e73056bd1d1ef44ece0e8bc3a0ec51914a793552315df0e1e1577d6c8ed4980c

Resubmissions

08/08/2026, 13:08

260808-qdft8sxdra9

08/08/2026, 13:04

260808-qa7hsa1xdx9

Analysis

user interaction
yes
max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 13:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MAGIX VEGAS Pro v23.0.xxx patch.exe
Size 5.0MB
Sample260808-qa7hsa1xdx
SHA256 e73056bd1d1ef44ece0e8bc3a0ec51914a793552315df0e1e1577d6c8ed4980c
MD5 8b928cec3cd7ac732db5781397ef2032
SHA1 9e779c56135bf86013b67cb1c45ddedd96c328b2
SHA512 8f3da7b5923259f87a35a955551e67cc127ac088e3caeb2378254280e2ed2687fe6d67e2f5c40b7445c85768def0778bb761d6243513fcaf7d062007a68b479f
SSDEEP 98304:J7nDM57bzHRaNPzwhtE0tFZPEz3uMOfe7qFwGP86M32Aj:J7DM57bzxCk30up1Puv
TLSH
T15236F12ABE5E613DC05A5AF54523C3105A377E6164FE8D1A42F0FB08CB33448DEEB666
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution installer persistence

Malware Config

Signatures

Detected Nirsoft tools 1 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/files/0x000d00000001c4f6-19.dat	Nirsoft

NirSoft NirCmd 1 IoCs

NirCmd is a lightweight Windows command-line tool for automating system tasks

resource	yara_rule
behavioral2/files/0x000d00000001c4f6-19.dat	NirCmd

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	MAGIX VEGAS Pro v23.0.xxx patch.tmp
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable = "1"	MAGIX VEGAS Pro v23.0.xxx patch.tmp

Executes dropped EXE 11 IoCs

pid	Process
3308	MAGIX VEGAS Pro v23.0.xxx patch.tmp
5196	nircmd.exe
5220	nircmd.exe
5808	nircmd.exe
4252	nircmd.exe
1244	nircmd.exe
2600	nircmd.exe
4452	nircmd.exe
4276	nircmd.exe
4120	nircmd.exe
1516	nircmd.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VEGAS\VEGAS Pro 23.0\Protein\Protein_x64.4.2.dll	MAGIX VEGAS Pro v23.0.xxx patch.tmp
File opened for modification	C:\Program Files\VEGAS\VEGAS Pro 23.0\vegas230.exe.local\wintrust.dll	MAGIX VEGAS Pro v23.0.xxx patch.tmp
File opened for modification	C:\Program Files\VEGAS\VEGAS Pro 23.0\vegas230.exe.local	MAGIX VEGAS Pro v23.0.xxx patch.tmp
File created	C:\Program Files\VEGAS\VEGAS Pro 23.0\Protein\is-J196B.tmp	MAGIX VEGAS Pro v23.0.xxx patch.tmp
File created	C:\Program Files\VEGAS\VEGAS Pro 23.0\vegas230.exe.local\is-Q4A96.tmp	MAGIX VEGAS Pro v23.0.xxx patch.tmp

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1628	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MAGIX VEGAS Pro v23.0.xxx patch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MAGIX VEGAS Pro v23.0.xxx patch.tmp

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/2996-0-0x0000000000400000-0x000000000053C000-memory.dmp	innosetup
behavioral2/memory/2996-38-0x0000000000400000-0x000000000053C000-memory.dmp	innosetup
behavioral2/memory/2996-42-0x0000000000400000-0x000000000053C000-memory.dmp	innosetup

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3308	MAGIX VEGAS Pro v23.0.xxx patch.tmp
3308	MAGIX VEGAS Pro v23.0.xxx patch.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3308	MAGIX VEGAS Pro v23.0.xxx patch.tmp

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 3308	2996	MAGIX VEGAS Pro v23.0.xxx patch.exe	89
PID 3308 wrote to memory of 1628	3308	MAGIX VEGAS Pro v23.0.xxx patch.tmp	90
PID 1628 wrote to memory of 5196	1628	cmd.exe	92
PID 1628 wrote to memory of 5220	1628	cmd.exe	93
PID 1628 wrote to memory of 5808	1628	cmd.exe	94
PID 1628 wrote to memory of 4252	1628	cmd.exe	95
PID 1628 wrote to memory of 1244	1628	cmd.exe	96
PID 1628 wrote to memory of 2600	1628	cmd.exe	97
PID 1628 wrote to memory of 4452	1628	cmd.exe	98
PID 1628 wrote to memory of 4276	1628	cmd.exe	99
PID 1628 wrote to memory of 4120	1628	cmd.exe	100
PID 1628 wrote to memory of 1516	1628	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\MAGIX VEGAS Pro v23.0.xxx patch.exe
"C:\Users\Admin\AppData\Local\Temp\MAGIX VEGAS Pro v23.0.xxx patch.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Users\Admin\AppData\Local\Temp\is-4UB6F.tmp\MAGIX VEGAS Pro v23.0.xxx patch.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-4UB6F.tmp\MAGIX VEGAS Pro v23.0.xxx patch.tmp" /SL5="$40116,4159888,1234944,C:\Users\Admin\AppData\Local\Temp\MAGIX VEGAS Pro v23.0.xxx patch.exe"
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3308
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-UEO7K.tmp\nircmd.cmd""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1628
  - - C:\Users\Admin\AppData\Local\Temp\is-UEO7K.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\VEGAS_Pro_23\installation.ini" "Serial" "string" "P3-64979-27462-07906-32757-21318-38872"
      4⤵
      Executes dropped EXE
      PID:5196
  - - C:\Users\Admin\AppData\Local\Temp\is-UEO7K.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\VEGAS_Pro_23\installation.ini" "VersionUnlock" "NumberOfStarts" "0"
      4⤵
      Executes dropped EXE
      PID:5220
  - - C:\Users\Admin\AppData\Local\Temp\is-UEO7K.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\VEGAS_Pro_23\installation.ini" "VersionUnlock" "DontShowNagBox" "1"
      4⤵
      Executes dropped EXE
      PID:5808
  - - C:\Users\Admin\AppData\Local\Temp\is-UEO7K.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\VEGAS_Pro_23\installation.ini" "VersionUnlock" "IsRegisteredUser" "1"
      4⤵
      Executes dropped EXE
      PID:4252
  - - C:\Users\Admin\AppData\Local\Temp\is-UEO7K.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\VEGAS_Pro_23\installation.ini" "VersionUnlock" "UserEMail" "uBusHTShXjdIakxgck01PRO5nuh8YfF4BDS17GWS/So3BnxxO66uwQ3meU0PEMwM"
      4⤵
      Executes dropped EXE
      PID:1244
  - - C:\Users\Admin\AppData\Local\Temp\is-UEO7K.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\DVD_Architect_Pro_7\installation.ini" "Serial" "string" "P3-77020-98979-63411-51090-66867-08191"
      4⤵
      Executes dropped EXE
      PID:2600
  - - C:\Users\Admin\AppData\Local\Temp\is-UEO7K.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\DVD_Architect_Pro_7\installation.ini" "VersionUnlock" "NumberOfStarts" "0"
      4⤵
      Executes dropped EXE
      PID:4452
  - - C:\Users\Admin\AppData\Local\Temp\is-UEO7K.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\DVD_Architect_Pro_7\installation.ini" "VersionUnlock" "DontShowNagBox" "1"
      4⤵
      Executes dropped EXE
      PID:4276
  - - C:\Users\Admin\AppData\Local\Temp\is-UEO7K.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\DVD_Architect_Pro_7\installation.ini" "VersionUnlock" "IsRegisteredUser" "1"
      4⤵
      Executes dropped EXE
      PID:4120
  - - C:\Users\Admin\AppData\Local\Temp\is-UEO7K.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\DVD_Architect_Pro_7\installation.ini" "VersionUnlock" "UserEMail" "uBusHTShXjdIakxgck01PRO5nuh8YfF4BDS17GWS/So3BnxxO66uwQ3meU0PEMwM"
      4⤵
      Executes dropped EXE
      PID:1516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MAGIX VEGAS Pro v23.0.xxx patch.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-4UB6F.tmp\MAGIX VEGAS Pro v23.0.xxx patch.tmp
Size 3.9MB
SHA256 6cd551879065a6cbdb4adf6b171279ee3b562506de6aa62f1773bc78db0a8f92
MD5 0466ce09f089c44d98ec9dc6c686be8d
SHA1 f3294e7a3df27d346f73b44d018cd8c670d533c1
SHA512 6c5d85f316a0720ce302b3460f45da353922fccfd8fd83f0df90b6dd1363e7582dced3969b5fadd2f52e8ecec8c090fa4829942b5fb01fbfa3c25f6c732896e7
SSDEEP 49152:orHHFnKA0otwLU/g2SmYXFuaYQ4mQVHYEXQcmpeDxjT/8333v:ornwboEuM4mQiEC0DK333v
TLSH
T1AB163913FE44A83AC05A2AF54527C75499377F2169EEDC1256E8FB0C8E37040FAEB646
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nircmd.cmd

Path C:\Users\Admin\AppData\Local\Temp\is-UEO7K.tmp\nircmd.cmd
Size 1KB
SHA256 26786e0cec865055c9f683e5b223ac53a4f79096e5c9557f8b19724608b6f23b
MD5 31a0172a08721aa7a574248770aaed7b
SHA1 56bb344dafb785df689d00675cdfd679600477b7
SHA512 615afddd81a8f31f94e65e9a93e7adecc27b4d59c8dc5fe6b4b2282301bd0af338d8a6d3a423348b3b51437fefeef1dbf5734b32a33d2847ab9b3a3e4579ee7d
TLSH
T1FA217E505173A2A5324B4B39AA0995C0F09EC74D63453C1F1892A890EB8FF0DFB370AF
MD5 SHA1 SHA512 TLSH

Submit Download

nircmd.exe

Path C:\Users\Admin\AppData\Local\Temp\is-UEO7K.tmp\nircmd.exe
Size 117KB
SHA256 2e81e048ab419fdc6e5f4336a951bd282ed6b740048dc38d7673678ee3490cda
MD5 4a9da765fd91e80decfd2c9fe221e842
SHA1 6f763fbd2b37b2ce76a8e874b05a8075f48d1171
SHA512 4716e598e4b930a0ec89f4d826afaa3dade22cf002111340bc253a618231e88f2f5247f918f993ed15b8ce0e3a97d6838c12b17616913e48334ee9b713c1957a
SSDEEP 3072:oG0tOQJC9TPafQy26RAA3hh5Tgr559MJZpOSDUDyjHHKHlLz1Ms/b:2OQJC9uICA11l1MYb
TLSH
T13AC34926732400EEC467E875DA119327C6F1BC550576E71FABD18CA7AF073A2BD29B02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2996-0-0x0000000000400000-0x000000000053C000-memory.dmp

Download

memory/2996-38-0x0000000000400000-0x000000000053C000-memory.dmp

Download

memory/2996-42-0x0000000000400000-0x000000000053C000-memory.dmp

Download

memory/3308-6-0x0000000000B60000-0x0000000000B61000-memory.dmp

Download

memory/3308-40-0x0000000000B60000-0x0000000000B61000-memory.dmp

Download

memory/3308-39-0x0000000000400000-0x00000000007F1000-memory.dmp

Download

memory/3308-41-0x0000000000400000-0x00000000007F1000-memory.dmp

Download