Overview
overview
10Static
static
10VSNKLGuzoF...2).exe
windows7-x64
3VSNKLGuzoF...5w.exe
windows7-x64
3VideoCodeCX.exe
windows7-x64
10WcsPlugInS...ex.exe
windows7-x64
5WinLocker Builder.exe
windows7-x64
5WinLocker_Builder.exe
windows7-x64
5_003E0000.exe.vir.exe
windows7-x64
9vmem02.exe
windows7-x64
3w8i9eHkHOwWwQlX.exe
windows7-x64
3wpbt0.exe
windows7-x64
10xpiofrbtkzhr.exe
windows7-x64
xxx_video (2).exe
windows7-x64
7xxx_video.exe
windows7-x64
5xxx_video_...vi.exe
windows7-x64
10xxx_video_...ir.exe
windows7-x64
10xxx_video_...ir.exe
windows7-x64
10xxx_video_...ir.exe
windows7-x64
10xxx_video_...vi.exe
windows7-x64
10xxx_video_...ir.exe
windows7-x64
10zcrypt.exe
windows7-x64
7{71257279-...a}.exe
windows7-x64
10Analysis
- max time kernel
239s - max time network
245s - platform
windows7_x64 - resource
win7-20240729-en - resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system - submitted
22/11/2024, 03:41
Behavioral task
behavioral1
Sample
VSNKLGuzoFJgFHyEI15w (2).exe
Resource
win7-20240903-en
windows7-x64
3 signatures
300 seconds
Behavioral task
behavioral2
Sample
VSNKLGuzoFJgFHyEI15w.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
300 seconds
Behavioral task
behavioral3
Sample
VideoCodeCX.exe
Resource
win7-20240729-en
windows7-x64
14 signatures
300 seconds
Behavioral task
behavioral4
Sample
WcsPlugInService.ex.exe
Resource
win7-20241010-en
windows7-x64
5 signatures
300 seconds
Behavioral task
behavioral5
Sample
WinLocker Builder.exe
Resource
win7-20240903-en
windows7-x64
2 signatures
300 seconds
Behavioral task
behavioral6
Sample
WinLocker_Builder.exe
Resource
win7-20240903-en
windows7-x64
2 signatures
300 seconds
Behavioral task
behavioral7
Sample
_003E0000.exe.vir.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
300 seconds
Behavioral task
behavioral8
Sample
vmem02.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
300 seconds
Behavioral task
behavioral9
Sample
w8i9eHkHOwWwQlX.exe
Resource
win7-20240903-en
windows7-x64
1 signatures
300 seconds
Behavioral task
behavioral10
Sample
wpbt0.exe
Resource
win7-20241023-en
windows7-x64
8 signatures
300 seconds
Behavioral task
behavioral11
Sample
xpiofrbtkzhr.exe
Resource
win7-20240708-en
windows7-x64
11 signatures
300 seconds
Behavioral task
behavioral12
Sample
xxx_video (2).exe
Resource
win7-20240903-en
windows7-x64
9 signatures
300 seconds
Behavioral task
behavioral13
Sample
xxx_video.exe
Resource
win7-20241010-en
windows7-x64
4 signatures
300 seconds
Behavioral task
behavioral14
Sample
xxx_video_26726.avi.exe
Resource
win7-20240903-en
windows7-x64
5 signatures
300 seconds
Behavioral task
behavioral15
Sample
xxx_video_35942.avi.exe.vir.exe
Resource
win7-20240729-en
windows7-x64
5 signatures
300 seconds
Behavioral task
behavioral16
Sample
xxx_video_35942.avi_unpacked_.exe.vir.exe
Resource
win7-20240708-en
windows7-x64
4 signatures
300 seconds
Behavioral task
behavioral17
Sample
xxx_video_73240.avi____.exe.vir.exe
Resource
win7-20240903-en
windows7-x64
4 signatures
300 seconds
Behavioral task
behavioral18
Sample
xxx_video_77498.avi.exe
Resource
win7-20241010-en
windows7-x64
3 signatures
300 seconds
Behavioral task
behavioral19
Sample
xxx_video_87279.avi.exe.vir.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
300 seconds
Behavioral task
behavioral20
Sample
zcrypt.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
300 seconds
Behavioral task
behavioral21
Sample
{71257279-042b-371d-a1d3-fbf8d2fadffa}.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
300 seconds
General
- Target VideoCodeCX.exe
- Size 2.0MB
- Sample241122-d88saazlhm
- SHA256 22b1af46ce7b3db0ec037026e035b0b09a6c791e5fb5fcb5e6ee3ef8d276abe1
- MD5 0701e045db5d20c93427b4bb452bc341
- SHA1 6be9df576ebfed1b2a0b14f2352dceaa36a10c79
- SHA512 40a542dbd44eab6c2f8f6631487be2065692489040632916aaee2d7f24810e4844291b1e6a0e5884362a7ebc534a03a44103465cd1266439107fc5c070c50dfb
- SSDEEP 49152:EkAG2QGTC5xvMdgpdb1KRzGepUu2cGbq7oc+tuNAn:EkAjQGTCnvMmpEQqUPn
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Program Files (x86)\\Video CodeC X\\Video CodeC X\\bsoderror.exe" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Program Files (x86)\\Video CodeC X\\Video CodeC X\\bsoderror.exe" msiexec.exe - Loads dropped DLL 15 IoCs
pid Process 2744 VideoCodeCX.exe 2744 VideoCodeCX.exe 2780 MsiExec.exe 2780 MsiExec.exe 2780 MsiExec.exe 2780 MsiExec.exe 2780 MsiExec.exe 2780 MsiExec.exe 2780 MsiExec.exe 2780 MsiExec.exe 2780 MsiExec.exe 896 MsiExec.exe 2780 MsiExec.exe 2744 VideoCodeCX.exe 2780 MsiExec.exe - Blocklisted process makes network request 1 IoCs
flow pid Process 4 2780 MsiExec.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\W: VideoCodeCX.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: VideoCodeCX.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\B: VideoCodeCX.exe File opened (read-only) \??\P: VideoCodeCX.exe File opened (read-only) \??\R: VideoCodeCX.exe File opened (read-only) \??\T: VideoCodeCX.exe File opened (read-only) \??\U: VideoCodeCX.exe File opened (read-only) \??\Z: VideoCodeCX.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\H: VideoCodeCX.exe File opened (read-only) \??\N: VideoCodeCX.exe File opened (read-only) \??\S: VideoCodeCX.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\I: VideoCodeCX.exe File opened (read-only) \??\O: VideoCodeCX.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Q: VideoCodeCX.exe File opened (read-only) \??\V: VideoCodeCX.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\G: VideoCodeCX.exe File opened (read-only) \??\J: VideoCodeCX.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\L: VideoCodeCX.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\A: VideoCodeCX.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: VideoCodeCX.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\S: msiexec.exe - Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\Video CodeC X\Video CodeC X\bsoderror.exe msiexec.exe - Drops file in Windows directory 22 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI800C.tmp msiexec.exe File created C:\Windows\Installer\f777ec4.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI8241.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8252.tmp msiexec.exe File opened for modification C:\Windows\Installer\f777ec1.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI7F8D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7FFB.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI804B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI807B.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI840B.tmp msiexec.exe File created C:\Windows\Installer\{E0D1DECF-00EC-4661-8C58-C5079F1CBFAF}\_itunes.exe msiexec.exe File created C:\Windows\Installer\f777ec6.msi msiexec.exe File opened for modification C:\Windows\Installer\f777ec4.ipi msiexec.exe File created C:\Windows\Installer\f777ec1.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI8231.tmp msiexec.exe File created C:\Windows\Tasks\you to.job MsiExec.exe File opened for modification C:\Windows\Installer\{E0D1DECF-00EC-4661-8C58-C5079F1CBFAF}\_itunes.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI8489.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7F1F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8291.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8300.tmp msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VideoCodeCX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E msiexec.exe - Modifies registry class 24 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FCED1D0ECE001664C8855C70F9C1FBFA\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3E0321A03BE396449BC7FFF3E123BAC2 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FCED1D0ECE001664C8855C70F9C1FBFA\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FCED1D0ECE001664C8855C70F9C1FBFA\SourceList\Net msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FCED1D0ECE001664C8855C70F9C1FBFA\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FCED1D0ECE001664C8855C70F9C1FBFA msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FCED1D0ECE001664C8855C70F9C1FBFA\ProductName = "Video CodeC X" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FCED1D0ECE001664C8855C70F9C1FBFA\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FCED1D0ECE001664C8855C70F9C1FBFA\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FCED1D0ECE001664C8855C70F9C1FBFA\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Roaming\\Video CodeC X\\Video CodeC X 2.0.0.0\\install\\F1CBFAF\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FCED1D0ECE001664C8855C70F9C1FBFA msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FCED1D0ECE001664C8855C70F9C1FBFA\PackageCode = "6363F740F6E08EF4E84656D164D38A57" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FCED1D0ECE001664C8855C70F9C1FBFA\Version = "33554432" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FCED1D0ECE001664C8855C70F9C1FBFA\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FCED1D0ECE001664C8855C70F9C1FBFA\SourceList\PackageName = "Video CodeC X.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FCED1D0ECE001664C8855C70F9C1FBFA\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FCED1D0ECE001664C8855C70F9C1FBFA\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FCED1D0ECE001664C8855C70F9C1FBFA\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FCED1D0ECE001664C8855C70F9C1FBFA\MainFeature msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FCED1D0ECE001664C8855C70F9C1FBFA\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3E0321A03BE396449BC7FFF3E123BAC2\FCED1D0ECE001664C8855C70F9C1FBFA msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FCED1D0ECE001664C8855C70F9C1FBFA\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Roaming\\Video CodeC X\\Video CodeC X 2.0.0.0\\install\\F1CBFAF\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FCED1D0ECE001664C8855C70F9C1FBFA\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FCED1D0ECE001664C8855C70F9C1FBFA\ProductIcon = "C:\\Windows\\Installer\\{E0D1DECF-00EC-4661-8C58-C5079F1CBFAF}\\_itunes.exe" msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2900 msiexec.exe 2900 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 2900 msiexec.exe Token: SeTakeOwnershipPrivilege 2900 msiexec.exe Token: SeSecurityPrivilege 2900 msiexec.exe Token: SeCreateTokenPrivilege 2744 VideoCodeCX.exe Token: SeAssignPrimaryTokenPrivilege 2744 VideoCodeCX.exe Token: SeLockMemoryPrivilege 2744 VideoCodeCX.exe Token: SeIncreaseQuotaPrivilege 2744 VideoCodeCX.exe Token: SeMachineAccountPrivilege 2744 VideoCodeCX.exe Token: SeTcbPrivilege 2744 VideoCodeCX.exe Token: SeSecurityPrivilege 2744 VideoCodeCX.exe Token: SeTakeOwnershipPrivilege 2744 VideoCodeCX.exe Token: SeLoadDriverPrivilege 2744 VideoCodeCX.exe Token: SeSystemProfilePrivilege 2744 VideoCodeCX.exe Token: SeSystemtimePrivilege 2744 VideoCodeCX.exe Token: SeProfSingleProcessPrivilege 2744 VideoCodeCX.exe Token: SeIncBasePriorityPrivilege 2744 VideoCodeCX.exe Token: SeCreatePagefilePrivilege 2744 VideoCodeCX.exe Token: SeCreatePermanentPrivilege 2744 VideoCodeCX.exe Token: SeBackupPrivilege 2744 VideoCodeCX.exe Token: SeRestorePrivilege 2744 VideoCodeCX.exe Token: SeShutdownPrivilege 2744 VideoCodeCX.exe Token: SeDebugPrivilege 2744 VideoCodeCX.exe Token: SeAuditPrivilege 2744 VideoCodeCX.exe Token: SeSystemEnvironmentPrivilege 2744 VideoCodeCX.exe Token: SeChangeNotifyPrivilege 2744 VideoCodeCX.exe Token: SeRemoteShutdownPrivilege 2744 VideoCodeCX.exe Token: SeUndockPrivilege 2744 VideoCodeCX.exe Token: SeSyncAgentPrivilege 2744 VideoCodeCX.exe Token: SeEnableDelegationPrivilege 2744 VideoCodeCX.exe Token: SeManageVolumePrivilege 2744 VideoCodeCX.exe Token: SeImpersonatePrivilege 2744 VideoCodeCX.exe Token: SeCreateGlobalPrivilege 2744 VideoCodeCX.exe Token: SeShutdownPrivilege 2812 msiexec.exe Token: SeIncreaseQuotaPrivilege 2812 msiexec.exe Token: SeCreateTokenPrivilege 2812 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2812 msiexec.exe Token: SeLockMemoryPrivilege 2812 msiexec.exe Token: SeIncreaseQuotaPrivilege 2812 msiexec.exe Token: SeMachineAccountPrivilege 2812 msiexec.exe Token: SeTcbPrivilege 2812 msiexec.exe Token: SeSecurityPrivilege 2812 msiexec.exe Token: SeTakeOwnershipPrivilege 2812 msiexec.exe Token: SeLoadDriverPrivilege 2812 msiexec.exe Token: SeSystemProfilePrivilege 2812 msiexec.exe Token: SeSystemtimePrivilege 2812 msiexec.exe Token: SeProfSingleProcessPrivilege 2812 msiexec.exe Token: SeIncBasePriorityPrivilege 2812 msiexec.exe Token: SeCreatePagefilePrivilege 2812 msiexec.exe Token: SeCreatePermanentPrivilege 2812 msiexec.exe Token: SeBackupPrivilege 2812 msiexec.exe Token: SeRestorePrivilege 2812 msiexec.exe Token: SeShutdownPrivilege 2812 msiexec.exe Token: SeDebugPrivilege 2812 msiexec.exe Token: SeAuditPrivilege 2812 msiexec.exe Token: SeSystemEnvironmentPrivilege 2812 msiexec.exe Token: SeChangeNotifyPrivilege 2812 msiexec.exe Token: SeRemoteShutdownPrivilege 2812 msiexec.exe Token: SeUndockPrivilege 2812 msiexec.exe Token: SeSyncAgentPrivilege 2812 msiexec.exe Token: SeEnableDelegationPrivilege 2812 msiexec.exe Token: SeManageVolumePrivilege 2812 msiexec.exe Token: SeImpersonatePrivilege 2812 msiexec.exe Token: SeCreateGlobalPrivilege 2812 msiexec.exe Token: SeRestorePrivilege 2900 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2812 msiexec.exe 2812 msiexec.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2744 wrote to memory of 2812 2744 VideoCodeCX.exe 31 PID 2744 wrote to memory of 2812 2744 VideoCodeCX.exe 31 PID 2744 wrote to memory of 2812 2744 VideoCodeCX.exe 31 PID 2744 wrote to memory of 2812 2744 VideoCodeCX.exe 31 PID 2744 wrote to memory of 2812 2744 VideoCodeCX.exe 31 PID 2744 wrote to memory of 2812 2744 VideoCodeCX.exe 31 PID 2744 wrote to memory of 2812 2744 VideoCodeCX.exe 31 PID 2900 wrote to memory of 2780 2900 msiexec.exe 32 PID 2900 wrote to memory of 2780 2900 msiexec.exe 32 PID 2900 wrote to memory of 2780 2900 msiexec.exe 32 PID 2900 wrote to memory of 2780 2900 msiexec.exe 32 PID 2900 wrote to memory of 2780 2900 msiexec.exe 32 PID 2900 wrote to memory of 2780 2900 msiexec.exe 32 PID 2900 wrote to memory of 2780 2900 msiexec.exe 32 PID 2900 wrote to memory of 896 2900 msiexec.exe 33 PID 2900 wrote to memory of 896 2900 msiexec.exe 33 PID 2900 wrote to memory of 896 2900 msiexec.exe 33 PID 2900 wrote to memory of 896 2900 msiexec.exe 33 PID 2900 wrote to memory of 896 2900 msiexec.exe 33 PID 2900 wrote to memory of 896 2900 msiexec.exe 33 PID 2900 wrote to memory of 896 2900 msiexec.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\VideoCodeCX.exe"C:\Users\Admin\AppData\Local\Temp\VideoCodeCX.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Video CodeC X\Video CodeC X 2.0.0.0\install\F1CBFAF\Video CodeC X.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\VideoCodeCX.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /exelang 0 /noprereqs "2⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2812
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Modifies WinLogon for persistence
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A371761743DBC15E96271C54860029AD2⤵
- Loads dropped DLL
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
PID:2780
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B6D96334DC12DB8986BA5F9FD9ADA77D M Global\MSI00002⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:896
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\f777ec5.rbs
- Size 106KB
- SHA256 4a96551895ea83c53f561774818a33f4044514a2923954bf54ee8b1ec006cec3
- MD5 0e49666f6aec36e92453cb4e41f749f5
- SHA1 b54cd4ebccacf282facfecbe3616df59876408b7
- SHA512 8c20f2dfd52613b12b3cab05088bd02414b3f8fc9ef4692535440809972d5792f1ece5cfd1dfe46aba6f430586fc6ceff18ae22f961fe9dcc7d81af6363ed5e0
- SSDEEP 1536:cCPYXUTK5kjNuQ+7bzwZH8uZYriQAvk7Dnzk28m2+b32Ih:JPYEI0T9kfV8m2+b3dh
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Video CodeC X\2.0.0.0\tracking.ini
- Size 69B
- SHA256 64800ab14a58d7062d669dac34018a2e5e5cdd250fade664ccd2d78be5733d1c
- MD5 89535309d6c3041f621b2061507b21fa
- SHA1 2a4a7d7a58a077bb789fecb313de22211952edbe
- SHA512 a50ee82cac21715b7d7e77154a2fe0598690a35ccb76b190413ca886481be92dd012a4e34a6cdc6d60ba70be9028995719596c2c3750e12a5e96bba4be1ae5bf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Video CodeC X\2.0.0.0\tracking.ini
- Size 84B
- SHA256 08ddd333275f10ed3d23c2be72d4bcbdd7a30638e181b1afecb85414fdef6d8c
- MD5 662bd174aba9542274222f4768bac369
- SHA1 8ed7282c153b614bad1a2ca52c53cc31d8463d7d
- SHA512 56243ebfa3444b656dbd822c89b9f8157c99ca9493a52691676d7f1122b2c49b59af5ac51f319dfe000f950d0602774a4382526fc075c6a34f7f8fadf4b0f06c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Video CodeC X\2.0.0.0\{35458323-09E8-4F03-9824-3C4D544AEB88}.session
- Size 4KB
- SHA256 a52a02af44a1eb9260e84f6048c45beb1cd42a372a62ea3fac2fd3493cc58245
- MD5 c84d162b3f035c6864b02b9b0da3085c
- SHA1 0cc6540955d144bcac1827e070af2b408680ffff
- SHA512 693a98f4022d6f831ad4dfd56c484e1c0abdea8bb869d9d258c9bbb8daa8dacac1a87cb43187a05795ec56b2b8afe1ff09dfef0301b0c3cf63e172a8fcb5d8b9
- SSDEEP 96:s9Cy7RHbCyutXBtCyupB9tCyu7WZeBCyuE02DCyuQjhCyuc1Cyu9kvCyua3wCyuq:xCGxe50PWp+OMc5ta3pyn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Video CodeC X\2.0.0.0\{35458323-09E8-4F03-9824-3C4D544AEB88}.session
- Size 2KB
- SHA256 848749dcaceab691b4b780defe10585fa64290c808f70e8fc9064fc9f8c60768
- MD5 4f73357193d931dbf175b646b6b5c575
- SHA1 b6894eac93880c243183f7889c345919c96e23ca
- SHA512 cbc7c62c72c38ff06a930e888ead651d763b84ad66bf56e3f79ee65d74a30bc80ff9f5de3c3f96ab0295302bb2e9010594ac1645ca44c3d6694481235f316499
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Video CodeC X\2.0.0.0\{35458323-09E8-4F03-9824-3C4D544AEB88}.session
- Size 3KB
- SHA256 7c5b06ac1c9fa199e28e89368dbad06cee810829c70bd99cae47cdf567a9009d
- MD5 45bd98cae8012556fb923b213ca5b6ab
- SHA1 e5b312a296e5d2d8e0bdc83c6b50c35f33c5241d
- SHA512 3037cefc932b4c43cec201a4c6fe352f694d050431b369f8631b60882d37432cc8280f9545e3989b46e356d15057473abbeff4ef776eecb9bd25ccbcb834380d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Video CodeC X\2.0.0.0\{35458323-09E8-4F03-9824-3C4D544AEB88}.session
- Size 3KB
- SHA256 3d1c3f2062ecfeff0311ebcf423a314ead96ad6a8c4043f066c430051b0b07f2
- MD5 7f02fb2ec3410cadf13d8d7ccce01433
- SHA1 d74ddea7609fc992a2ebed415cb7fc590451dd58
- SHA512 72e1e64c5cd16b143c03b571153346c5981cdb16189a299b45ebb8a17e631ef9639ab84b99e7f8a181f9a2e7acb62f362d96a6dee851de332fae93200a934f29
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Video CodeC X\2.0.0.0\{35458323-09E8-4F03-9824-3C4D544AEB88}.session
- Size 3KB
- SHA256 95006281c914e9cac887adf4114705b78d5070dc67ae2f3597527d519485f783
- MD5 3fef2d800f6c98295e8902e2616aaa7b
- SHA1 055b8cb676b8c86548d53b0db3cbfe6561c192c6
- SHA512 e30c93d2405a2cf237648c56bfd251c3a8e114fa0de8e90b30480c7eb6ff376c63b49c21c1f7b1062962a515288653bc82364ed14241817498052467aa1cd7a7
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Video CodeC X\Video CodeC X 2.0.0.0\install\F1CBFAF\Video CodeC X.msi
- Size 1.1MB
- SHA256 f32c666abd8d50bce93391840de7c8d9969b75d42aea3bee61d68be411e3ffe3
- MD5 5a62fc6cb914c167550b337e86e8a933
- SHA1 7a6bf8f179aed33057a694966b45a7928f1698b7
- SHA512 6a64db837e86eed6b2227b6e3df35a1f9f761cac890ea1475a1c42ec4c511bd3a622737ccfd133a5682c0ca226d046dfb60140c7001be40c574e41f10df396b9
- SSDEEP 24576:Pg0yr3ZYpabtZ3L60uRaOX6YhmbnrEAO+:PFHabtZ320uRa66YhmbrEAO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Video CodeC X\Video CodeC X 2.0.0.0\install\F1CBFAF\bsoderror.exe
- Size 84KB
- SHA256 3b5d9aadfdb9c1257ef84e33cdad67cd818334ec8fd40e0968b8b71e2a0eef95
- MD5 ea3ad4540a9411f051d52788dde2cb53
- SHA1 641e87b35a4d31d41a1bb842190e6cd830ddea63
- SHA512 2f39c3caaf28b2ca592f6268ae0750fa36ecf9eeceaf3a1846162914129a794c0c0224cc7e6c6e55cc2f0b65a18d3e2c1c9bc86252799635e22f4c50ce196c33
- SSDEEP 1536:/WNNuIDd4LSxoYe4IzHiOV8ggH1kHgDqzQA8R57nB6w:uppWTCaHaqUtj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Video CodeC X\Video CodeC X 2.0.0.0\install\decoder.dll
- Size 126KB
- SHA256 76133e832c15aa5cbc49fb3ba09e0b8dd467c307688be2c9e85e79d3bf62c089
- MD5 3531cf7755b16d38d5e9e3c43280e7d2
- SHA1 19981b17ae35b6e9a0007551e69d3e50aa1afffe
- SHA512 7b053ba2cf92ef2431b98b2a06bd56340dad94de36d11e326a80cd61b9acb378ac644ac407cf970f4ef8333b8d3fb4ff40b18bb41ec5aee49d79a6a2adcf28fd
- SSDEEP 3072:pJzYRnR1UrYpMxbkpG2/wI/Bf6zWcvEm+6MG:zYPqrKM5kA2jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI7F1F.tmp
- Size 180KB
- SHA256 a0367875b68b1699d2647a748278ebce64d5be633598580977aa126a81cf57c5
- MD5 d552dd4108b5665d306b4a8bd6083dde
- SHA1 dae55ccba7adb6690b27fa9623eeeed7a57f8da1
- SHA512 e5545a97014b5952e15bb321135f65c0e24414f8dd606fe454fd2d048d3f769b9318df7cfb2a6bf932eb2bf6d79811b93cb2008115deb0f0fa9db07f32a70969
- SSDEEP 3072:uVvQSjk1ZA65w4m2Qhy8beP7bNhDbKYpPlsB2KNndf:ovnqZzxmH7G7bnrhQ/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI7FFB.tmp
- Size 88KB
- SHA256 252b7423b01ff81aea6fe7b40de91abf49f515e9c0c7b95aa982756889f8ac1a
- MD5 4083cb0f45a747d8e8ab0d3e060616f2
- SHA1 dcec8efa7a15fa432af2ea0445c4b346fef2a4d6
- SHA512 26f8949cad02334f9942fda8509579303b81b11bc052a962c5c31a7c6c54a1c96957f30ee241c2206d496d2c519d750d7f6a12b52afdb282fa706f9fee385133
- SSDEEP 1536:adQe5dWJ5PQrYbcdv06DoY4J70eVsRckW1HhYpK5EubsF:pGdWJ5PGc6DoYu7hSWhYpwXsF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI8241.tmp
- Size 96KB
- SHA256 604e79fe970c5ed044517a9a35e4690ea6f7d959d21173ebef45cdd3d3a22bdd
- MD5 3cab78d0dc84883be2335788d387601e
- SHA1 14745df9595f190008c7e5c190660361f998d824
- SHA512 df6b49f2b5cddebd7e23e81b0f89e4883fc12d95735a9b3f84d2f402f4996c54b5fdea8adb9eaa98e8c973b089656d18d6b322bd71cb42d7807f7fa8a7348820
- SSDEEP 1536:9CPYXUTK5kjNuQ+7bzwZH8uZYriQAvk7Dnzk28m2+b32I:wPYEI0T9kfV8m2+b3d
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI8252.tmp
- Size 128KB
- SHA256 59ff5bc12b155cc2e666bd8bc34195c3750eb742542374fc5e53fb22d11e862f
- MD5 7e6b88f7bb59ec4573711255f60656b5
- SHA1 5e7a159825a2d2cb263a161e247e9db93454d4f6
- SHA512 294a379c99403f928d476e04668717cdabc7dc3e33bcf6bcad5c3d93d4268971811ff7303aa5b4b2ed2b59d59c8eba350a9a30888d4b5b3064708521ac21439c
- SSDEEP 1536:BZTfyLkhcCrnxivk2tychAFPsrc2tlNY6hHLThRn0CWihVrePB4E+URMVQKa:BT2fhKUNf1hjZV6SE+UREQKa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI8291.tmp
- Size 312KB
- SHA256 9c155d4214cebda186647c035ada552963dcac8f88a6b38a23ea34f9ecd1d437
- MD5 aa82345a8f360804ea1d8d935f0377aa
- SHA1 c09cf3b1666d9192fa524c801bb2e3542c0840e2
- SHA512 c051a381d87ba933ea7929c899fb01af2207cb2462dcb2b55c28cff65596b27bdb05a48207624eeea40fddb85003133ad7af09ca93cfb2426c155daea5a9a6db
- SSDEEP 6144:2yULssarl2Qr7DsSb45R+V573Wj2quM3o4cBo4NeRiAmf:2/9arvr7Q0FP73Lqz0uRa
- MD5 SHA1 SHA512 SSDEEP