Analysis
- user interaction
yes - max time kernel
48s - max time network
59s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/09/2026, 00:47
Static task
static1
Behavioral task
behavioral1
Sample
videomanager-P9wg.msi
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
19 signatures
150 seconds
General
- Target videomanager-P9wg.msi
- Size 123.2MB
- Sample260913-a5brlayfmc
- SHA256 678cd8d43ee095c2effc74df1f2f66d785798febdf864177e627e16043698522
- MD5 e492bb38822fa45fdfa1b4564fa0167f
- SHA1 960a260ac250e05074f9777c65c6471fe3a4c1eb
- SHA512 00ed7c3bd94a3222b9024cd087ee9d283352153123ae9317af3b7e3008de74682b2ebde01a6f25bfc70afef82a804eb14b884386d29c0d197d9da4a563aec602
- SSDEEP 3145728:zxRyMQg/l9l+fs1ejfyYoS0g+YGFEKPugW4qniO6Lu:Gsl9l+E1e+YoC+YGF5PugW4quL
- TLSH T1B45833BE9824B71BE467DE394A523B18479B7D3061035803A33E770EAA773D1687B4C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 4012 rundll32.exe 3 3448 rundll32.exe 4 3308 rundll32.exe 10 1200 rundll32.exe - Executes dropped EXE 3 IoCs
pid Process 5760 VideoManagerHelperTool.exe 4088 VideoManager.exe 4316 VideoManager.exe - Loads dropped DLL 64 IoCs
pid Process 6100 MsiExec.exe 4012 rundll32.exe 4012 rundll32.exe 4012 rundll32.exe 4012 rundll32.exe 4012 rundll32.exe 4012 rundll32.exe 4012 rundll32.exe 6100 MsiExec.exe 3448 rundll32.exe 3448 rundll32.exe 3448 rundll32.exe 3448 rundll32.exe 3448 rundll32.exe 3448 rundll32.exe 3448 rundll32.exe 4640 MsiExec.exe 3252 rundll32.exe 3252 rundll32.exe 3252 rundll32.exe 3252 rundll32.exe 3252 rundll32.exe 4640 MsiExec.exe 3308 rundll32.exe 3308 rundll32.exe 3308 rundll32.exe 3308 rundll32.exe 3308 rundll32.exe 3308 rundll32.exe 3308 rundll32.exe 4640 MsiExec.exe 1200 rundll32.exe 1200 rundll32.exe 1200 rundll32.exe 1200 rundll32.exe 1200 rundll32.exe 1200 rundll32.exe 1200 rundll32.exe 4640 MsiExec.exe 1988 rundll32.exe 1988 rundll32.exe 1988 rundll32.exe 1988 rundll32.exe 1988 rundll32.exe 4088 VideoManager.exe 4316 VideoManager.exe 4088 VideoManager.exe 4316 VideoManager.exe 4316 VideoManager.exe 4316 VideoManager.exe 4088 VideoManager.exe 4088 VideoManager.exe 4088 VideoManager.exe 4088 VideoManager.exe 4316 VideoManager.exe 4316 VideoManager.exe 4088 VideoManager.exe 4088 VideoManager.exe 4316 VideoManager.exe 4316 VideoManager.exe 4088 VideoManager.exe 4088 VideoManager.exe 4316 VideoManager.exe 4316 VideoManager.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows\CurrentVersion\Run\VideoManagerHelperTool = "\"C:\\Users\\Admin\\AppData\\Local\\VideoManagerHelperTool\\VideoManagerHelperTool.exe\"" msiexec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\A: msiexec.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\VideoManager\Microsoft.AspNetCore.DataProtection.Abstractions.dll msiexec.exe File created C:\Program Files (x86)\VideoManager\Microsoft.Extensions.Configuration.Abstractions.dll msiexec.exe File created C:\Program Files (x86)\VideoManager\Microsoft.Xaml.Behaviors.dll msiexec.exe File created C:\Program Files (x86)\VideoManager\SharpVectors.Css.dll msiexec.exe File created C:\Program Files (x86)\VideoManager\Resources\Dependencies\yt-dlp.exe msiexec.exe File created C:\Program Files (x86)\VideoManager\runtimes\win-x86\native\e_sqlite3.dll msiexec.exe File created C:\Program Files (x86)\VideoManager\Microsoft.AspNetCore.DataProtection.dll msiexec.exe File created C:\Program Files (x86)\VideoManager\Microsoft.Extensions.Options.dll msiexec.exe File created C:\Program Files (x86)\VideoManager\SharpVectors.Core.dll msiexec.exe File created C:\Program Files (x86)\VideoManager\SQLitePCLRaw.batteries_v2.dll msiexec.exe File created C:\Program Files (x86)\VideoManager\VideoManager.exe.config msiexec.exe File created C:\Program Files (x86)\VideoManager\Microsoft.Extensions.ObjectPool.dll msiexec.exe File created C:\Program Files (x86)\VideoManager\SharpVectors.Dom.dll msiexec.exe File created C:\Program Files (x86)\VideoManager\System.Security.Principal.Windows.dll msiexec.exe File created C:\Program Files (x86)\VideoManager\SQLitePCLRaw.provider.dynamic_cdecl.dll msiexec.exe File created C:\Program Files (x86)\VideoManager\System.Security.AccessControl.dll msiexec.exe File created C:\Program Files (x86)\VideoManager\System.Threading.Tasks.Extensions.dll msiexec.exe File created C:\Program Files (x86)\VideoManager\Microsoft.Extensions.Logging.Abstractions.dll msiexec.exe File created C:\Program Files (x86)\VideoManager\SharpVectors.Runtime.Wpf.dll msiexec.exe File created C:\Program Files (x86)\VideoManager\SQLitePCLRaw.core.dll msiexec.exe File created C:\Program Files (x86)\VideoManager\Updater.exe.config msiexec.exe File created C:\Program Files (x86)\VideoManager\Microsoft.AspNetCore.Http.Extensions.dll msiexec.exe File created C:\Program Files (x86)\VideoManager\de\MahApps.Metro.resources.dll msiexec.exe File created C:\Program Files (x86)\VideoManager\Microsoft.Toolkit.Uwp.Notifications.dll msiexec.exe File created C:\Program Files (x86)\VideoManager\Microsoft.Win32.Registry.dll msiexec.exe File created C:\Program Files (x86)\VideoManager\System.Security.Cryptography.Xml.dll msiexec.exe File created C:\Program Files (x86)\VideoManager\MahApps.Metro.dll msiexec.exe File created C:\Program Files (x86)\VideoManager\Microsoft.AspNetCore.Authentication.Core.dll msiexec.exe File created C:\Program Files (x86)\VideoManager\SharpVectors.Model.dll msiexec.exe File created C:\Program Files (x86)\VideoManager\System.Memory.dll msiexec.exe File created C:\Program Files (x86)\VideoManager\System.Text.Json.dll msiexec.exe File created C:\Program Files (x86)\VideoManager\runtimes\win-arm\native\e_sqlite3.dll msiexec.exe File created C:\Program Files (x86)\VideoManager\Microsoft.AspNetCore.Hosting.Server.Abstractions.dll msiexec.exe File created C:\Program Files (x86)\VideoManager\Microsoft.AspNetCore.Http.Abstractions.dll msiexec.exe File created C:\Program Files (x86)\VideoManager\Microsoft.Extensions.Hosting.Abstractions.dll msiexec.exe File created C:\Program Files (x86)\VideoManager\System.IO.Pipelines.dll msiexec.exe File created C:\Program Files (x86)\VideoManager\Resources\Dependencies\deno.exe msiexec.exe File created C:\Program Files (x86)\VideoManager\Microsoft.Data.Sqlite.dll msiexec.exe File created C:\Program Files (x86)\VideoManager\Microsoft.Extensions.FileProviders.Abstractions.dll msiexec.exe File created C:\Program Files (x86)\VideoManager\Updater.exe msiexec.exe File created C:\Program Files (x86)\VideoManager\Microsoft.AspNetCore.Authentication.Abstractions.dll msiexec.exe File created C:\Program Files (x86)\VideoManager\runtimes\win-x64\native\e_sqlite3.dll msiexec.exe File created C:\Program Files (x86)\VideoManager\Microsoft.Web.WebView2.Core.dll msiexec.exe File created C:\Program Files (x86)\VideoManager\Microsoft.Extensions.WebEncoders.dll msiexec.exe File created C:\Program Files (x86)\VideoManager\SharpVectors.Rendering.Wpf.dll msiexec.exe File created C:\Program Files (x86)\VideoManager\System.Text.Encodings.Web.dll msiexec.exe File created C:\Program Files (x86)\VideoManager\de\VideoManager.resources.dll msiexec.exe File created C:\Program Files (x86)\VideoManager\Microsoft.AspNetCore.WebUtilities.dll msiexec.exe File created C:\Program Files (x86)\VideoManager\Microsoft.Extensions.Primitives.dll msiexec.exe File created C:\Program Files (x86)\VideoManager\System.Security.Permissions.dll msiexec.exe File created C:\Program Files (x86)\VideoManager\VideoManager.exe msiexec.exe File created C:\Program Files (x86)\VideoManager\ControlzEx.dll msiexec.exe File created C:\Program Files (x86)\VideoManager\Microsoft.AspNetCore.Http.Features.dll msiexec.exe File created C:\Program Files (x86)\VideoManager\Microsoft.Net.Http.Headers.dll msiexec.exe File created C:\Program Files (x86)\VideoManager\Microsoft.Web.WebView2.Wpf.dll msiexec.exe File created C:\Program Files (x86)\VideoManager\System.Numerics.Vectors.dll msiexec.exe File created C:\Program Files (x86)\VideoManager\System.Runtime.CompilerServices.Unsafe.dll msiexec.exe File created C:\Program Files (x86)\VideoManager\AppEventManager.dll msiexec.exe File created C:\Program Files (x86)\VideoManager\es\VideoManager.resources.dll msiexec.exe File created C:\Program Files (x86)\VideoManager\Microsoft.AspNetCore.Hosting.Abstractions.dll msiexec.exe File created C:\Program Files (x86)\VideoManager\System.CodeDom.dll msiexec.exe File created C:\Program Files (x86)\VideoManager\Microsoft.AspNetCore.Http.dll msiexec.exe File created C:\Program Files (x86)\VideoManager\Microsoft.Bcl.AsyncInterfaces.dll msiexec.exe File created C:\Program Files (x86)\VideoManager\Microsoft.Extensions.DependencyInjection.Abstractions.dll msiexec.exe - Drops file in Windows directory 36 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI2676.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI2676.tmp-\CustomAction.config rundll32.exe File created C:\Windows\Installer\{72920ABA-2DF1-4336-9FD8-75A83FE7677C}\VideoManager.ico msiexec.exe File opened for modification C:\Windows\Installer\MSI4877.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File created C:\Windows\SystemTemp\~DFC4AAC4DB8D8C466A.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI2491.tmp-\VideoManager.CustomActionsWiX.dll rundll32.exe File created C:\Windows\SystemTemp\~DFA279EDE034765A4B.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI4F9C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4F9C.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI2676.tmp-\VideoManager.CustomActionsWiX.dll rundll32.exe File created C:\Windows\Installer\SourceHash{72920ABA-2DF1-4336-9FD8-75A83FE7677C} msiexec.exe File created C:\Windows\Installer\e5a1bb9.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI4877.tmp-\VideoManager.CustomActionsWiX.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI4F9C.tmp-\VideoManager.CustomActionsWiX.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI4F9C.tmp-\Newtonsoft.Json.dll rundll32.exe File created C:\Windows\Installer\{72920ABA-2DF1-4336-9FD8-75A83FE7677C}\DesktopShortcut.ico msiexec.exe File created C:\Windows\Installer\e5a1bb7.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI2491.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2491.tmp-\Newtonsoft.Json.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI2491.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI2676.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2491.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\{72920ABA-2DF1-4336-9FD8-75A83FE7677C}\DesktopShortcut.ico msiexec.exe File opened for modification C:\Windows\Installer\MSI4877.tmp-\Newtonsoft.Json.dll rundll32.exe File created C:\Windows\SystemTemp\~DF94EF3A53DBF0BB00.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI2676.tmp-\Newtonsoft.Json.dll rundll32.exe File opened for modification C:\Windows\Installer\{72920ABA-2DF1-4336-9FD8-75A83FE7677C}\VideoManager.ico msiexec.exe File opened for modification C:\Windows\Installer\MSI4F9C.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\e5a1bb7.msi msiexec.exe File created C:\Windows\SystemTemp\~DF6D101D9994808E87.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI4877.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI3DC8.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4877.tmp-\CustomAction.config rundll32.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 1860 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VideoManager.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VideoManager.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe - Modifies registry class 25 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ABA029271FD26334F98D578AF37E76C7\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\ABA029271FD26334F98D578AF37E76C7\HelperToolFeature = "ProductFeature" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ABA029271FD26334F98D578AF37E76C7\PackageCode = "17A08E9825D73BA45A47C1E739D604CA" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ABA029271FD26334F98D578AF37E76C7\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ABA029271FD26334F98D578AF37E76C7\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ABA029271FD26334F98D578AF37E76C7\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\ABA029271FD26334F98D578AF37E76C7\ProductFeature msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ABA029271FD26334F98D578AF37E76C7\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ABA029271FD26334F98D578AF37E76C7\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\124EBC2DE2A5C7D478994EE4B20AE6E2 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ABA029271FD26334F98D578AF37E76C7\SourceList\Media\2 = ";" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\ABA029271FD26334F98D578AF37E76C7 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ABA029271FD26334F98D578AF37E76C7 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ABA029271FD26334F98D578AF37E76C7\ProductName = "VideoManager" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ABA029271FD26334F98D578AF37E76C7\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ABA029271FD26334F98D578AF37E76C7\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ABA029271FD26334F98D578AF37E76C7\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ABA029271FD26334F98D578AF37E76C7\SourceList\PackageName = "videomanager-P9wg.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ABA029271FD26334F98D578AF37E76C7\SourceList\Media msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ABA029271FD26334F98D578AF37E76C7\Version = "16777216" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ABA029271FD26334F98D578AF37E76C7\ProductIcon = "C:\\Windows\\Installer\\{72920ABA-2DF1-4336-9FD8-75A83FE7677C}\\VideoManager.ico" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\124EBC2DE2A5C7D478994EE4B20AE6E2\ABA029271FD26334F98D578AF37E76C7 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ABA029271FD26334F98D578AF37E76C7\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ABA029271FD26334F98D578AF37E76C7\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ABA029271FD26334F98D578AF37E76C7\SourceList\Media\1 = ";" msiexec.exe - Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 1988 rundll32.exe 1988 rundll32.exe 1988 rundll32.exe 4316 VideoManager.exe 4316 VideoManager.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1860 msiexec.exe Token: SeIncreaseQuotaPrivilege 1860 msiexec.exe Token: SeSecurityPrivilege 1108 msiexec.exe Token: SeCreateTokenPrivilege 1860 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1860 msiexec.exe Token: SeLockMemoryPrivilege 1860 msiexec.exe Token: SeIncreaseQuotaPrivilege 1860 msiexec.exe Token: SeMachineAccountPrivilege 1860 msiexec.exe Token: SeTcbPrivilege 1860 msiexec.exe Token: SeSecurityPrivilege 1860 msiexec.exe Token: SeTakeOwnershipPrivilege 1860 msiexec.exe Token: SeLoadDriverPrivilege 1860 msiexec.exe Token: SeSystemProfilePrivilege 1860 msiexec.exe Token: SeSystemtimePrivilege 1860 msiexec.exe Token: SeProfSingleProcessPrivilege 1860 msiexec.exe Token: SeIncBasePriorityPrivilege 1860 msiexec.exe Token: SeCreatePagefilePrivilege 1860 msiexec.exe Token: SeCreatePermanentPrivilege 1860 msiexec.exe Token: SeBackupPrivilege 1860 msiexec.exe Token: SeRestorePrivilege 1860 msiexec.exe Token: SeShutdownPrivilege 1860 msiexec.exe Token: SeDebugPrivilege 1860 msiexec.exe Token: SeAuditPrivilege 1860 msiexec.exe Token: SeSystemEnvironmentPrivilege 1860 msiexec.exe Token: SeChangeNotifyPrivilege 1860 msiexec.exe Token: SeRemoteShutdownPrivilege 1860 msiexec.exe Token: SeUndockPrivilege 1860 msiexec.exe Token: SeSyncAgentPrivilege 1860 msiexec.exe Token: SeEnableDelegationPrivilege 1860 msiexec.exe Token: SeManageVolumePrivilege 1860 msiexec.exe Token: SeImpersonatePrivilege 1860 msiexec.exe Token: SeCreateGlobalPrivilege 1860 msiexec.exe Token: SeCreateTokenPrivilege 1860 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1860 msiexec.exe Token: SeLockMemoryPrivilege 1860 msiexec.exe Token: SeIncreaseQuotaPrivilege 1860 msiexec.exe Token: SeMachineAccountPrivilege 1860 msiexec.exe Token: SeTcbPrivilege 1860 msiexec.exe Token: SeSecurityPrivilege 1860 msiexec.exe Token: SeTakeOwnershipPrivilege 1860 msiexec.exe Token: SeLoadDriverPrivilege 1860 msiexec.exe Token: SeSystemProfilePrivilege 1860 msiexec.exe Token: SeSystemtimePrivilege 1860 msiexec.exe Token: SeProfSingleProcessPrivilege 1860 msiexec.exe Token: SeIncBasePriorityPrivilege 1860 msiexec.exe Token: SeCreatePagefilePrivilege 1860 msiexec.exe Token: SeCreatePermanentPrivilege 1860 msiexec.exe Token: SeBackupPrivilege 1860 msiexec.exe Token: SeRestorePrivilege 1860 msiexec.exe Token: SeShutdownPrivilege 1860 msiexec.exe Token: SeDebugPrivilege 1860 msiexec.exe Token: SeAuditPrivilege 1860 msiexec.exe Token: SeSystemEnvironmentPrivilege 1860 msiexec.exe Token: SeChangeNotifyPrivilege 1860 msiexec.exe Token: SeRemoteShutdownPrivilege 1860 msiexec.exe Token: SeUndockPrivilege 1860 msiexec.exe Token: SeSyncAgentPrivilege 1860 msiexec.exe Token: SeEnableDelegationPrivilege 1860 msiexec.exe Token: SeManageVolumePrivilege 1860 msiexec.exe Token: SeImpersonatePrivilege 1860 msiexec.exe Token: SeCreateGlobalPrivilege 1860 msiexec.exe Token: SeCreateTokenPrivilege 1860 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1860 msiexec.exe Token: SeLockMemoryPrivilege 1860 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1860 msiexec.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1860 msiexec.exe 1108 msiexec.exe 6100 MsiExec.exe 4640 MsiExec.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1108 wrote to memory of 6100 1108 msiexec.exe 87 PID 6100 wrote to memory of 4012 6100 MsiExec.exe 88 PID 6100 wrote to memory of 3448 6100 MsiExec.exe 89 PID 1108 wrote to memory of 4640 1108 msiexec.exe 92 PID 4640 wrote to memory of 3252 4640 MsiExec.exe 93 PID 4640 wrote to memory of 3308 4640 MsiExec.exe 94 PID 4640 wrote to memory of 1200 4640 MsiExec.exe 96 PID 4640 wrote to memory of 1988 4640 MsiExec.exe 99 PID 1860 wrote to memory of 4088 1860 msiexec.exe 101 PID 1860 wrote to memory of 4316 1860 msiexec.exe 100 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\videomanager-P9wg.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Program Files (x86)\VideoManager\VideoManager.exe"C:\Program Files (x86)\VideoManager\VideoManager.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4316
-
-
C:\Program Files (x86)\VideoManager\VideoManager.exe"C:\Program Files (x86)\VideoManager\VideoManager.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4088
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding D9A7C0BFE29A1E1E852574EB756187E5 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6100 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIFF65.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240779343 1 VideoManager.CustomActionsWiX!VideoManager.CustomActionsWiX.CustomActions.StartInstallerCustomAction3⤵
- Badlisted process makes network request
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4012
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI15DC.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240784875 5 VideoManager.CustomActionsWiX!VideoManager.CustomActionsWiX.CustomActions.UserInteractedCustomAction3⤵
- Badlisted process makes network request
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3448
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 8BDDEF55FB9FBBEA561912EED9CA239F2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSI2491.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240788718 2 VideoManager.CustomActionsWiX!VideoManager.CustomActionsWiX.CustomActions.SetInstallDateCustomAction3⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3252
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSI2676.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240789125 6 VideoManager.CustomActionsWiX!VideoManager.CustomActionsWiX.CustomActions.InstallationStartedCustomAction3⤵
- Badlisted process makes network request
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3308
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSI4877.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240797875 10 VideoManager.CustomActionsWiX!VideoManager.CustomActionsWiX.CustomActions.InstallationSuccessfulCustomAction3⤵
- Badlisted process makes network request
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1200
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSI4F9C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240799656 14 VideoManager.CustomActionsWiX!VideoManager.CustomActionsWiX.CustomActions.StartHelperToolCustomAction3⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1988
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:3148
-
C:\Users\Admin\AppData\Local\VideoManagerHelperTool\VideoManagerHelperTool.exe"C:\Users\Admin\AppData\Local\VideoManagerHelperTool\VideoManagerHelperTool.exe"1⤵
- Executes dropped EXE
PID:5760
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5a1bb8.rbs
- Size 23KB
- SHA256 3f2c952e7ee2d32e84f6ba9970ede130b8916e0c699b2303967c86e01d277f29
- MD5 b653ecd97d551373412178d062095937
- SHA1 6ead0668522ac7fc183db12993e37e0cffb06c21
- SHA512 543e83e5c510a7502efe2b0f8f0ca62338502096eff4cfe401a880106f5582a62e9beae6d3e3723f4499c04411a45ee2d59ddb084d09b433bf15f4e304118f70
- SSDEEP 192:lLrLEK6IYqlRfz6QTj90UkmPW/2rCmOIOInIO5lfox5tjVg4F6PIojZNQpwzY:lPLdRRfVPWUkm+dIlI3Sxjo
- TLSH T1E1B25183DA52D9C6E75675B26A90794A3F05C78AEFD0C20A24C836F74AC35446BEC0F7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\VideoManager\System.Text.Json.dll
- Size 947KB
- SHA256 01ee4e997839141be6b9f28401736286700fef4d0ce3b31f3103ccf9180c3960
- MD5 7fc3a2eac878bd5b77009c25e6d7121e
- SHA1 6930e366e0207d4e9cf83d405f220fdaab432dfe
- SHA512 2e2e824a679403faba3f0adfb145770f996d100939e2fcb0acc2dd30aa5ecbcb9ba2b253b0ac61f76cfcd765de66a68b0790a6044cfa34000a30dcb4c7c0d270
- SSDEEP 12288:Ot5CIBYtZN3lYQX/Qr/5ALzdT4qMZTZmYZfCzxnA:MCGYtZNVkQoRCzxA
- TLSH T1DE252A02FFEC9F2BC59F7374E8752101A774EC5A6796D30B161094BA2C63BE49E80366
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\VideoManager\System.Threading.Tasks.Extensions.dll
- Size 27KB
- SHA256 692c324c02a922f890aaf5948c54ec9758f5ab7019b8e8ab169c106ddd3231f4
- MD5 d3a5f69c93863517c2671dffeef2d39e
- SHA1 c74b937a718f4dc9960bd8e105ff522f43edc59d
- SHA512 3ea0e0cd4e8e9e561fb9987e53babda3f375f6e42f05e853d1da3176fa61673c5911ca2eb0d2a37242cef11706bddb94f72c3107a270210fa3adaa17d11a17d1
- SSDEEP 384:87PVBSE/ug1TQb05JCw0p8CUQefpaQKwhARcUGWSHXWEWYA6VFHRN7yhoJR9znZ2:2PV0iug18Y+b5gU6RWFClyO9znQx
- TLSH T1A1C29E6183A85113DF6F4E76E2A9D91B5F70B346A902F7391EECF2D80C5338A8631235
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\VideoManager\VideoManager.exe
- Size 1.3MB
- SHA256 df79bb0a6bd66764cfb16e939d13149105646f46844331aa1d1bf444bc5d8fad
- MD5 6181abbe8c13ca0f161ad4445e498bba
- SHA1 26985d9d9560cf4bf44b0d0f71e724e8fcdab0f4
- SHA512 45a70cf2ce2d100fcd027eaaf585dd5d0e2dfc083c6441af57a87fa817b7214ebd2c6cce2ffed061316c80e6a2e39ddd7f4051f3a688623fbe34b44c6a11e160
- SSDEEP 24576:vBA8OnVJGAN62uaUJY4mdlwQLVXft/ZMSHx:PdjaEYFwKrbR
- TLSH T19155BF41B3A58936D1AE1737D07181104FF2C147A792DB0BED9628DC2EC63EADE2A15F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\VideoManager\VideoManager.exe.config
- Size 2KB
- SHA256 4166c8dfa8fe44417460fa509c890390183caf94a0605040b4e1a7d22ddd9b2a
- MD5 9cf1167c5508c96ea186c74ad65c2ec6
- SHA1 e3ff593d15e2ad6d809ae4abccae0623b90838ca
- SHA512 60472473f187b575fb5021801e0fdba2f7786fdb7e4199b21c59e799a9367c91e3d5be918ad944111b1144a43734a46f8d5e2e8dd2037c58aa461a33d8d46164
- TLSH T1A651412091C8AB958F7255F23D6B6428CB6D03B7288C05DDB1EEAE4BCF359DA5207077
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIFF65.tmp
- Size 482KB
- SHA256 f635d393b747fc3ab8391cb8e5be4789a45d5f9989413979d0ee1d6c84d11662
- MD5 4ebee5231ad2a9fe5923e4b2f607ea62
- SHA1 3a9bc06f3f044f091d9d9b0f6c84193268f3b8b0
- SHA512 2b610341bd1d566ecfa0e30243af1bb10a8fb07bfe4181a1db2e26b4ed1ba6f95cf15a6418cdde2f75bb59112ab8352e9dd436a602e0489ed181b984a632faa7
- SSDEEP 12288:GnBaimvx27V4FVjGK/5BudOzDqlFlI4FUiJJw0p:kG5c4j5BuQWrjGkw4
- TLSH T114B4010075D480B5F6FF2A385D34A69158BEBE701F71CA8E274C492D5EB85E0CB29B63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIFF65.tmp-\CustomAction.config
- Size 1KB
- SHA256 33d947c04a10e3aff3dca3b779393fa56ce5f02251c8cbae5076a125fdea081f
- MD5 01c01d040563a55e0fd31cc8daa5f155
- SHA1 3c1c229703198f9772d7721357f1b90281917842
- SHA512 9c3f0cc17868479575090e1949e31a688b8c1cdfa56ac4a08cbe661466bb40ecfc94ea512dc4b64d5ff14a563f96f1e71c03b6eeacc42992455bd4f1c91f17d5
- TLSH T11031568E0B05B77711312753AEED90C5DB7561A73C95811834DE99293F36978137338E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIFF65.tmp-\Microsoft.Deployment.WindowsInstaller.dll
- Size 179KB
- SHA256 cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca
- MD5 1a5caea6734fdd07caa514c3f3fb75da
- SHA1 f070ac0d91bd337d7952abd1ddf19a737b94510c
- SHA512 a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1
- SSDEEP 3072:BGfZS7hUuK3PcbFeRRLxyR69UgoCaf8+aCnfKlRUjW01KymkO:9zMRLkR6joxfRPW
- TLSH T159046B2953FC473ACAFF4778E261425197B1F2E67117DB0EEC8181AA2522780F792397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIFF65.tmp-\Newtonsoft.Json.dll
- Size 695KB
- SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
- MD5 195ffb7167db3219b217c4fd439eedd6
- SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
- SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
- SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
- TLSH T166E4394123F98F2BE1AF6B75B4704E1543F9F917A6B5E78F9A04D9A91C43B408E403A3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIFF65.tmp-\VideoManager.CustomActionsWiX.dll
- Size 18KB
- SHA256 d975177d51bc74afc3d9bf7a1f88464cd85900b1b2639ee521a2753789758c19
- MD5 02b53d956673705856ba24b342ce3271
- SHA1 46615f6f746d99872068f5486f80b34d2586b053
- SHA512 87cf88d7da108afe500a01b0e32ae83f2d054b953b2b09fb80b51c7bf438e1f1f28df16ece57a4667c401b52e77bc2640230801e66996602765451b3412e7097
- SSDEEP 192:DJQTfb199U5eXTN9XEAn854Fb6baN12Bn1fiTfzuefZ8Z5vWL44nC5Bk:DJQTp9WeXJ85Ob6barmuzueR8nC2C
- TLSH T1A0822B02B3E8C739DEAF4BBF55B3025411B2E5965513DB6C9E9840AE3DB33904703BA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\VideoManagerHelperTool\Resources
- Size 64B
- SHA256 ae3ce38cefa94326bed7db9c8332dea73043ddf6f6098e7ec5c1d94023f92c71
- MD5 831e613197b2d1f73de7f5b98281cab3
- SHA1 e0fbcf4f3bdc6415ef4813ff5e34d083c80e0ae2
- SHA512 13d764e506a44a185081f3a64f9022136331dd0cf857164c656e251cb9c33e843043a66787cc74f151110c5bd5f4e526b8e3d197483729e867c2053c69febfb6
- TLSH T161A00236658965DD68ACA6A3E1004CC478B8B9C108E3D2542573DF9E609E2648B868C5
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\VideoManagerHelperTool\VideoManagerHelperTool.exe
- Size 5.9MB
- SHA256 2d34337dbe93c82defa99991a93ae653f5ce1922f7d9d48a15a76fda2a83232d
- MD5 8ea708ad5de0e510dda455e52fa92097
- SHA1 6032a588c89a215f39c3b37308a6f86c8973bcb3
- SHA512 44b1d7ae8db88d8140eb05d1e978c052dc228f31cfd9d24d02ab8fde41d3dde816d6074a5e75a61d38e634322781c726be836143341d9768830be1454b23bcc1
- SSDEEP 49152:jLlvmGa5m5dDHXW8Qrd6GNmemZrrszSjUQYNoDppdB0/73042QIfA7VE5f2yzeXK:n98r48SthZBAB+aa666666666666Pfj
- TLSH T1CB567C09A3D945E7E536D230CA668732D6B1BC818B30CF4F059AE68A1F336519F6F724
- MD5 SHA1 SHA512 SSDEEP TLSH