Analysis
- user interaction
yes - max time kernel
149s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
25/08/2026, 09:47
General
- Target Microsoft.HEVCVideoExtension_1.0.40203.0_x64__8wekyb3d8bbwe.appx
- Size 2.8MB
- Sample260825-lsbfvagn8v
- SHA256 db8f01b40f08976c2148bb8ac11f7041ee59f8f5bcf94b997d0705390926a2df
Malware Config
Signatures
- Drops file in Windows directory 1 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell start shell:AppsFolder\Microsoft.HEVCVideoExtension_8wekyb3d8bbwe!App1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\Clipup.exe"C:\Windows\system32\Clipup.exe" -p -pfm Microsoft.HEVCVideoExtension_8wekyb3d8bbwe1⤵
-
C:\Windows\system32\Clipup.exe"C:\Windows\system32\Clipup.exe" -p -pfm Microsoft.HEVCVideoExtension_8wekyb3d8bbwe -ppl C:\Windows\SystemTemp\tem9030.tmp2⤵
- Drops file in Windows directory
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
tem9030.tmp
memory/1368-13-0x000001A03E7E0000-0x000001A03E7F0000-memory.dmp
memory/1368-12-0x000001A03E7E0000-0x000001A03E7F0000-memory.dmp
memory/1368-14-0x000001A03E7E0000-0x000001A03E7F0000-memory.dmp
memory/1368-24-0x000001A03E7E0000-0x000001A03E7F0000-memory.dmp
memory/1368-25-0x000001A03E7E0000-0x000001A03E7F0000-memory.dmp
memory/1368-26-0x000001A03E7E0000-0x000001A03E7F0000-memory.dmp
memory/1368-27-0x000001A03E7E0000-0x000001A03E7F0000-memory.dmp
memory/5456-19-0x0000021215210000-0x0000021215220000-memory.dmp
memory/5456-22-0x0000021215210000-0x0000021215220000-memory.dmp
memory/5456-15-0x0000021215210000-0x0000021215220000-memory.dmp
memory/5456-16-0x0000021215210000-0x0000021215220000-memory.dmp
memory/5456-17-0x0000021215210000-0x0000021215220000-memory.dmp
memory/5456-20-0x0000021215210000-0x0000021215220000-memory.dmp
memory/5456-21-0x0000021215210000-0x0000021215220000-memory.dmp
memory/5936-7-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp
memory/5936-4-0x0000017773030000-0x0000017773052000-memory.dmp
memory/5936-6-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp
memory/5936-0-0x00007FFE66FBF000-0x00007FFE66FC0000-memory.dmp
memory/5936-11-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp
memory/5936-8-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp
memory/5936-9-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp
memory/5936-5-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp
memory/5936-3-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp