f9c509c0e06a6c3677f248f69abed6831d600434e509cb27ed38f9682875bf9a

Analysis

max time kernel
141s
max time network
147s
platform
windows10_x64
resource
win10v20201028
submitted
17-11-2020 12:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

94b93992e4968d36b4366673815847ed.exe
Size

12.5MB
MD5

095d2b42824e3e91facbfd195c6dcbfa
SHA1

5ce029af0dd1037c834800f46cfc7d33ee96cf8f
SHA256

f9c509c0e06a6c3677f248f69abed6831d600434e509cb27ed38f9682875bf9a
SHA512

d51e5e8f68e294bbfce95ecafef8039aa9cd133fcbe15837928379ff3f7f6d1a5d0cc696b826c7f5035d063dd55835634dea5170b089f6fec706f5673dceed11

Score

9^/10

discovery

Malware Config

Signatures

ServiceHost packer 95 IoCs

Detects ServiceHost packer used for .NET malware

Processes:

resource	yara_rule
behavioral2/memory/3292-18-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3292-19-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3292-21-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3292-20-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3292-24-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3292-25-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3292-23-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3292-27-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3292-28-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3292-29-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3292-30-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3292-32-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3292-34-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3292-33-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3292-36-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3292-37-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3292-38-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3292-39-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3292-41-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3292-42-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3292-43-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3292-46-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3292-45-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3292-47-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3292-48-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3292-50-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3292-51-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3292-52-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3292-55-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3292-56-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3292-57-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3292-58-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3292-60-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3292-61-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3292-62-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3292-64-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3292-65-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3292-66-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3292-67-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3292-69-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3292-70-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3292-71-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3292-75-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3292-74-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3292-76-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3292-73-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3292-149-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3292-148-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3292-150-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3292-151-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3292-154-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3292-155-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3292-153-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3292-156-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3292-157-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3292-159-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3292-160-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3292-161-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3292-162-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3292-164-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3292-165-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3292-167-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3292-166-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/3292-168-0x0000000000000000-mapping.dmp	servicehost

Executes dropped EXE 3 IoCs

Processes:

94b93992e4968d36b4366673815847ed.tmpwmfdist.exeVideoConverter.exe

pid process

5032 94b93992e4968d36b4366673815847ed.tmp
784 wmfdist.exe
3292 VideoConverter.exe
Loads dropped DLL 3 IoCs

Processes:

94b93992e4968d36b4366673815847ed.tmpregsvr32.exeVideoConverter.exe

pid process

5032 94b93992e4968d36b4366673815847ed.tmp
3780 regsvr32.exe
3292 VideoConverter.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

Processes:

94b93992e4968d36b4366673815847ed.tmp

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\xvidvfw.dll	94b93992e4968d36b4366673815847ed.tmp
File opened for modification	C:\Windows\SysWOW64\xvidcore.dll	94b93992e4968d36b4366673815847ed.tmp
File created	C:\Windows\SysWOW64\is-RG4O8.tmp	94b93992e4968d36b4366673815847ed.tmp
File created	C:\Windows\SysWOW64\is-GDH2N.tmp	94b93992e4968d36b4366673815847ed.tmp
File created	C:\Windows\SysWOW64\is-GD85B.tmp	94b93992e4968d36b4366673815847ed.tmp

Drops file in Program Files directory 49 IoCs

Processes:

94b93992e4968d36b4366673815847ed.tmp

description	ioc	process
File created	C:\Program Files (x86)\Isoft Free Video Converter\is-H1N40.tmp	94b93992e4968d36b4366673815847ed.tmp
File created	C:\Program Files (x86)\Isoft Free Video Converter\is-9732H.tmp	94b93992e4968d36b4366673815847ed.tmp
File created	C:\Program Files (x86)\Isoft Free Video Converter\is-9S382.tmp	94b93992e4968d36b4366673815847ed.tmp
File created	C:\Program Files (x86)\Isoft Free Video Converter\is-8BBUD.tmp	94b93992e4968d36b4366673815847ed.tmp
File opened for modification	C:\Program Files (x86)\Isoft Free Video Converter\xvidcore.dll	94b93992e4968d36b4366673815847ed.tmp
File opened for modification	C:\Program Files (x86)\Isoft Free Video Converter\ImageEx.dll	94b93992e4968d36b4366673815847ed.tmp
File created	C:\Program Files (x86)\Isoft Free Video Converter\is-PEOSS.tmp	94b93992e4968d36b4366673815847ed.tmp
File created	C:\Program Files (x86)\Isoft Free Video Converter\is-8F1ML.tmp	94b93992e4968d36b4366673815847ed.tmp
File created	C:\Program Files (x86)\Isoft Free Video Converter\is-AN15S.tmp	94b93992e4968d36b4366673815847ed.tmp
File opened for modification	C:\Program Files (x86)\Isoft Free Video Converter\avfilter-0.dll	94b93992e4968d36b4366673815847ed.tmp
File created	C:\Program Files (x86)\Isoft Free Video Converter\is-9RUDU.tmp	94b93992e4968d36b4366673815847ed.tmp
File created	C:\Program Files (x86)\Isoft Free Video Converter\is-LMP7M.tmp	94b93992e4968d36b4366673815847ed.tmp
File created	C:\Program Files (x86)\Isoft Free Video Converter\is-3NMSP.tmp	94b93992e4968d36b4366673815847ed.tmp
File opened for modification	C:\Program Files (x86)\Isoft Free Video Converter\CrashReport.dll	94b93992e4968d36b4366673815847ed.tmp
File opened for modification	C:\Program Files (x86)\Isoft Free Video Converter\libffplay.dll	94b93992e4968d36b4366673815847ed.tmp
File opened for modification	C:\Program Files (x86)\Isoft Free Video Converter\swscale-0.dll	94b93992e4968d36b4366673815847ed.tmp
File opened for modification	C:\Program Files (x86)\Isoft Free Video Converter\update.EXE	94b93992e4968d36b4366673815847ed.tmp
File created	C:\Program Files (x86)\Isoft Free Video Converter\is-9AMRQ.tmp	94b93992e4968d36b4366673815847ed.tmp
File opened for modification	C:\Program Files (x86)\Isoft Free Video Converter\MediaAssist.dll	94b93992e4968d36b4366673815847ed.tmp
File opened for modification	C:\Program Files (x86)\Isoft Free Video Converter\avformat-52.dll	94b93992e4968d36b4366673815847ed.tmp
File opened for modification	C:\Program Files (x86)\Isoft Free Video Converter\SDL.dll	94b93992e4968d36b4366673815847ed.tmp
File opened for modification	C:\Program Files (x86)\Isoft Free Video Converter\SkinMagicU.dll	94b93992e4968d36b4366673815847ed.tmp
File opened for modification	C:\Program Files (x86)\Isoft Free Video Converter\SkinScroll.dll	94b93992e4968d36b4366673815847ed.tmp
File opened for modification	C:\Program Files (x86)\Isoft Free Video Converter\sqlite3.dll	94b93992e4968d36b4366673815847ed.tmp
File created	C:\Program Files (x86)\Isoft Free Video Converter\is-TBP36.tmp	94b93992e4968d36b4366673815847ed.tmp
File created	C:\Program Files (x86)\Isoft Free Video Converter\is-QDFBK.tmp	94b93992e4968d36b4366673815847ed.tmp
File opened for modification	C:\Program Files (x86)\Isoft Free Video Converter\libffmpeg.dll	94b93992e4968d36b4366673815847ed.tmp
File opened for modification	C:\Program Files (x86)\Isoft Free Video Converter\avdevice-52.dll	94b93992e4968d36b4366673815847ed.tmp
File created	C:\Program Files (x86)\Isoft Free Video Converter\is-QIBBM.tmp	94b93992e4968d36b4366673815847ed.tmp
File created	C:\Program Files (x86)\Isoft Free Video Converter\is-6RAME.tmp	94b93992e4968d36b4366673815847ed.tmp
File created	C:\Program Files (x86)\Isoft Free Video Converter\is-QB037.tmp	94b93992e4968d36b4366673815847ed.tmp
File created	C:\Program Files (x86)\Isoft Free Video Converter\is-KOCCP.tmp	94b93992e4968d36b4366673815847ed.tmp
File created	C:\Program Files (x86)\Isoft Free Video Converter\is-H22PN.tmp	94b93992e4968d36b4366673815847ed.tmp
File created	C:\Program Files (x86)\Isoft Free Video Converter\is-JBJJI.tmp	94b93992e4968d36b4366673815847ed.tmp
File opened for modification	C:\Program Files (x86)\Isoft Free Video Converter\Common.dll	94b93992e4968d36b4366673815847ed.tmp
File created	C:\Program Files (x86)\Isoft Free Video Converter\is-L90L7.tmp	94b93992e4968d36b4366673815847ed.tmp
File created	C:\Program Files (x86)\Isoft Free Video Converter\is-R2J4B.tmp	94b93992e4968d36b4366673815847ed.tmp
File created	C:\Program Files (x86)\Isoft Free Video Converter\is-L3NB9.tmp	94b93992e4968d36b4366673815847ed.tmp
File created	C:\Program Files (x86)\Isoft Free Video Converter\is-59FRQ.tmp	94b93992e4968d36b4366673815847ed.tmp
File created	C:\Program Files (x86)\Isoft Free Video Converter\is-Q8K3R.tmp	94b93992e4968d36b4366673815847ed.tmp
File opened for modification	C:\Program Files (x86)\Isoft Free Video Converter\avutil-49.dll	94b93992e4968d36b4366673815847ed.tmp
File opened for modification	C:\Program Files (x86)\Isoft Free Video Converter\Log.dll	94b93992e4968d36b4366673815847ed.tmp
File opened for modification	C:\Program Files (x86)\Isoft Free Video Converter\wmfdist.exe	94b93992e4968d36b4366673815847ed.tmp
File created	C:\Program Files (x86)\Isoft Free Video Converter\unins000.dat	94b93992e4968d36b4366673815847ed.tmp
File created	C:\Program Files (x86)\Isoft Free Video Converter\is-DOGOJ.tmp	94b93992e4968d36b4366673815847ed.tmp
File created	C:\Program Files (x86)\Isoft Free Video Converter\is-4J7Q2.tmp	94b93992e4968d36b4366673815847ed.tmp
File created	C:\Program Files (x86)\Isoft Free Video Converter\is-MLRT2.tmp	94b93992e4968d36b4366673815847ed.tmp
File opened for modification	C:\Program Files (x86)\Isoft Free Video Converter\unins000.dat	94b93992e4968d36b4366673815847ed.tmp
File opened for modification	C:\Program Files (x86)\Isoft Free Video Converter\VideoConverter.exe	94b93992e4968d36b4366673815847ed.tmp

Program crash 12 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4264	3292	WerFault.exe	VideoConverter.exe
564	3292	WerFault.exe	VideoConverter.exe
1180	3292	WerFault.exe	VideoConverter.exe
1592	3292	WerFault.exe	VideoConverter.exe
3164	3292	WerFault.exe	VideoConverter.exe
4376	3292	WerFault.exe	VideoConverter.exe
4456	3292	WerFault.exe	VideoConverter.exe
2976	3292	WerFault.exe	VideoConverter.exe
4632	3292	WerFault.exe	VideoConverter.exe
4020	3292	WerFault.exe	VideoConverter.exe
3340	3292	WerFault.exe	VideoConverter.exe
552	3292	WerFault.exe	VideoConverter.exe

Modifies registry class 14 IoCs

Processes:

regsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000001-4FEF-40D3-B3FA-E0531B897F98}\InprocServer32\ = "C:\\Windows\\SysWow64\\xvid.ax"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{64697678-0000-0010-8000-00AA00389B71}\FilterData = 020000000000800002000000000000003070693300000000000000000800000000000000000000003074793300000000d0000000e00000003174793300000000d0000000f00000003274793300000000d0000000000100003374793300000000d0000000100100003474793300000000d0000000200100003574793300000000d0000000300100003674793300000000d0000000400100003774793300000000d0000000500100003170693308000000000000000100000000000000000000003074793300000000d0000000600100007669647300001000800000aa00389b717876696400001000800000aa00389b715856494400001000800000aa00389b716469767800001000800000aa00389b714449565800001000800000aa00389b716478353000001000800000aa00389b714458353000001000800000aa00389b716d70347600001000800000aa00389b714d50345600001000800000aa00389b7100000000000000000000000000000000	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{64697678-0000-0010-8000-00AA00389B71}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{64697678-0000-0010-8000-00AA00389B71}\InprocServer32\ = "C:\\Windows\\SysWow64\\xvid.ax"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000001-4FEF-40D3-B3FA-E0531B897F98}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000001-4FEF-40D3-B3FA-E0531B897F98}\ = "Xvid MPEG-4 Video DecoderAbout"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{64697678-0000-0010-8000-00AA00389B71}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{64697678-0000-0010-8000-00AA00389B71}\FriendlyName = "Xvid MPEG-4 Video Decoder"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{64697678-0000-0010-8000-00AA00389B71}\ = "Xvid MPEG-4 Video Decoder"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{64697678-0000-0010-8000-00AA00389B71}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{64697678-0000-0010-8000-00AA00389B71}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000001-4FEF-40D3-B3FA-E0531B897F98}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000001-4FEF-40D3-B3FA-E0531B897F98}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{64697678-0000-0010-8000-00AA00389B71}\CLSID = "{64697678-0000-0010-8000-00AA00389B71}"	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 184 IoCs

Processes:

94b93992e4968d36b4366673815847ed.tmpVideoConverter.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	process
5032	94b93992e4968d36b4366673815847ed.tmp
5032	94b93992e4968d36b4366673815847ed.tmp
3292	VideoConverter.exe
3292	VideoConverter.exe
4264	WerFault.exe
4264	WerFault.exe
4264	WerFault.exe
4264	WerFault.exe
4264	WerFault.exe
4264	WerFault.exe
4264	WerFault.exe
4264	WerFault.exe
4264	WerFault.exe
4264	WerFault.exe
4264	WerFault.exe
4264	WerFault.exe
4264	WerFault.exe
4264	WerFault.exe
4264	WerFault.exe
564	WerFault.exe
564	WerFault.exe
564	WerFault.exe
564	WerFault.exe
564	WerFault.exe
564	WerFault.exe
564	WerFault.exe
564	WerFault.exe
564	WerFault.exe
564	WerFault.exe
564	WerFault.exe
564	WerFault.exe
564	WerFault.exe
564	WerFault.exe
564	WerFault.exe
1180	WerFault.exe
1180	WerFault.exe
1180	WerFault.exe
1180	WerFault.exe
1180	WerFault.exe
1180	WerFault.exe
1180	WerFault.exe
1180	WerFault.exe
1180	WerFault.exe
1180	WerFault.exe
1180	WerFault.exe
1180	WerFault.exe
1180	WerFault.exe
1180	WerFault.exe
1180	WerFault.exe
1592	WerFault.exe
1592	WerFault.exe
1592	WerFault.exe
1592	WerFault.exe
1592	WerFault.exe
1592	WerFault.exe
1592	WerFault.exe
1592	WerFault.exe
1592	WerFault.exe
1592	WerFault.exe
1592	WerFault.exe
1592	WerFault.exe
1592	WerFault.exe
1592	WerFault.exe
1592	WerFault.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

description	pid	process
Token: SeRestorePrivilege	4264	WerFault.exe
Token: SeBackupPrivilege	4264	WerFault.exe
Token: SeDebugPrivilege	4264	WerFault.exe
Token: SeDebugPrivilege	564	WerFault.exe
Token: SeDebugPrivilege	1180	WerFault.exe
Token: SeDebugPrivilege	1592	WerFault.exe
Token: SeDebugPrivilege	3164	WerFault.exe
Token: SeDebugPrivilege	4376	WerFault.exe
Token: SeDebugPrivilege	4456	WerFault.exe
Token: SeDebugPrivilege	2976	WerFault.exe
Token: SeDebugPrivilege	4632	WerFault.exe
Token: SeDebugPrivilege	4020	WerFault.exe
Token: SeDebugPrivilege	3340	WerFault.exe
Token: SeDebugPrivilege	552	WerFault.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

94b93992e4968d36b4366673815847ed.tmp

pid process

5032 94b93992e4968d36b4366673815847ed.tmp

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

94b93992e4968d36b4366673815847ed.exe94b93992e4968d36b4366673815847ed.tmp

description	pid	process	target process
PID 4700 wrote to memory of 5032	4700	94b93992e4968d36b4366673815847ed.exe	94b93992e4968d36b4366673815847ed.tmp
PID 4700 wrote to memory of 5032	4700	94b93992e4968d36b4366673815847ed.exe	94b93992e4968d36b4366673815847ed.tmp
PID 4700 wrote to memory of 5032	4700	94b93992e4968d36b4366673815847ed.exe	94b93992e4968d36b4366673815847ed.tmp
PID 5032 wrote to memory of 3780	5032	94b93992e4968d36b4366673815847ed.tmp	regsvr32.exe
PID 5032 wrote to memory of 3780	5032	94b93992e4968d36b4366673815847ed.tmp	regsvr32.exe
PID 5032 wrote to memory of 3780	5032	94b93992e4968d36b4366673815847ed.tmp	regsvr32.exe
PID 5032 wrote to memory of 784	5032	94b93992e4968d36b4366673815847ed.tmp	wmfdist.exe
PID 5032 wrote to memory of 784	5032	94b93992e4968d36b4366673815847ed.tmp	wmfdist.exe
PID 5032 wrote to memory of 784	5032	94b93992e4968d36b4366673815847ed.tmp	wmfdist.exe
PID 5032 wrote to memory of 3292	5032	94b93992e4968d36b4366673815847ed.tmp	VideoConverter.exe
PID 5032 wrote to memory of 3292	5032	94b93992e4968d36b4366673815847ed.tmp	VideoConverter.exe
PID 5032 wrote to memory of 3292	5032	94b93992e4968d36b4366673815847ed.tmp	VideoConverter.exe

C:\Users\Admin\AppData\Local\Temp\94b93992e4968d36b4366673815847ed.exe
"C:\Users\Admin\AppData\Local\Temp\94b93992e4968d36b4366673815847ed.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4700

C:\Users\Admin\AppData\Local\Temp\is-L5E38.tmp\94b93992e4968d36b4366673815847ed.tmp
"C:\Users\Admin\AppData\Local\Temp\is-L5E38.tmp\94b93992e4968d36b4366673815847ed.tmp" /SL5="$20112,12351485,776192,C:\Users\Admin\AppData\Local\Temp\94b93992e4968d36b4366673815847ed.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5032

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\xvid.ax"
3⤵
- Loads dropped DLL
- Modifies registry class
PID:3780

C:\Program Files (x86)\Isoft Free Video Converter\wmfdist.exe
"C:\Program Files (x86)\Isoft Free Video Converter\wmfdist.exe" /Q:A /R:N
3⤵
- Executes dropped EXE
PID:784

C:\Program Files (x86)\Isoft Free Video Converter\VideoConverter.exe
"C:\Program Files (x86)\Isoft Free Video Converter\VideoConverter.exe" 94b93992e4968d36b4366673815847ed.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 812
4⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 796
4⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 740
4⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 804
4⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 820
4⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 848
4⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:4376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 780
4⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:4456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 840
4⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 796
4⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:4632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 852
4⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:4020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 792
4⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 796
4⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:552

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Isoft Free Video Converter\VideoConverter.exe
MD5
b7aa2acdbcd2f246494a5ac037bc47cc

SHA1
7bf49bd4fd3db213cf2918c5d275cba43cb49f1a

SHA256
09f13e9cd3e0f4fc19701b0349a27633212b124cd1c1e3b8868ebcc6d86e27b3

SHA512
f5085f61dd260297a84faa62c14e9dad99dfcdfbdf5db5d2305629dcc1dce373310aea8ff81f1bd63d0b3920834a5dd383ed79df48301912cb5e6bbb802d246d

Download Submit
C:\Program Files (x86)\Isoft Free Video Converter\VideoConverter.exe
MD5
b7aa2acdbcd2f246494a5ac037bc47cc

SHA1
7bf49bd4fd3db213cf2918c5d275cba43cb49f1a

SHA256
09f13e9cd3e0f4fc19701b0349a27633212b124cd1c1e3b8868ebcc6d86e27b3

SHA512
f5085f61dd260297a84faa62c14e9dad99dfcdfbdf5db5d2305629dcc1dce373310aea8ff81f1bd63d0b3920834a5dd383ed79df48301912cb5e6bbb802d246d

Download Submit
C:\Program Files (x86)\Isoft Free Video Converter\sqlite3.dll
MD5
e477a96c8f2b18d6b5c27bde49c990bf

SHA1
e980c9bf41330d1e5bd04556db4646a0210f7409

SHA256
16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660

SHA512
335a86268e7c0e568b1c30981ec644e6cd332e66f96d2551b58a82515316693c1859d87b4f4b7310cf1ac386cee671580fdd999c3bcb23acf2c2282c01c8798c

Download Submit
C:\Program Files (x86)\Isoft Free Video Converter\wmfdist.exe
MD5
f59090e9a8070d7fbbdcc8895d2169a3

SHA1
370e62290cac6a6c7aa13442741caf6671437a54

SHA256
a6b53074cb4a3f9885f6e7d52c9e893b44cf4965000d899b2bf21508ac320023

SHA512
45b9d9bd43b67c39b35a0f4007a2800847e65da8f818bef4b2f5858d95235fca34708ab9b774324bc7e1eb9519ce5d2f4634034f7987c17e788d017f2fdf7d5a

Download Submit
C:\Program Files (x86)\Isoft Free Video Converter\wmfdist.exe
MD5
f59090e9a8070d7fbbdcc8895d2169a3

SHA1
370e62290cac6a6c7aa13442741caf6671437a54

SHA256
a6b53074cb4a3f9885f6e7d52c9e893b44cf4965000d899b2bf21508ac320023

SHA512
45b9d9bd43b67c39b35a0f4007a2800847e65da8f818bef4b2f5858d95235fca34708ab9b774324bc7e1eb9519ce5d2f4634034f7987c17e788d017f2fdf7d5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-L5E38.tmp\94b93992e4968d36b4366673815847ed.tmp
MD5
4376b4cecb5244d11c5a7d8c465ca6ae

SHA1
8e56aba0def557e49a018766baa329f7cf71f225

SHA256
021bf86aac9942dffa5040f33324d240f655e11321d92e73ebc4177858ff9689

SHA512
d4f1338c2f7cff4731f7dd1ae7f4a717763cc82cd727f4caad82e37733842bd4afd446d94a465a3b41ebfeb1d96abd3a308fa7891a1a20eff89752f56851a2e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-L5E38.tmp\94b93992e4968d36b4366673815847ed.tmp
MD5
4376b4cecb5244d11c5a7d8c465ca6ae

SHA1
8e56aba0def557e49a018766baa329f7cf71f225

SHA256
021bf86aac9942dffa5040f33324d240f655e11321d92e73ebc4177858ff9689

SHA512
d4f1338c2f7cff4731f7dd1ae7f4a717763cc82cd727f4caad82e37733842bd4afd446d94a465a3b41ebfeb1d96abd3a308fa7891a1a20eff89752f56851a2e6

Download Submit
C:\Windows\SysWOW64\xvid.ax
MD5
1dfc887cb243a525675ce04787dedf8b

SHA1
69163fbf6a40a34ae9f27e652b01b4cc8fb2cc5f

SHA256
0969d1f5501ad4be6f969ce45f44a739b2d61a50237f75ae7b77626d6a0aff11

SHA512
160a6df0774c359a3959088fe478d237b4fa597eaa0cf1b084b77ba8fcdb08137387fa3ce91bd40e3af6d2992be048e583368644fe6fa627918e8900833adde4

Download Submit
\Program Files (x86)\Isoft Free Video Converter\sqlite3.dll
MD5
e477a96c8f2b18d6b5c27bde49c990bf

SHA1
e980c9bf41330d1e5bd04556db4646a0210f7409

SHA256
16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660

SHA512
335a86268e7c0e568b1c30981ec644e6cd332e66f96d2551b58a82515316693c1859d87b4f4b7310cf1ac386cee671580fdd999c3bcb23acf2c2282c01c8798c

Download Submit
\Users\Admin\AppData\Local\Temp\is-IM9CK.tmp\_isetup\_iscrypt.dll
MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
\Windows\SysWOW64\xvid.ax
MD5
1dfc887cb243a525675ce04787dedf8b

SHA1
69163fbf6a40a34ae9f27e652b01b4cc8fb2cc5f

SHA256
0969d1f5501ad4be6f969ce45f44a739b2d61a50237f75ae7b77626d6a0aff11

SHA512
160a6df0774c359a3959088fe478d237b4fa597eaa0cf1b084b77ba8fcdb08137387fa3ce91bd40e3af6d2992be048e583368644fe6fa627918e8900833adde4

Download Submit
memory/552-205-0x0000000004B80000-0x0000000004B81000-memory.dmp

Filesize
4KB

Download
memory/564-26-0x0000000004490000-0x0000000004491000-memory.dmp

Filesize
4KB

Download
memory/564-31-0x0000000004C30000-0x0000000004C31000-memory.dmp

Filesize
4KB

Download
memory/784-7-0x0000000000000000-mapping.dmp

Download
memory/1180-35-0x0000000004B50000-0x0000000004B51000-memory.dmp

Filesize
4KB

Download
memory/1180-40-0x0000000005500000-0x0000000005501000-memory.dmp

Filesize
4KB

Download
memory/1592-49-0x0000000004E30000-0x0000000004E31000-memory.dmp

Filesize
4KB

Download
memory/1592-44-0x0000000004490000-0x0000000004491000-memory.dmp

Filesize
4KB

Download
memory/2976-158-0x0000000005530000-0x0000000005531000-memory.dmp

Filesize
4KB

Download
memory/2976-152-0x0000000004990000-0x0000000004991000-memory.dmp

Filesize
4KB

Download
memory/3164-53-0x0000000004830000-0x0000000004831000-memory.dmp

Filesize
4KB

Download
memory/3164-54-0x0000000004830000-0x0000000004831000-memory.dmp

Filesize
4KB

Download
memory/3164-59-0x00000000054D0000-0x00000000054D1000-memory.dmp

Filesize
4KB

Download
memory/3292-69-0x0000000000000000-mapping.dmp

Download
memory/3292-154-0x0000000000000000-mapping.dmp

Download
memory/3292-27-0x0000000000000000-mapping.dmp

Download
memory/3292-28-0x0000000000000000-mapping.dmp

Download
memory/3292-29-0x0000000000000000-mapping.dmp

Download
memory/3292-30-0x0000000000000000-mapping.dmp

Download
memory/3292-25-0x0000000000000000-mapping.dmp

Download
memory/3292-32-0x0000000000000000-mapping.dmp

Download
memory/3292-34-0x0000000000000000-mapping.dmp

Download
memory/3292-33-0x0000000000000000-mapping.dmp

Download
memory/3292-24-0x0000000000000000-mapping.dmp

Download
memory/3292-36-0x0000000000000000-mapping.dmp

Download
memory/3292-37-0x0000000000000000-mapping.dmp

Download
memory/3292-38-0x0000000000000000-mapping.dmp

Download
memory/3292-39-0x0000000000000000-mapping.dmp

Download
memory/3292-206-0x0000000000000000-mapping.dmp

Download
memory/3292-41-0x0000000000000000-mapping.dmp

Download
memory/3292-42-0x0000000000000000-mapping.dmp

Download
memory/3292-43-0x0000000000000000-mapping.dmp

Download
memory/3292-20-0x0000000000000000-mapping.dmp

Download
memory/3292-46-0x0000000000000000-mapping.dmp

Download
memory/3292-45-0x0000000000000000-mapping.dmp

Download
memory/3292-47-0x0000000000000000-mapping.dmp

Download
memory/3292-48-0x0000000000000000-mapping.dmp

Download
memory/3292-21-0x0000000000000000-mapping.dmp

Download
memory/3292-50-0x0000000000000000-mapping.dmp

Download
memory/3292-51-0x0000000000000000-mapping.dmp

Download
memory/3292-52-0x0000000000000000-mapping.dmp

Download
memory/3292-19-0x0000000000000000-mapping.dmp

Download
memory/3292-18-0x0000000000000000-mapping.dmp

Download
memory/3292-55-0x0000000000000000-mapping.dmp

Download
memory/3292-56-0x0000000000000000-mapping.dmp

Download
memory/3292-57-0x0000000000000000-mapping.dmp

Download
memory/3292-58-0x0000000000000000-mapping.dmp

Download
memory/3292-10-0x0000000000000000-mapping.dmp

Download
memory/3292-60-0x0000000000000000-mapping.dmp

Download
memory/3292-61-0x0000000000000000-mapping.dmp

Download
memory/3292-62-0x0000000000000000-mapping.dmp

Download
memory/3292-64-0x0000000000000000-mapping.dmp

Download
memory/3292-65-0x0000000000000000-mapping.dmp

Download
memory/3292-66-0x0000000000000000-mapping.dmp

Download
memory/3292-67-0x0000000000000000-mapping.dmp

Download
memory/3292-202-0x0000000000000000-mapping.dmp

Download
memory/3292-70-0x0000000000000000-mapping.dmp

Download
memory/3292-71-0x0000000000000000-mapping.dmp

Download
memory/3292-75-0x0000000000000000-mapping.dmp

Download
memory/3292-74-0x0000000000000000-mapping.dmp

Download
memory/3292-76-0x0000000000000000-mapping.dmp

Download
memory/3292-204-0x0000000000000000-mapping.dmp

Download
memory/3292-73-0x0000000000000000-mapping.dmp

Download
memory/3292-149-0x0000000000000000-mapping.dmp

Download
memory/3292-148-0x0000000000000000-mapping.dmp

Download
memory/3292-150-0x0000000000000000-mapping.dmp

Download
memory/3292-151-0x0000000000000000-mapping.dmp

Download
memory/3292-15-0x0000000004E30000-0x0000000004E31000-memory.dmp

Filesize
4KB

Download
memory/3292-23-0x0000000000000000-mapping.dmp

Download
memory/3292-155-0x0000000000000000-mapping.dmp

Download
memory/3292-153-0x0000000000000000-mapping.dmp

Download
memory/3292-156-0x0000000000000000-mapping.dmp

Download
memory/3292-157-0x0000000000000000-mapping.dmp

Download
memory/3292-14-0x0000000004630000-0x0000000004631000-memory.dmp

Filesize
4KB

Download
memory/3292-159-0x0000000000000000-mapping.dmp

Download
memory/3292-160-0x0000000000000000-mapping.dmp

Download
memory/3292-161-0x0000000000000000-mapping.dmp

Download
memory/3292-162-0x0000000000000000-mapping.dmp

Download
memory/3292-203-0x0000000000000000-mapping.dmp

Download
memory/3292-164-0x0000000000000000-mapping.dmp

Download
memory/3292-165-0x0000000000000000-mapping.dmp

Download
memory/3292-167-0x0000000000000000-mapping.dmp

Download
memory/3292-166-0x0000000000000000-mapping.dmp

Download
memory/3292-168-0x0000000000000000-mapping.dmp

Download
memory/3292-169-0x0000000000000000-mapping.dmp

Download
memory/3292-201-0x0000000000000000-mapping.dmp

Download
memory/3292-171-0x0000000000000000-mapping.dmp

Download
memory/3292-172-0x0000000000000000-mapping.dmp

Download
memory/3292-173-0x0000000000000000-mapping.dmp

Download
memory/3292-174-0x0000000000000000-mapping.dmp

Download
memory/3292-175-0x0000000000000000-mapping.dmp

Download
memory/3292-176-0x0000000000000000-mapping.dmp

Download
memory/3292-200-0x0000000000000000-mapping.dmp

Download
memory/3292-178-0x0000000000000000-mapping.dmp

Download
memory/3292-179-0x0000000000000000-mapping.dmp

Download
memory/3292-180-0x0000000000000000-mapping.dmp

Download
memory/3292-181-0x0000000000000000-mapping.dmp

Download
memory/3292-182-0x0000000000000000-mapping.dmp

Download
memory/3292-183-0x0000000000000000-mapping.dmp

Download
memory/3292-199-0x0000000000000000-mapping.dmp

Download
memory/3292-185-0x0000000000000000-mapping.dmp

Download
memory/3292-186-0x0000000000000000-mapping.dmp

Download
memory/3292-188-0x0000000000000000-mapping.dmp

Download
memory/3292-187-0x0000000000000000-mapping.dmp

Download
memory/3292-189-0x0000000000000000-mapping.dmp

Download
memory/3292-197-0x0000000000000000-mapping.dmp

Download
memory/3292-191-0x0000000000000000-mapping.dmp

Download
memory/3292-192-0x0000000000000000-mapping.dmp

Download
memory/3292-194-0x0000000000000000-mapping.dmp

Download
memory/3292-195-0x0000000000000000-mapping.dmp

Download
memory/3292-193-0x0000000000000000-mapping.dmp

Download
memory/3292-196-0x0000000000000000-mapping.dmp

Download
memory/3340-190-0x0000000004C60000-0x0000000004C61000-memory.dmp

Filesize
4KB

Download
memory/3340-198-0x0000000005700000-0x0000000005701000-memory.dmp

Filesize
4KB

Download
memory/3780-4-0x0000000000000000-mapping.dmp

Download
memory/4020-184-0x0000000005970000-0x0000000005971000-memory.dmp

Filesize
4KB

Download
memory/4020-177-0x0000000004D50000-0x0000000004D51000-memory.dmp

Filesize
4KB

Download
memory/4264-16-0x0000000004490000-0x0000000004491000-memory.dmp

Filesize
4KB

Download
memory/4264-22-0x0000000004E40000-0x0000000004E41000-memory.dmp

Filesize
4KB

Download
memory/4456-78-0x0000000004F30000-0x0000000004F31000-memory.dmp

Filesize
4KB

Download
memory/4632-170-0x0000000005240000-0x0000000005241000-memory.dmp

Filesize
4KB

Download
memory/4632-163-0x00000000046A0000-0x00000000046A1000-memory.dmp

Filesize
4KB

Download
memory/5032-0-0x0000000000000000-mapping.dmp

Download

pid	process
5032	94b93992e4968d36b4366673815847ed.tmp
3780	regsvr32.exe
3292	VideoConverter.exe