b3688db852d9a57834ef758cd54a9507fad2de1854a2faed23bda53411000383

Analysis

max time kernel
148s
max time network
97s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 10:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MAGIX VEGAS Pro v22.0 patch.exe
Size 4.8MB
Sample260703-mhvbmsft8x
SHA256 b3688db852d9a57834ef758cd54a9507fad2de1854a2faed23bda53411000383
MD5 ff4bc7a206b856502dd647e94dec5c8f
SHA1 4a3d0e4fb6fb2a7ac633a288a0d2ce8f14286cda
SHA512 f93170b9fe1b06e9c48a255bede5a1150e8125d09d6c5d1fe8438525b40b648f8bcb86a79d3453d6f45f4392cc946214088ac3aa24ee298ff36579f22da1c1cc
SSDEEP 98304:8L1CNqRBQsRE+Mv2RJlmQJu6A3ty6gVLPysH:81H42RJs+ODzY
TLSH
T18D36F12A7E54633DC57A06F24563831099377E6176FE8C2A02E4FB88CB37140DEFA656
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery installer persistence

Malware Config

Signatures

Detected Nirsoft tools 1 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/files/0x000d00000001c58b-22.dat	Nirsoft

NirSoft NirCmd 1 IoCs

NirCmd is a lightweight Windows command-line tool for automating system tasks

resource	yara_rule
behavioral2/files/0x000d00000001c58b-22.dat	NirCmd

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	MAGIX VEGAS Pro v22.0 patch.tmp
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable = "1"	MAGIX VEGAS Pro v22.0 patch.tmp

Executes dropped EXE 11 IoCs

pid	Process
2892	MAGIX VEGAS Pro v22.0 patch.tmp
1228	nircmd.exe
4320	nircmd.exe
1844	nircmd.exe
4196	nircmd.exe
6012	nircmd.exe
2488	nircmd.exe
3568	nircmd.exe
5500	nircmd.exe
1420	nircmd.exe
5444	nircmd.exe

Loads dropped DLL 1 IoCs

pid	Process
2892	MAGIX VEGAS Pro v22.0 patch.tmp

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\VEGAS\VEGAS Pro 22.0\vegas220.exe.local\is-NC9E3.tmp	MAGIX VEGAS Pro v22.0 patch.tmp
File opened for modification	C:\Program Files\VEGAS\VEGAS Pro 22.0\Protein\Protein_x64.4.2.dll	MAGIX VEGAS Pro v22.0 patch.tmp
File opened for modification	C:\Program Files\VEGAS\VEGAS Pro 22.0\vegas220.exe.local\wintrust.dll	MAGIX VEGAS Pro v22.0 patch.tmp
File opened for modification	C:\Program Files\VEGAS\VEGAS Pro 22.0\vegas220.exe.local	MAGIX VEGAS Pro v22.0 patch.tmp
File created	C:\Program Files\VEGAS\VEGAS Pro 22.0\Protein\is-DG32H.tmp	MAGIX VEGAS Pro v22.0 patch.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MAGIX VEGAS Pro v22.0 patch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MAGIX VEGAS Pro v22.0 patch.tmp

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/3616-0-0x0000000000400000-0x0000000000531000-memory.dmp	innosetup
behavioral2/memory/3616-41-0x0000000000400000-0x0000000000531000-memory.dmp	innosetup
behavioral2/memory/3616-45-0x0000000000400000-0x0000000000531000-memory.dmp	innosetup

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2892	MAGIX VEGAS Pro v22.0 patch.tmp
2892	MAGIX VEGAS Pro v22.0 patch.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2892	MAGIX VEGAS Pro v22.0 patch.tmp

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3616 wrote to memory of 2892	3616	MAGIX VEGAS Pro v22.0 patch.exe	88
PID 2892 wrote to memory of 3416	2892	MAGIX VEGAS Pro v22.0 patch.tmp	89
PID 3416 wrote to memory of 1228	3416	cmd.exe	91
PID 3416 wrote to memory of 4320	3416	cmd.exe	92
PID 3416 wrote to memory of 1844	3416	cmd.exe	93
PID 3416 wrote to memory of 4196	3416	cmd.exe	94
PID 3416 wrote to memory of 6012	3416	cmd.exe	95
PID 3416 wrote to memory of 2488	3416	cmd.exe	96
PID 3416 wrote to memory of 3568	3416	cmd.exe	97
PID 3416 wrote to memory of 5500	3416	cmd.exe	98
PID 3416 wrote to memory of 1420	3416	cmd.exe	99
PID 3416 wrote to memory of 5444	3416	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\MAGIX VEGAS Pro v22.0 patch.exe
"C:\Users\Admin\AppData\Local\Temp\MAGIX VEGAS Pro v22.0 patch.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3616
- C:\Users\Admin\AppData\Local\Temp\is-VTKJK.tmp\MAGIX VEGAS Pro v22.0 patch.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-VTKJK.tmp\MAGIX VEGAS Pro v22.0 patch.tmp" /SL5="$60204,4046882,1178624,C:\Users\Admin\AppData\Local\Temp\MAGIX VEGAS Pro v22.0 patch.exe"
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-EMJ8F.tmp\nircmd.cmd""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3416
  - - C:\Users\Admin\AppData\Local\Temp\is-EMJ8F.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\VEGAS_Pro_22\installation.ini" "Serial" "string" "P3-64979-27462-07906-32757-21318-38872"
      4⤵
      Executes dropped EXE
      PID:1228
  - - C:\Users\Admin\AppData\Local\Temp\is-EMJ8F.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\VEGAS_Pro_22\installation.ini" "VersionUnlock" "NumberOfStarts" "0"
      4⤵
      Executes dropped EXE
      PID:4320
  - - C:\Users\Admin\AppData\Local\Temp\is-EMJ8F.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\VEGAS_Pro_22\installation.ini" "VersionUnlock" "DontShowNagBox" "1"
      4⤵
      Executes dropped EXE
      PID:1844
  - - C:\Users\Admin\AppData\Local\Temp\is-EMJ8F.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\VEGAS_Pro_22\installation.ini" "VersionUnlock" "IsRegisteredUser" "1"
      4⤵
      Executes dropped EXE
      PID:4196
  - - C:\Users\Admin\AppData\Local\Temp\is-EMJ8F.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\VEGAS_Pro_22\installation.ini" "VersionUnlock" "UserEMail" "uBusHTShXjdIakxgck01PRO5nuh8YfF4BDS17GWS/So3BnxxO66uwQ3meU0PEMwM"
      4⤵
      Executes dropped EXE
      PID:6012
  - - C:\Users\Admin\AppData\Local\Temp\is-EMJ8F.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\DVD_Architect_Pro_7\installation.ini" "Serial" "string" "P3-77020-98979-63411-51090-66867-08191"
      4⤵
      Executes dropped EXE
      PID:2488
  - - C:\Users\Admin\AppData\Local\Temp\is-EMJ8F.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\DVD_Architect_Pro_7\installation.ini" "VersionUnlock" "NumberOfStarts" "0"
      4⤵
      Executes dropped EXE
      PID:3568
  - - C:\Users\Admin\AppData\Local\Temp\is-EMJ8F.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\DVD_Architect_Pro_7\installation.ini" "VersionUnlock" "DontShowNagBox" "1"
      4⤵
      Executes dropped EXE
      PID:5500
  - - C:\Users\Admin\AppData\Local\Temp\is-EMJ8F.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\DVD_Architect_Pro_7\installation.ini" "VersionUnlock" "IsRegisteredUser" "1"
      4⤵
      Executes dropped EXE
      PID:1420
  - - C:\Users\Admin\AppData\Local\Temp\is-EMJ8F.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\DVD_Architect_Pro_7\installation.ini" "VersionUnlock" "UserEMail" "uBusHTShXjdIakxgck01PRO5nuh8YfF4BDS17GWS/So3BnxxO66uwQ3meU0PEMwM"
      4⤵
      Executes dropped EXE
      PID:5444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_iscrypt.dll

Path C:\Users\Admin\AppData\Local\Temp\is-EMJ8F.tmp\_isetup\_iscrypt.dll
Size 2KB
SHA256 2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
MD5 a69559718ab506675e907fe49deb71e9
SHA1 bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA512 e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
TLSH
T11051CE835239A462C41A37B426E7E509B35B467643CE4FE33590230EF8876F80C35D90
MD5 SHA1 SHA512 TLSH

Submit Download

nircmd.cmd

Path C:\Users\Admin\AppData\Local\Temp\is-EMJ8F.tmp\nircmd.cmd
Size 1KB
SHA256 915357dfb71b907b64b18a198160e8962ffaaed4d5278d5ac4ee0208b6f089c0
MD5 14d3f2a3efbfe535fa0958da17d565fa
SHA1 958c79de8f3dc821d4c9c89e1f3b92bc7c48637a
SHA512 79ae0e1c73558546d7f61ae5ff0576ddb303e15f3a2be549a0bf32b54f0336bb20357203796341646a53b6c8a6449ccbd9c63174db16b5310ebdbe976aadae75
TLSH
T1052149509173A2AA364B473AAA0995C0F19EC74D57513C1F58926890EB8FF0CFB370AE
MD5 SHA1 SHA512 TLSH

Submit Download

nircmd.exe

Path C:\Users\Admin\AppData\Local\Temp\is-EMJ8F.tmp\nircmd.exe
Size 114KB
SHA256 5bfa034f7555a38e64c078af71b4ff8c49511579fa826a87661940b7e9a6e333
MD5 b417238213efb0d2a23562674406cdf9
SHA1 04bf7acc7d0aa74fa750f7c32fdebbbe1daf46f8
SHA512 881b420af6e7104ac1f2edf03fc905f30af8ee264d8279f7eeb18e6178e210e063ac3c3d9a47f0c7c36ad04b51773e28595f965b037b0a0305d6c9fdf18e96a3
SSDEEP 3072:0l9AT3LpPBrPsvtoAeDmdGX5a7Y8G4ZXGUt+HdkzQFoHCfsDyR1q6:hT3ZVk6AwPRU6
TLSH
T152B35A16B32500EEC066D975CB129707D7F1B8550976A71FABE08DA2AF533E2FC25B02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MAGIX VEGAS Pro v22.0 patch.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-VTKJK.tmp\MAGIX VEGAS Pro v22.0 patch.tmp
Size 3.5MB
SHA256 7a8924b753dbbd168b822d7c483f0150697c6bb31d19cfd1fd872f1090254fcf
MD5 cd0e5319f235a458802e284c1d7fb7c7
SHA1 716d6347b01df04b96c32db414361ae828dec3d9
SHA512 5d3873d79783e7f123f618e41087c59b59ac4e5e932057bc649415d34b4465b29ba84d6390ca2cbea9de2a33f5b7f60300fd722e5ca78d0a9b8d83a804a68406
SSDEEP 49152:xFqOSBnrDcB6qen6rR2SB85UAQl0i3wqEhIjxvB2En4A2yJXyskyM1XQTrR333A:xQTWt3wq2Ijxp2E4A2yJXIyf333A
TLSH
T1CBF51917EE48613AC05A27FB4523C35099377F6165EE5C1666F8FB0C8E3B040EAEA647
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2892-6-0x0000000002570000-0x0000000002571000-memory.dmp

Download

memory/2892-42-0x0000000000400000-0x000000000078B000-memory.dmp

Download

memory/2892-43-0x0000000002570000-0x0000000002571000-memory.dmp

Download

memory/2892-44-0x0000000000400000-0x000000000078B000-memory.dmp

Download

memory/3616-0-0x0000000000400000-0x0000000000531000-memory.dmp

Download

memory/3616-41-0x0000000000400000-0x0000000000531000-memory.dmp

Download

memory/3616-45-0x0000000000400000-0x0000000000531000-memory.dmp

Download