b3688db852d9a57834ef758cd54a9507fad2de1854a2faed23bda53411000383

Analysis

max time kernel
148s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/10/2026, 22:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MAGIX VEGAS Pro v22.0 patch.exe
Size 4.8MB
Sample261029-2akvkaft2v
SHA256 b3688db852d9a57834ef758cd54a9507fad2de1854a2faed23bda53411000383
MD5 ff4bc7a206b856502dd647e94dec5c8f
SHA1 4a3d0e4fb6fb2a7ac633a288a0d2ce8f14286cda
SHA512 f93170b9fe1b06e9c48a255bede5a1150e8125d09d6c5d1fe8438525b40b648f8bcb86a79d3453d6f45f4392cc946214088ac3aa24ee298ff36579f22da1c1cc
SSDEEP 98304:8L1CNqRBQsRE+Mv2RJlmQJu6A3ty6gVLPysH:81H42RJs+ODzY
TLSH
T18D36F12A7E54633DC57A06F24563831099377E6176FE8C2A02E4FB88CB37140DEFA656
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution installer persistence

Malware Config

Signatures

Detected Nirsoft tools 1 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/files/0x000d00000001c4ca-25.dat	Nirsoft

NirSoft NirCmd 1 IoCs

NirCmd is a lightweight Windows command-line tool for automating system tasks

resource	yara_rule
behavioral2/files/0x000d00000001c4ca-25.dat	NirCmd

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	MAGIX VEGAS Pro v22.0 patch.tmp
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable = "1"	MAGIX VEGAS Pro v22.0 patch.tmp

Executes dropped EXE 11 IoCs

pid	Process
3192	MAGIX VEGAS Pro v22.0 patch.tmp
1248	nircmd.exe
5904	nircmd.exe
2460	nircmd.exe
2192	nircmd.exe
5776	nircmd.exe
4380	nircmd.exe
5308	nircmd.exe
5452	nircmd.exe
52	nircmd.exe
240	nircmd.exe

Loads dropped DLL 1 IoCs

pid	Process
3192	MAGIX VEGAS Pro v22.0 patch.tmp

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VEGAS\VEGAS Pro 22.0\vegas220.exe.local	MAGIX VEGAS Pro v22.0 patch.tmp
File created	C:\Program Files\VEGAS\VEGAS Pro 22.0\Protein\is-S0E70.tmp	MAGIX VEGAS Pro v22.0 patch.tmp
File created	C:\Program Files\VEGAS\VEGAS Pro 22.0\vegas220.exe.local\is-6VC0E.tmp	MAGIX VEGAS Pro v22.0 patch.tmp
File opened for modification	C:\Program Files\VEGAS\VEGAS Pro 22.0\Protein\Protein_x64.4.2.dll	MAGIX VEGAS Pro v22.0 patch.tmp
File opened for modification	C:\Program Files\VEGAS\VEGAS Pro 22.0\vegas220.exe.local\wintrust.dll	MAGIX VEGAS Pro v22.0 patch.tmp

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4748	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MAGIX VEGAS Pro v22.0 patch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MAGIX VEGAS Pro v22.0 patch.tmp

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/4916-0-0x0000000000400000-0x0000000000531000-memory.dmp	innosetup
behavioral2/memory/4916-45-0x0000000000400000-0x0000000000531000-memory.dmp	innosetup
behavioral2/memory/4916-49-0x0000000000400000-0x0000000000531000-memory.dmp	innosetup

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3192	MAGIX VEGAS Pro v22.0 patch.tmp
3192	MAGIX VEGAS Pro v22.0 patch.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3192	MAGIX VEGAS Pro v22.0 patch.tmp

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 3192	4916	MAGIX VEGAS Pro v22.0 patch.exe	89
PID 3192 wrote to memory of 4748	3192	MAGIX VEGAS Pro v22.0 patch.tmp	90
PID 4748 wrote to memory of 1248	4748	cmd.exe	92
PID 4748 wrote to memory of 5904	4748	cmd.exe	93
PID 4748 wrote to memory of 2460	4748	cmd.exe	94
PID 4748 wrote to memory of 2192	4748	cmd.exe	95
PID 4748 wrote to memory of 5776	4748	cmd.exe	96
PID 4748 wrote to memory of 4380	4748	cmd.exe	97
PID 4748 wrote to memory of 5308	4748	cmd.exe	98
PID 4748 wrote to memory of 5452	4748	cmd.exe	99
PID 4748 wrote to memory of 52	4748	cmd.exe	100
PID 4748 wrote to memory of 240	4748	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\MAGIX VEGAS Pro v22.0 patch.exe
"C:\Users\Admin\AppData\Local\Temp\MAGIX VEGAS Pro v22.0 patch.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Users\Admin\AppData\Local\Temp\is-TLRAN.tmp\MAGIX VEGAS Pro v22.0 patch.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-TLRAN.tmp\MAGIX VEGAS Pro v22.0 patch.tmp" /SL5="$60212,4046882,1178624,C:\Users\Admin\AppData\Local\Temp\MAGIX VEGAS Pro v22.0 patch.exe"
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3192
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-0NNJO.tmp\nircmd.cmd""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4748
  - - C:\Users\Admin\AppData\Local\Temp\is-0NNJO.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\VEGAS_Pro_22\installation.ini" "Serial" "string" "P3-64979-27462-07906-32757-21318-38872"
      4⤵
      Executes dropped EXE
      PID:1248
  - - C:\Users\Admin\AppData\Local\Temp\is-0NNJO.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\VEGAS_Pro_22\installation.ini" "VersionUnlock" "NumberOfStarts" "0"
      4⤵
      Executes dropped EXE
      PID:5904
  - - C:\Users\Admin\AppData\Local\Temp\is-0NNJO.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\VEGAS_Pro_22\installation.ini" "VersionUnlock" "DontShowNagBox" "1"
      4⤵
      Executes dropped EXE
      PID:2460
  - - C:\Users\Admin\AppData\Local\Temp\is-0NNJO.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\VEGAS_Pro_22\installation.ini" "VersionUnlock" "IsRegisteredUser" "1"
      4⤵
      Executes dropped EXE
      PID:2192
  - - C:\Users\Admin\AppData\Local\Temp\is-0NNJO.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\VEGAS_Pro_22\installation.ini" "VersionUnlock" "UserEMail" "uBusHTShXjdIakxgck01PRO5nuh8YfF4BDS17GWS/So3BnxxO66uwQ3meU0PEMwM"
      4⤵
      Executes dropped EXE
      PID:5776
  - - C:\Users\Admin\AppData\Local\Temp\is-0NNJO.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\DVD_Architect_Pro_7\installation.ini" "Serial" "string" "P3-77020-98979-63411-51090-66867-08191"
      4⤵
      Executes dropped EXE
      PID:4380
  - - C:\Users\Admin\AppData\Local\Temp\is-0NNJO.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\DVD_Architect_Pro_7\installation.ini" "VersionUnlock" "NumberOfStarts" "0"
      4⤵
      Executes dropped EXE
      PID:5308
  - - C:\Users\Admin\AppData\Local\Temp\is-0NNJO.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\DVD_Architect_Pro_7\installation.ini" "VersionUnlock" "DontShowNagBox" "1"
      4⤵
      Executes dropped EXE
      PID:5452
  - - C:\Users\Admin\AppData\Local\Temp\is-0NNJO.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\DVD_Architect_Pro_7\installation.ini" "VersionUnlock" "IsRegisteredUser" "1"
      4⤵
      Executes dropped EXE
      PID:52
  - - C:\Users\Admin\AppData\Local\Temp\is-0NNJO.tmp\nircmd.exe
      nircmd inisetval "c:\ProgramData\VEGAS\DVD_Architect_Pro_7\installation.ini" "VersionUnlock" "UserEMail" "uBusHTShXjdIakxgck01PRO5nuh8YfF4BDS17GWS/So3BnxxO66uwQ3meU0PEMwM"
      4⤵
      Executes dropped EXE
      PID:240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wintrust.dll

Path C:\Program Files\VEGAS\VEGAS Pro 22.0\vegas220.exe.local\wintrust.dll
Size 373KB
SHA256 8c6c791e8db8728f9a610def238c61be054bfa3de487bf6ab037130a61a3ef19
MD5 b7a38368a52ff07d875e6465bd7ee26a
SHA1 99d5ea14e5ef16fc997e09f681eaad39bc5c6f61
SHA512 5a3b474f6b8731067f3a149fde53f9216cb8fb81ef5bb0aa4a622c7ceb7c4b8b65fdb91167d2a179b8c4e52a3761a42f5d06ddca2d935704d33db6f0ad7b3275
SSDEEP 6144:pmCBP6xz5/RZdpcIJJlmWnoBdM6DxlWGqrJvuxS2WeTwNLZLV/M9iQZoBNmlK/oW:UkPY/Vpc0JHWDxlRqb5qK/R
TLSH
T1C3844A2EA6F910A4D8B6913885538206D6737874237196CF429CC6BD9F2BFE47A3DF01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_iscrypt.dll

Path C:\Users\Admin\AppData\Local\Temp\is-0NNJO.tmp\_isetup\_iscrypt.dll
Size 2KB
SHA256 2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
MD5 a69559718ab506675e907fe49deb71e9
SHA1 bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA512 e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
TLSH
T11051CE835239A462C41A37B426E7E509B35B467643CE4FE33590230EF8876F80C35D90
MD5 SHA1 SHA512 TLSH

Submit Download

nircmd.cmd

Path C:\Users\Admin\AppData\Local\Temp\is-0NNJO.tmp\nircmd.cmd
Size 1KB
SHA256 915357dfb71b907b64b18a198160e8962ffaaed4d5278d5ac4ee0208b6f089c0
MD5 14d3f2a3efbfe535fa0958da17d565fa
SHA1 958c79de8f3dc821d4c9c89e1f3b92bc7c48637a
SHA512 79ae0e1c73558546d7f61ae5ff0576ddb303e15f3a2be549a0bf32b54f0336bb20357203796341646a53b6c8a6449ccbd9c63174db16b5310ebdbe976aadae75
TLSH
T1052149509173A2AA364B473AAA0995C0F19EC74D57513C1F58926890EB8FF0CFB370AE
MD5 SHA1 SHA512 TLSH

Submit Download

nircmd.exe

Path C:\Users\Admin\AppData\Local\Temp\is-0NNJO.tmp\nircmd.exe
Size 114KB
SHA256 5bfa034f7555a38e64c078af71b4ff8c49511579fa826a87661940b7e9a6e333
MD5 b417238213efb0d2a23562674406cdf9
SHA1 04bf7acc7d0aa74fa750f7c32fdebbbe1daf46f8
SHA512 881b420af6e7104ac1f2edf03fc905f30af8ee264d8279f7eeb18e6178e210e063ac3c3d9a47f0c7c36ad04b51773e28595f965b037b0a0305d6c9fdf18e96a3
SSDEEP 3072:0l9AT3LpPBrPsvtoAeDmdGX5a7Y8G4ZXGUt+HdkzQFoHCfsDyR1q6:hT3ZVk6AwPRU6
TLSH
T152B35A16B32500EEC066D975CB129707D7F1B8550976A71FABE08DA2AF533E2FC25B02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MAGIX VEGAS Pro v22.0 patch.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-TLRAN.tmp\MAGIX VEGAS Pro v22.0 patch.tmp
Size 3.5MB
SHA256 7a8924b753dbbd168b822d7c483f0150697c6bb31d19cfd1fd872f1090254fcf
MD5 cd0e5319f235a458802e284c1d7fb7c7
SHA1 716d6347b01df04b96c32db414361ae828dec3d9
SHA512 5d3873d79783e7f123f618e41087c59b59ac4e5e932057bc649415d34b4465b29ba84d6390ca2cbea9de2a33f5b7f60300fd722e5ca78d0a9b8d83a804a68406
SSDEEP 49152:xFqOSBnrDcB6qen6rR2SB85UAQl0i3wqEhIjxvB2En4A2yJXyskyM1XQTrR333A:xQTWt3wq2Ijxp2E4A2yJXIyf333A
TLSH
T1CBF51917EE48613AC05A27FB4523C35099377F6165EE5C1666F8FB0C8E3B040EAEA647
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3192-6-0x00000000026B0000-0x00000000026B1000-memory.dmp

Download

memory/3192-46-0x0000000000400000-0x000000000078B000-memory.dmp

Download

memory/3192-47-0x00000000026B0000-0x00000000026B1000-memory.dmp

Download

memory/3192-48-0x0000000000400000-0x000000000078B000-memory.dmp

Download

memory/4916-0-0x0000000000400000-0x0000000000531000-memory.dmp

Download

memory/4916-45-0x0000000000400000-0x0000000000531000-memory.dmp

Download

memory/4916-49-0x0000000000400000-0x0000000000531000-memory.dmp

Download