5bf7313421c6d05708d75654a53e736a89238d34beced4d7d28d3e41d1dd85fa

Sharing

Copy URL Twitter E-mail

General

Target
MAGIX VEGAS Pro v23.0.0.356 (x64).zip
Size 854.0MB
Sample260804-f2ea7sgl9t
SHA256 5bf7313421c6d05708d75654a53e736a89238d34beced4d7d28d3e41d1dd85fa
MD5 fefa78fed97045be69e93fd3230195c1
SHA1 4adc43b78f731a80029e41ccae2d048bde4d7ee3
SHA512 56585615b3d25dd06a2c69738adbeafb83954a27d07469b6c83785789dfd6e56cdd6f19b8e3536305db31a8b4781dba1efe0876c80f046448ea86734e8b1496f
SSDEEP 25165824:EuenxG8MzZ8fmNxw1L6tgwqyzypi3+mPkD2nB8XP2dtiON+F:pqzMcVB5y+ROkD2nHU
TLSH
T1F099333E7DECCCE2985DBD5E3B89218172503960721F05A9D67858FBA33C6D92E70E60
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  Patch/MAGIX VEGAS Pro v23.0.xxx patch.exe
- Size 5.0MB
- SHA256 e73056bd1d1ef44ece0e8bc3a0ec51914a793552315df0e1e1577d6c8ed4980c
- MD5 8b928cec3cd7ac732db5781397ef2032
- SHA1 9e779c56135bf86013b67cb1c45ddedd96c328b2
- SHA512 8f3da7b5923259f87a35a955551e67cc127ac088e3caeb2378254280e2ed2687fe6d67e2f5c40b7445c85768def0778bb761d6243513fcaf7d062007a68b479f
- SSDEEP 98304:J7nDM57bzHRaNPzwhtE0tFZPEz3uMOfe7qFwGP86M32Aj:J7DM57bzxCk30up1Puv
- TLSH
  T15236F12ABE5E613DC05A5AF54523C3105A377E6164FE8D1A42F0FB08CB33448DEEB666
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

discovery execution installer persistence
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- NirSoft NirCmd
  NirCmd is a lightweight Windows command-line tool for automating system tasks
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Executes dropped EXE
behavioral1 behavioral2 behavioral3
- Target
  Setup/Setup.exe
- Size 658.4MB
- SHA256 2b7d2e0cecf79a67de90a57870a1bd25d73741db1ea4cd7093581a41009247b4
- MD5 0d3beaa032fda96e63869232e58bf474
- SHA1 18eef6ed11cbde8a8c7967750fd1719f98fa75a7
- SHA512 7660163c330a160fbb2a091099c84532ef7f7721256ddcd4190e3e3521cf113c4b73235704507eaef3c9331962c9dccd11af3c98ed43e88584d085ad494498ac
- SSDEEP 12582912:ZWI336PytUMEjQ3Pi8NYFFXSeP9kqxPaxa3IAdUWjlUnFgobqM5S5VeZaGh4voCa:ZWI338gU5jQ34P9kOSxkV6K+nqMI50Z1
- TLSH
  T16A6933257F0A41AEE44102F189A6D31A22249D6413FD01E3EB9DF76693774D2EBF1B23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery execution installer persistence privilege_escalation ransomware
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral4 behavioral5 behavioral6
- Target
  Update/Update.exe
- Size 195.7MB
- SHA256 4fb627f8126c1176e1ccb388c6e19872677e33bd14d1cacda146a20fad31d10a
- MD5 5ad8e09d0a56e57afc1c2b8fa39d65d7
- SHA1 dd189d18c479b05117fbcb2c35772c95a82031aa
- SHA512 bb50e3c7c77815f08a5b20a4fb6702d8d7debd1f85d33f26a49d2d59b8fd382b60ea7518d0430756de7c8f95366b7da439ca4e5ec678e9fce47fefb5fcd34980
- SSDEEP 3145728:HFOZ/5S1ZT56SlRNWXR48vP7hxDDIcFdxt/cO1mCG94HWibTJtg0R+k:HgZ/5S1ZgiWX7FxNXcO1mCGO2ibvph
- TLSH
  T1C7A833103F8A816EE00202F69966D76816248D9443FD01E7EB5EF72B9377592E7F1B23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral7 behavioral8 behavioral9