e73056bd1d1ef44ece0e8bc3a0ec51914a793552315df0e1e1577d6c8ed4980c

General

Target
patch_upload.exe
Size 5.0MB
Sample260808-mabjkadn2x
SHA256 e73056bd1d1ef44ece0e8bc3a0ec51914a793552315df0e1e1577d6c8ed4980c
MD5 8b928cec3cd7ac732db5781397ef2032
SHA1 9e779c56135bf86013b67cb1c45ddedd96c328b2
SHA512 8f3da7b5923259f87a35a955551e67cc127ac088e3caeb2378254280e2ed2687fe6d67e2f5c40b7445c85768def0778bb761d6243513fcaf7d062007a68b479f
SSDEEP 98304:J7nDM57bzHRaNPzwhtE0tFZPEz3uMOfe7qFwGP86M32Aj:J7DM57bzxCk30up1Puv
TLSH
T15236F12ABE5E613DC05A5AF54523C3105A377E6164FE8D1A42F0FB08CB33448DEEB666
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution installer persistence

Malware Config

Signatures

Detected Nirsoft tools 1 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/files/0x000d00000001c424-19.dat	Nirsoft

NirSoft NirCmd 1 IoCs

NirCmd is a lightweight Windows command-line tool for automating system tasks

resource	yara_rule
behavioral2/files/0x000d00000001c424-19.dat	NirCmd

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	patch_upload.tmp
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable = "1"	patch_upload.tmp

Executes dropped EXE 11 IoCs

pid	Process
2348	patch_upload.tmp
3860	nircmd.exe
4572	nircmd.exe
4520	nircmd.exe
4600	nircmd.exe
2472	nircmd.exe
1260	nircmd.exe
1120	nircmd.exe
5916	nircmd.exe
2144	nircmd.exe
2712	nircmd.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VEGAS\VEGAS Pro 23.0\vegas230.exe.local	patch_upload.tmp
File created	C:\Program Files\VEGAS\VEGAS Pro 23.0\Protein\is-RD4FV.tmp	patch_upload.tmp
File created	C:\Program Files\VEGAS\VEGAS Pro 23.0\vegas230.exe.local\is-VSQ0I.tmp	patch_upload.tmp
File opened for modification	C:\Program Files\VEGAS\VEGAS Pro 23.0\Protein\Protein_x64.4.2.dll	patch_upload.tmp
File opened for modification	C:\Program Files\VEGAS\VEGAS Pro 23.0\vegas230.exe.local\wintrust.dll	patch_upload.tmp

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1652	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patch_upload.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patch_upload.tmp

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/5660-0-0x0000000000400000-0x000000000053C000-memory.dmp	innosetup
behavioral2/memory/5660-39-0x0000000000400000-0x000000000053C000-memory.dmp	innosetup

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2348	patch_upload.tmp
2348	patch_upload.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2348	patch_upload.tmp

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 5660 wrote to memory of 2348	5660	patch_upload.exe	89
PID 2348 wrote to memory of 1652	2348	patch_upload.tmp	90
PID 1652 wrote to memory of 3860	1652	cmd.exe	92
PID 1652 wrote to memory of 4572	1652	cmd.exe	93
PID 1652 wrote to memory of 4520	1652	cmd.exe	94
PID 1652 wrote to memory of 4600	1652	cmd.exe	95
PID 1652 wrote to memory of 2472	1652	cmd.exe	96
PID 1652 wrote to memory of 1260	1652	cmd.exe	97
PID 1652 wrote to memory of 1120	1652	cmd.exe	98
PID 1652 wrote to memory of 5916	1652	cmd.exe	99
PID 1652 wrote to memory of 2144	1652	cmd.exe	100
PID 1652 wrote to memory of 2712	1652	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\patch_upload.exe
"C:\Users\Admin\AppData\Local\Temp\patch_upload.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5660
- C:\Users\Admin\AppData\Local\Temp\is-45V7O.tmp\patch_upload.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-45V7O.tmp\patch_upload.tmp" /SL5="$40196,4159888,1234944,C:\Users\Admin\AppData\Local\Temp\patch_upload.exe"
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2348
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-C95D3.tmp\nircmd.cmd""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1652
  - - C:\Users\Admin\AppData\Local\Temp\is-C95D3.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\VEGAS_Pro_23\installation.ini" "Serial" "string" "P3-64979-27462-07906-32757-21318-38872"
      4⤵
      Executes dropped EXE
      PID:3860
  - - C:\Users\Admin\AppData\Local\Temp\is-C95D3.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\VEGAS_Pro_23\installation.ini" "VersionUnlock" "NumberOfStarts" "0"
      4⤵
      Executes dropped EXE
      PID:4572
  - - C:\Users\Admin\AppData\Local\Temp\is-C95D3.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\VEGAS_Pro_23\installation.ini" "VersionUnlock" "DontShowNagBox" "1"
      4⤵
      Executes dropped EXE
      PID:4520
  - - C:\Users\Admin\AppData\Local\Temp\is-C95D3.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\VEGAS_Pro_23\installation.ini" "VersionUnlock" "IsRegisteredUser" "1"
      4⤵
      Executes dropped EXE
      PID:4600
  - - C:\Users\Admin\AppData\Local\Temp\is-C95D3.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\VEGAS_Pro_23\installation.ini" "VersionUnlock" "UserEMail" "uBusHTShXjdIakxgck01PRO5nuh8YfF4BDS17GWS/So3BnxxO66uwQ3meU0PEMwM"
      4⤵
      Executes dropped EXE
      PID:2472
  - - C:\Users\Admin\AppData\Local\Temp\is-C95D3.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\DVD_Architect_Pro_7\installation.ini" "Serial" "string" "P3-77020-98979-63411-51090-66867-08191"
      4⤵
      Executes dropped EXE
      PID:1260
  - - C:\Users\Admin\AppData\Local\Temp\is-C95D3.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\DVD_Architect_Pro_7\installation.ini" "VersionUnlock" "NumberOfStarts" "0"
      4⤵
      Executes dropped EXE
      PID:1120
  - - C:\Users\Admin\AppData\Local\Temp\is-C95D3.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\DVD_Architect_Pro_7\installation.ini" "VersionUnlock" "DontShowNagBox" "1"
      4⤵
      Executes dropped EXE
      PID:5916
  - - C:\Users\Admin\AppData\Local\Temp\is-C95D3.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\DVD_Architect_Pro_7\installation.ini" "VersionUnlock" "IsRegisteredUser" "1"
      4⤵
      Executes dropped EXE
      PID:2144
  - - C:\Users\Admin\AppData\Local\Temp\is-C95D3.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\DVD_Architect_Pro_7\installation.ini" "VersionUnlock" "UserEMail" "uBusHTShXjdIakxgck01PRO5nuh8YfF4BDS17GWS/So3BnxxO66uwQ3meU0PEMwM"
      4⤵
      Executes dropped EXE
      PID:2712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Event Triggered Execution

1

T1546

Image File Execution Options Injection

1

T1546.012

Privilege Escalation

Event Triggered Execution

1

T1546

Image File Execution Options Injection

1

T1546.012

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patch_upload.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-45V7O.tmp\patch_upload.tmp
Size 3.9MB
SHA256 6cd551879065a6cbdb4adf6b171279ee3b562506de6aa62f1773bc78db0a8f92
MD5 0466ce09f089c44d98ec9dc6c686be8d
SHA1 f3294e7a3df27d346f73b44d018cd8c670d533c1
SHA512 6c5d85f316a0720ce302b3460f45da353922fccfd8fd83f0df90b6dd1363e7582dced3969b5fadd2f52e8ecec8c090fa4829942b5fb01fbfa3c25f6c732896e7
SSDEEP 49152:orHHFnKA0otwLU/g2SmYXFuaYQ4mQVHYEXQcmpeDxjT/8333v:ornwboEuM4mQiEC0DK333v
TLSH
T1AB163913FE44A83AC05A2AF54527C75499377F2169EEDC1256E8FB0C8E37040FAEB646
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nircmd.cmd

Path C:\Users\Admin\AppData\Local\Temp\is-C95D3.tmp\nircmd.cmd
Size 1KB
SHA256 26786e0cec865055c9f683e5b223ac53a4f79096e5c9557f8b19724608b6f23b
MD5 31a0172a08721aa7a574248770aaed7b
SHA1 56bb344dafb785df689d00675cdfd679600477b7
SHA512 615afddd81a8f31f94e65e9a93e7adecc27b4d59c8dc5fe6b4b2282301bd0af338d8a6d3a423348b3b51437fefeef1dbf5734b32a33d2847ab9b3a3e4579ee7d
TLSH
T1FA217E505173A2A5324B4B39AA0995C0F09EC74D63453C1F1892A890EB8FF0DFB370AF
MD5 SHA1 SHA512 TLSH

Submit Download

nircmd.exe

Path C:\Users\Admin\AppData\Local\Temp\is-C95D3.tmp\nircmd.exe
Size 117KB
SHA256 2e81e048ab419fdc6e5f4336a951bd282ed6b740048dc38d7673678ee3490cda
MD5 4a9da765fd91e80decfd2c9fe221e842
SHA1 6f763fbd2b37b2ce76a8e874b05a8075f48d1171
SHA512 4716e598e4b930a0ec89f4d826afaa3dade22cf002111340bc253a618231e88f2f5247f918f993ed15b8ce0e3a97d6838c12b17616913e48334ee9b713c1957a
SSDEEP 3072:oG0tOQJC9TPafQy26RAA3hh5Tgr559MJZpOSDUDyjHHKHlLz1Ms/b:2OQJC9uICA11l1MYb
TLSH
T13AC34926732400EEC467E875DA119327C6F1BC550576E71FABD18CA7AF073A2BD29B02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2348-6-0x0000000000E40000-0x0000000000E41000-memory.dmp

Download

memory/2348-38-0x0000000000400000-0x00000000007F1000-memory.dmp

Download

memory/5660-0-0x0000000000400000-0x000000000053C000-memory.dmp

Download

memory/5660-39-0x0000000000400000-0x000000000053C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads