect_Pro_7\installation.ini" "VersionUnlock" "UserEMail" "uBusHTShXjdIakxgck01PRO5nuh8YfF4BDS17GWS/So3BnxxO66uwQ3meU0PEMwM"4⤵
- Executes dropped EXE
PID:3276
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.5MB
MD5cd0e5319f235a458802e284c1d7fb7c7
SHA1716d6347b01df04b96c32db414361ae828dec3d9
SHA2567a8924b753dbbd168b822d7c483f0150697c6bb31d19cfd1fd872f1090254fcf
SHA5125d3873d79783e7f123f618e41087c59b59ac4e5e932057bc649415d34b4465b29ba84d6390ca2cbea9de2a33f5b7f60300fd722e5ca78d0a9b8d83a804a68406
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
1KB
MD514d3f2a3efbfe535fa0958da17d565fa
SHA1958c79de8f3dc821d4c9c89e1f3b92bc7c48637a
SHA256915357dfb71b907b64b18a198160e8962ffaaed4d5278d5ac4ee0208b6f089c0
SHA51279ae0e1c73558546d7f61ae5ff0576ddb303e15f3a2be549a0bf32b54f0336bb20357203796341646a53b6c8a6449ccbd9c63174db16b5310ebdbe976aadae75
-
Filesize
114KB
MD5b417238213efb0d2a23562674406cdf9
SHA104bf7acc7d0aa74fa750f7c32fdebbbe1daf46f8
SHA2565bfa034f7555a38e64c078af71b4ff8c49511579fa826a87661940b7e9a6e333
SHA512881b420af6e7104ac1f2edf03fc905f30af8ee264d8279f7eeb18e6178e210e063ac3c3d9a47f0c7c36ad04b51773e28595f965b037b0a0305d6c9fdf18e96a3