f55f5f0b070786948e89fb5810d54286bde9aca92897a7cc31fe4cd270e1a86a

Analysis

max time kernel
29s
max time network
19s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/02/2024, 15:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
webcamrecordersetup(1).exe
Size 2.8MB
Sample240224-te8s7agh2v
SHA256 f55f5f0b070786948e89fb5810d54286bde9aca92897a7cc31fe4cd270e1a86a
MD5 b3242f68d0e97a51d984e074eadc5f6f
SHA1 57c76d225c6af676a68f307bf8a9449e6e30a022
SHA512 ce6d857ae0df9932edb41248579240dfb935cf7e387c3ff50fb276d5e2ffde32917ced795a999de5dc147494b1ebc71c4b61bac1af21f8f6e3811ed88819b94e
SSDEEP 49152:Pv8iKTIPifjRLFeJtxL+NAfVXtGvDIH1oVkZtmiNf3RfdBzi4MjeK+k7ZNqW:38pT/pFePxLLfVdGsVoctRffd9i4Wr7l
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery persistence

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Free2X Webcam Recorder.lnk	webcamrecordersetup(1).tmp

Executes dropped EXE 2 IoCs

pid	Process
1992	webcamrecordersetup(1).tmp
2420	WebcamRecorder.exe

Loads dropped DLL 17 IoCs

pid	Process
1652	webcamrecordersetup(1).exe
1992	webcamrecordersetup(1).tmp
1992	webcamrecordersetup(1).tmp
1992	webcamrecordersetup(1).tmp
1992	webcamrecordersetup(1).tmp
1992	webcamrecordersetup(1).tmp
1992	webcamrecordersetup(1).tmp
1992	webcamrecordersetup(1).tmp
2612	regsvr32.exe
2904	regsvr32.exe
1992	webcamrecordersetup(1).tmp
2420	WebcamRecorder.exe
2420	WebcamRecorder.exe
2420	WebcamRecorder.exe
2420	WebcamRecorder.exe
2420	WebcamRecorder.exe
2420	WebcamRecorder.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Setup\Registering MS MPEG4 ActiveX filter... = "C:\\Windows\\system32\\regsvr32.exe /s C:\\Windows\\system32\\mpg4ds32.ax"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Wrapper = "runonce"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Setup	runonce.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\MPG4ds32.ax	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\SET5F41.tmp	rundll32.exe
File created	C:\Windows\SysWOW64\SET5F41.tmp	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\MPG4c32.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\SET5F30.tmp	rundll32.exe
File created	C:\Windows\SysWOW64\SET5F30.tmp	rundll32.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Free2X\Webcam Recorder\unins000.dat	webcamrecordersetup(1).tmp
File opened for modification	C:\Program Files (x86)\Free2X\Webcam Recorder\WebcamRecorder.exe	webcamrecordersetup(1).tmp
File opened for modification	C:\Program Files (x86)\Free2X\Webcam Recorder\zHook.dll	webcamrecordersetup(1).tmp
File created	C:\Program Files (x86)\Free2X\Webcam Recorder\is-2QNN9.tmp	webcamrecordersetup(1).tmp
File created	C:\Program Files (x86)\Free2X\Webcam Recorder\is-15IMC.tmp	webcamrecordersetup(1).tmp
File created	C:\Program Files (x86)\Free2X\Webcam Recorder\is-FTK6K.tmp	webcamrecordersetup(1).tmp
File opened for modification	C:\Program Files (x86)\Free2X\Webcam Recorder\Bass.dll	webcamrecordersetup(1).tmp
File created	C:\Program Files (x86)\Free2X\Webcam Recorder\unins000.dat	webcamrecordersetup(1).tmp
File created	C:\Program Files (x86)\Free2X\Webcam Recorder\is-155N9.tmp	webcamrecordersetup(1).tmp
File created	C:\Program Files (x86)\Free2X\Webcam Recorder\is-ED2BJ.tmp	webcamrecordersetup(1).tmp

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.app.log	rundll32.exe
File opened for modification	C:\Windows\INF\SET5F80.tmp	rundll32.exe
File created	C:\Windows\INF\SET5F80.tmp	rundll32.exe
File opened for modification	C:\Windows\INF\Mpg4vki.inf	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe

Modifies registry class 51 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2477BBD1-8D11-4C61-9FA3-8A9E371AF926}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B8D27089-FF5F-4B7C-98DC-0E91A1696286}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Free2X\\Webcam Recorder\\Dll\\lame_dshow.ax"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{82CCD3E0-F71A-11D0-9FE5-00609778EA66}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{82CCD3E0-F71A-11D0-9FE5-00609778EA66}\InprocServer32\ = "C:\\Windows\\SysWow64\\mpg4ds32.ax"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{2477BBD1-8D11-4C61-9FA3-8A9E371AF926}\FriendlyName = "LAME Audio Encoder"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{82CCD3E0-F71A-11D0-9FE5-00609778EA66}\FilterData = 020000000000800002000000000000003070693300000000000000000800000000000000000000003074793300000000d0000000e00000003174793300000000d0000000f00000003274793300000000d0000000000100003374793300000000d0000000100100003474793300000000d0000000200100003574793300000000d0000000300100003674793300000000d0000000400100003774793300000000d0000000500100003170693308000000000000000100000000000000000000003074793300000000d0000000600100007669647300001000800000aa00389b714d50473400001000800000aa00389b716d70673400001000800000aa00389b714d50343200001000800000aa00389b716d70343200001000800000aa00389b714d50343300001000800000aa00389b716d70343300001000800000aa00389b714d50345300001000800000aa00389b716d70347300001000800000aa00389b7100000000000000000000000000000000	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B8D27089-FF5F-4B7C-98DC-0E91A1696286}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B8D2708A-FF5F-4B7C-98DC-0E91A1696286}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FE69EDD1-F4CB-11D5-994A-000021D1FE2F}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Free2X\\Webcam Recorder\\Dll\\lame_dshow.ax"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{2477BBD1-8D11-4C61-9FA3-8A9E371AF926}\CLSID = "{2477BBD1-8D11-4C61-9FA3-8A9E371AF926}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{82CCD3E0-F71A-11D0-9FE5-00609778EA66}\ = "Microcrap MPEG-4 Video Decompressor"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{82CCD3E0-F71A-11D0-9FE5-00609778EA66}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2477BBD1-8D11-4C61-9FA3-8A9E371AF926}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B8D2708A-FF5F-4B7C-98DC-0E91A1696286}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Free2X\\Webcam Recorder\\Dll\\lame_dshow.ax"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{33D9A761-90C8-11D0-BD43-00A0C911CE86}\Instance\LAME Audio Encoder	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{82CCD3E0-F71A-11D0-9FE5-00609778EA66}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{598EBA02-B49A-11D2-A1C1-00609778EA66}\ = "Microcrap MPEG-4 Video Decompressor Property page"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{598EBA02-B49A-11D2-A1C1-00609778EA66}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{075BB8A1-B7D8-11D2-A1C6-00609778EA66}\ = "Microcrap MPEG-4 Video Decompressor About Page"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{075BB8A1-B7D8-11D2-A1C6-00609778EA66}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B8D2708A-FF5F-4B7C-98DC-0E91A1696286}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{82CCD3E0-F71A-11D0-9FE5-00609778EA66}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FE69EDD1-F4CB-11D5-994A-000021D1FE2F}	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{2477BBD1-8D11-4C61-9FA3-8A9E371AF926}\FilterData = 02000000000020000200000000000000307069330000000000000000010000000000000000000000307479330000000090000000a0000000317069330800000000000000040000000000000000000000307479330000000090000000b0000000317479330000000090000000c0000000327479330000000090000000d00000003374793300000000e0000000f00000006175647300001000800000aa00389b710100000000001000800000aa00389b715000000000001000800000aa00389b712b806de046dbcf11b4d100805f6cbbea5500000000001000800000aa00389b7183eb36e44f52ce119f530020af0ba77087eb36e44f52ce119f530020af0ba770	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{33D9A761-90C8-11D0-BD43-00A0C911CE86}\Instance	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{33D9A761-90C8-11D0-BD43-00A0C911CE86}\Instance\LAME Audio Encoder\FriendlyName = "LAME Audio Encoder"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{33D9A761-90C8-11D0-BD43-00A0C911CE86}\Instance\LAME Audio Encoder\FilterData = 02000000000020000200000000000000307069330000000000000000010000000000000000000000307479330000000090000000a0000000317069330800000000000000040000000000000000000000307479330000000090000000b0000000317479330000000090000000c0000000327479330000000090000000d00000003374793300000000e0000000f00000006175647300001000800000aa00389b710100000000001000800000aa00389b715000000000001000800000aa00389b712b806de046dbcf11b4d100805f6cbbea5500000000001000800000aa00389b7183eb36e44f52ce119f530020af0ba77087eb36e44f52ce119f530020af0ba770	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2477BBD1-8D11-4C61-9FA3-8A9E371AF926}\ = "LAME Audio Encoder"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B8D27089-FF5F-4B7C-98DC-0E91A1696286}\ = "LAME Audio Encoder Property Page"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B8D27089-FF5F-4B7C-98DC-0E91A1696286}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{598EBA02-B49A-11D2-A1C1-00609778EA66}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2477BBD1-8D11-4C61-9FA3-8A9E371AF926}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FE69EDD1-F4CB-11D5-994A-000021D1FE2F}\ = "LAME Audio Encoder About"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{2477BBD1-8D11-4C61-9FA3-8A9E371AF926}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{82CCD3E0-F71A-11D0-9FE5-00609778EA66}\FriendlyName = "Microcrap MPEG-4 Video Decompressor"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2477BBD1-8D11-4C61-9FA3-8A9E371AF926}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Free2X\\Webcam Recorder\\Dll\\lame_dshow.ax"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B8D2708A-FF5F-4B7C-98DC-0E91A1696286}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{075BB8A1-B7D8-11D2-A1C6-00609778EA66}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B8D27089-FF5F-4B7C-98DC-0E91A1696286}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{598EBA02-B49A-11D2-A1C1-00609778EA66}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{075BB8A1-B7D8-11D2-A1C6-00609778EA66}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B8D2708A-FF5F-4B7C-98DC-0E91A1696286}\ = "LAME Audio Encoder Property Page"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{075BB8A1-B7D8-11D2-A1C6-00609778EA66}\InprocServer32\ = "C:\\Windows\\SysWow64\\mpg4ds32.ax"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FE69EDD1-F4CB-11D5-994A-000021D1FE2F}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{33D9A761-90C8-11D0-BD43-00A0C911CE86}\Instance\LAME Audio Encoder\CLSID = "{2477BBD1-8D11-4C61-9FA3-8A9E371AF926}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{598EBA02-B49A-11D2-A1C1-00609778EA66}\InprocServer32\ = "C:\\Windows\\SysWow64\\mpg4ds32.ax"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{82CCD3E0-F71A-11D0-9FE5-00609778EA66}\CLSID = "{82CCD3E0-F71A-11D0-9FE5-00609778EA66}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FE69EDD1-F4CB-11D5-994A-000021D1FE2F}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{33D9A761-90C8-11D0-BD43-00A0C911CE86}	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1992	webcamrecordersetup(1).tmp
1992	webcamrecordersetup(1).tmp

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2420	WebcamRecorder.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeRestorePrivilege	748	rundll32.exe
Token: SeRestorePrivilege	748	rundll32.exe
Token: SeRestorePrivilege	748	rundll32.exe
Token: SeRestorePrivilege	748	rundll32.exe
Token: SeRestorePrivilege	748	rundll32.exe
Token: SeRestorePrivilege	748	rundll32.exe
Token: SeRestorePrivilege	748	rundll32.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
1992	webcamrecordersetup(1).tmp
2420	WebcamRecorder.exe
2420	WebcamRecorder.exe
2420	WebcamRecorder.exe
2420	WebcamRecorder.exe
2420	WebcamRecorder.exe
2420	WebcamRecorder.exe
2420	WebcamRecorder.exe
2420	WebcamRecorder.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
2420	WebcamRecorder.exe
2420	WebcamRecorder.exe
2420	WebcamRecorder.exe
2420	WebcamRecorder.exe
2420	WebcamRecorder.exe
2420	WebcamRecorder.exe
2420	WebcamRecorder.exe
2420	WebcamRecorder.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2420	WebcamRecorder.exe
2420	WebcamRecorder.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 1992	1652	webcamrecordersetup(1).exe	28
PID 1652 wrote to memory of 1992	1652	webcamrecordersetup(1).exe	28
PID 1652 wrote to memory of 1992	1652	webcamrecordersetup(1).exe	28
PID 1652 wrote to memory of 1992	1652	webcamrecordersetup(1).exe	28
PID 1652 wrote to memory of 1992	1652	webcamrecordersetup(1).exe	28
PID 1652 wrote to memory of 1992	1652	webcamrecordersetup(1).exe	28
PID 1652 wrote to memory of 1992	1652	webcamrecordersetup(1).exe	28
PID 1992 wrote to memory of 2612	1992	webcamrecordersetup(1).tmp	29
PID 1992 wrote to memory of 2612	1992	webcamrecordersetup(1).tmp	29
PID 1992 wrote to memory of 2612	1992	webcamrecordersetup(1).tmp	29
PID 1992 wrote to memory of 2612	1992	webcamrecordersetup(1).tmp	29
PID 1992 wrote to memory of 2612	1992	webcamrecordersetup(1).tmp	29
PID 1992 wrote to memory of 2612	1992	webcamrecordersetup(1).tmp	29
PID 1992 wrote to memory of 2612	1992	webcamrecordersetup(1).tmp	29
PID 1992 wrote to memory of 748	1992	webcamrecordersetup(1).tmp	31
PID 1992 wrote to memory of 748	1992	webcamrecordersetup(1).tmp	31
PID 1992 wrote to memory of 748	1992	webcamrecordersetup(1).tmp	31
PID 1992 wrote to memory of 748	1992	webcamrecordersetup(1).tmp	31
PID 1992 wrote to memory of 748	1992	webcamrecordersetup(1).tmp	31
PID 1992 wrote to memory of 748	1992	webcamrecordersetup(1).tmp	31
PID 1992 wrote to memory of 748	1992	webcamrecordersetup(1).tmp	31
PID 748 wrote to memory of 2924	748	rundll32.exe	32
PID 748 wrote to memory of 2924	748	rundll32.exe	32
PID 748 wrote to memory of 2924	748	rundll32.exe	32
PID 748 wrote to memory of 2924	748	rundll32.exe	32
PID 2924 wrote to memory of 2984	2924	runonce.exe	33
PID 2924 wrote to memory of 2984	2924	runonce.exe	33
PID 2924 wrote to memory of 2984	2924	runonce.exe	33
PID 2924 wrote to memory of 2984	2924	runonce.exe	33
PID 2984 wrote to memory of 2904	2984	runonce.exe	34
PID 2984 wrote to memory of 2904	2984	runonce.exe	34
PID 2984 wrote to memory of 2904	2984	runonce.exe	34
PID 2984 wrote to memory of 2904	2984	runonce.exe	34
PID 2984 wrote to memory of 2904	2984	runonce.exe	34
PID 2984 wrote to memory of 2904	2984	runonce.exe	34
PID 2984 wrote to memory of 2904	2984	runonce.exe	34
PID 2924 wrote to memory of 2064	2924	runonce.exe	35
PID 2924 wrote to memory of 2064	2924	runonce.exe	35
PID 2924 wrote to memory of 2064	2924	runonce.exe	35
PID 2924 wrote to memory of 2064	2924	runonce.exe	35
PID 1992 wrote to memory of 2420	1992	webcamrecordersetup(1).tmp	36
PID 1992 wrote to memory of 2420	1992	webcamrecordersetup(1).tmp	36
PID 1992 wrote to memory of 2420	1992	webcamrecordersetup(1).tmp	36
PID 1992 wrote to memory of 2420	1992	webcamrecordersetup(1).tmp	36

C:\Users\Admin\AppData\Local\Temp\webcamrecordersetup(1).exe
"C:\Users\Admin\AppData\Local\Temp\webcamrecordersetup(1).exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Users\Admin\AppData\Local\Temp\is-6B3R4.tmp\webcamrecordersetup(1).tmp
  "C:\Users\Admin\AppData\Local\Temp\is-6B3R4.tmp\webcamrecordersetup(1).tmp" /SL5="$50150,2649872,171008,C:\Users\Admin\AppData\Local\Temp\webcamrecordersetup(1).exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1992
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Free2X\Webcam Recorder\Dll\lame_dshow.ax"
    3⤵
    - Loads dropped DLL
    - Modifies registry class
    PID:2612
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\system32\rundll32.exe" setupapi,InstallHinfSection DefaultInstall 128 C:\Users\Admin\AppData\Local\Free2X\Webcam Recorder\Dll\MPG4VKI.inf
    3⤵
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:748
  - - C:\Windows\SysWOW64\runonce.exe
      "C:\Windows\system32\runonce.exe" -r
      4⤵
      Checks processor information in registry
      Suspicious use of WriteProcessMemory
      PID:2924
    - - C:\Windows\SysWOW64\runonce.exe
        
        "C:\Windows\System32\runonce.exe"
        5⤵
        Adds Run key to start application
        Checks processor information in registry
        Suspicious use of WriteProcessMemory
        
        PID:2984
      - C:\Windows\SysWOW64\regsvr32.exe
        
        C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\mpg4ds32.ax
        6⤵
        Loads dropped DLL
        Modifies registry class
        
        PID:2904
    - - C:\Windows\SysWOW64\grpconv.exe
        
        "C:\Windows\System32\grpconv.exe" -o
        5⤵
        
        PID:2064
- - C:\Program Files (x86)\Free2X\Webcam Recorder\WebcamRecorder.exe
    "C:\Program Files (x86)\Free2X\Webcam Recorder\WebcamRecorder.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:2420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MPG4c32.dll

Path C:\Users\Admin\AppData\Local\Free2X\WEBCAM~1\Dll\MPG4c32.dll
Size 404KB
SHA256 19305bac9452a61b757db35dfe189369d4311c4203699cb4cbb3af5f590a8e04
MD5 3f81e76e701bb4e00d3cce7a1a751fb2
SHA1 d65379b26c653a0842e649eb76399c7c0cda3b22
SHA512 f9e7750d6b08a823d86ffa19a50723c78bcd9ca83be024caf572a9fd4158c2fbe7df98ea390621e78a0979fa49244d9c5ac745e56f475af49f97f5a20bd182f9
SSDEEP 6144:E/0BAIcKDZT+6zz8fK7o1yB+c8My7hFMMhmnslB3dJXRRmWds:E4nFLzWckcyzD4slR/RRmAs
MD5 SHA1 SHA512 SSDEEP

Submit Download

MPG4ds32.ax

Path C:\Users\Admin\AppData\Local\Free2X\WEBCAM~1\Dll\MPG4ds32.ax
Size 234KB
SHA256 caa4262f53680c825484cf8613fb8cdff984c8c051c0f2f0f3e85becdf1258e0
MD5 99f8bd46f424a2086a0821fde445902e
SHA1 341689b419e9bc2335b691748ede33b1aed5533c
SHA512 768760322ceabd0323e40dce8212ea1b4bcb6df12dc34beb42b67aa8b98d781b4582b718ae70043ae308b9e3a14864ad7cb5b779764c8934696dc89b8a0babcd
SSDEEP 3072:uT/B2YVFw+0oNZlobmKSylGynhyb+/qbN0HW1cBWkg083/A/X7sW0G+mZ5:EVG+jSbmKjphyb+ybN0HWDs8O7sRm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Config.ini

Path C:\Users\Admin\AppData\Local\Free2X\Webcam Recorder\Config.ini
Size 289B
SHA256 94267b9cb292ab9d2ca9aa429c4a1bf7e4d799fd5b5dd13e937716dfbefa87ae
MD5 8af5e39af2e010eff423004fc06850cf
SHA1 94a9eef35b748079e8b5e12b400e3ffb168d8d9a
SHA512 324ad1385ce3dcd7b88054da172e63cc86ae7241e62e820327231a2914420dbb816f8215472749f6799ac651d591f964507781a4c5765b84ef8e8fd9ded4c4b4
MD5 SHA1 SHA512

Submit Download

MPG4VKI.inf

Path C:\Users\Admin\AppData\Local\Free2X\Webcam Recorder\Dll\MPG4VKI.inf
Size 2KB
SHA256 d84b5dc5484f7e1b2ecd94e883fb4ae1f16380f5eddb1bc2c0476e46a0594c5f
MD5 9beeb013024a5f5c179e17799074a4e2
SHA1 20e19ce59529b1adcb16a13235d5604034f452be
SHA512 dd79b1c83360496f977d3cd9677af51bc52896d7773bf75651306ad6284f1c8e7ee251d5e37c1ee9b2689fdb732dbc541c4111eac2da599023051afba977452d
MD5 SHA1 SHA512

Submit Download

lame_dshow.ax

Path C:\Users\Admin\AppData\Local\Free2X\Webcam Recorder\Dll\lame_dshow.ax
Size 261KB
SHA256 d1e85a15de0314869549d5d5db1b46aff4c4f58d0379966ab91b1a2f19e8d372
MD5 83f0ee332d478b736c9afd856300ef37
SHA1 fbc0c7cb8c06c057267dfdec53bf2040eda6d5cb
SHA512 490d20eef54d321a8b31c885d985c2bf2022725cb723b10b1e72364aa3ce999525aae9e7556495d9e97abdee542a21340277fc4b812efb44bdab4ad1c8420ef5
SSDEEP 6144:5ieLLVdOHazuzIZxdP1k2FYIUlZSG2ziLTqvqVWJZAMUIKadFaOZ8Rr:5iW6HaqexR1pUlZS1KAKadF
MD5 SHA1 SHA512 SSDEEP

Submit Download

HotKey.ini

Path C:\Users\Admin\AppData\Local\Free2X\Webcam Recorder\HotKey.ini
Size 225B
SHA256 2fac334c7954e7a15cf14d98bc81c030c6cd1018e21653e09f255495466fbc58
MD5 36773c4c4cebaa543d13abe36dbe3de4
SHA1 f3331d20b2eedf497c40591750d5ee38a4baf17c
SHA512 46308e7cc9a5efbecb9573f90132a47af84f068d6105f1d424c96ba7b0ff0c3c6905714602feeb0ff65b36e1b6c8297c3750e20a0f7c451c7d45d2d5336e445e
MD5 SHA1 SHA512

Submit Download

Mark.ini

Path C:\Users\Admin\AppData\Local\Free2X\Webcam Recorder\Mark.ini
Size 329B
SHA256 2863731968d845312e5114aef3335133521d92f2a02f95da698618d83740cb30
MD5 15b268afdb459ed2266f2309b4f28208
SHA1 14c7755ee1af078ebdfdf006e7a43c240b7fe942
SHA512 4fe76ccc8b0861c329932da28c6354036f97c1b1fe3a1be38b92709af8fcf0ffbbe981040a49261d3d642665f3ae7109f35f9d8221f5357517919a4e81ec5995
MD5 SHA1 SHA512

Submit Download

Bass.dll

Path \Program Files (x86)\Free2X\Webcam Recorder\Bass.dll
Size 95KB
SHA256 b9e7b89f6fc7545bf514e716cd4f779cca7497c8035ebfc19dddab1cf01cc7f2
MD5 9f163ea61d74488e25de852d77530993
SHA1 45926b7de1a80640d4f07e991c324975a1f94050
SHA512 2a5925ea5c9790c431e1a46a3b60869e40459e0fb1741f7700c03016ce7a7a7b0a9c8b520db04b5104369b7399857c6420047c1ac35e8ce110ec8957c10cd36c
SSDEEP 1536:eFgh/V28JWqRrmhMDkrty0rs0aTzxT18wd1k3B+TSMdUqpOFeU+Pj+wD3F3f:mgRV5rIjovBywc3UTriqpOEUA9DF3f
MD5 SHA1 SHA512 SSDEEP

Submit Download

WebcamRecorder.exe

Path \Program Files (x86)\Free2X\Webcam Recorder\WebcamRecorder.exe
Size 8.5MB
SHA256 9b91ed8ebed113cf3781fb9f9653ff6a3fb0bbc0aac03de50a17a85208532905
MD5 4abdb96d38abb0b503bb2aa653d2c385
SHA1 c225c4863faefbee00069767b3035dd1c332effd
SHA512 9d69cf5160605a95d3a8f8ec875eef98a4dba70dcc557b6aa7b0859a2cc54fa44f7adf42a33c0e8c916edc8ab06495340d74c1c5bf786c74d660bcfcfd5a406a
SSDEEP 196608:Hf6TWOedh4pdXSC/iHjA0pi11/HvMjNk:Hf6Tsh4pdXSC/iHjAQi3H6N
MD5 SHA1 SHA512 SSDEEP

Submit Download

unins000.exe

Path \Program Files (x86)\Free2X\Webcam Recorder\unins000.exe
Size 812KB
SHA256 22dc30421b62e8c9af2a4983286cd162a7490401ea28abae1dc386f9003eeff5
MD5 e767fb4fe66bc9cca6d153cdd4b3879d
SHA1 0b9099111f67777d7758235acfee85a528ed381d
SHA512 9195d65fb19cd760fc962a820eba4f22af70a06628ea4fb3a8f910b81add6bdc967c596f268d97577bce91c4923e97c00a3f0905105446ba9bb23f54a45d5050
SSDEEP 24576:PkqZ1G7DMvrP537dzHsA6hcHGbH3ENh18t8x9yy:Pkm1BrP537dzHsA6hc0c/r
MD5 SHA1 SHA512 SSDEEP

Submit Download

zHook.dll

Path \Program Files (x86)\Free2X\Webcam Recorder\zHook.dll
Size 155KB
SHA256 edd9ba4e59d6e0a82f2add34482d4c5b716ab544fa36931e7ab4e7f379c5dcd1
MD5 b3fd19ea53d2cb0b264b22f78b5efa0c
SHA1 bbdf1dab5f3995d7bd29eac689051688b0327d4e
SHA512 c05476535c77f848d6d1f9feeae3c23d6a71d2cc698bee3b02efd364aa15fcf21f56ffe3f65854fd02891c22b845e6faf1d863c1ed720a9d4a66b3a322e4f452
SSDEEP 3072:97bBvFhlodHoMpTclFSLOLxK6nFLNiaIrgyM4hHq/6vqJke8qGUIPJt:9RdhlMHoA/aFFFLNJIrLXhHq/2eQPJt
MD5 SHA1 SHA512 SSDEEP

Submit Download

_shfoldr.dll

Path \Users\Admin\AppData\Local\Temp\is-2VS2A.tmp\_isetup\_shfoldr.dll
Size 22KB
SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
MD5 92dc6ef532fbb4a5c3201469a5b5eb63
SHA1 3e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA512 9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
SSDEEP 384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
MD5 SHA1 SHA512 SSDEEP

Submit Download

webcamrecordersetup(1).tmp

Path \Users\Admin\AppData\Local\Temp\is-6B3R4.tmp\webcamrecordersetup(1).tmp
Size 801KB
SHA256 447155fb257435ca8734a8ac9f0e5d6caa397471b95f0ad261c30b5224ac9079
MD5 03ef56ff5ed746c48bb0123e3c441461
SHA1 8573f4d8cb705ddcd7014d7781796ac8697735a3
SHA512 dd432becc78c890633754af7004af15d5c8e982ebb53b3cf1e16800222e8dde57f8151fff7fb92bd13a0d00e4e07249a9b799bbee393a27ab0a8205c1ffb5016
SSDEEP 24576:nkqZ1G7DMvrP537dzHsA6hcHGbH3ENh18t8x9yr:nkm1BrP537dzHsA6hc0c/I
MD5 SHA1 SHA512 SSDEEP

Submit Download

v~f77A0.tmp

Path \Users\Admin\AppData\Local\Temp\v~f77A0.tmp
Size 195KB
SHA256 fdd12f517c9414675608d228c8abcd4d521500f5fbafe7173ef359c93377502e
MD5 6fa73fd212aa5ad859aa6d1dac283157
SHA1 66d75d66a744b811672f790932d3c782348bd952
SHA512 6c429d8ca62f64f28570aa922f985aa2e2b0feb58deec24f1efdfe06bc9ab806ab097dc6515a809ee38bebcaa048318e7ad8083a84ad4d4adec6043228cd3590
SSDEEP 3072:LdciwsKoyCZeGta2wSDIVXWbYdfIIlvM7dhsptcvZayrZJwFLCzCef8qrMsGaIS0:RLAZ6Arv4rdIyrZJwV1gMsfI/El2
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1652-1-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1652-101-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1652-15-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1992-8-0x0000000000240000-0x0000000000241000-memory.dmp

Download

memory/1992-16-0x0000000000400000-0x00000000004D9000-memory.dmp

Download

memory/1992-100-0x0000000000400000-0x00000000004D9000-memory.dmp

Download

memory/2420-90-0x0000000000260000-0x0000000000261000-memory.dmp

Download

memory/2420-127-0x00000000068C0000-0x00000000068F1000-memory.dmp

Download

memory/2420-89-0x0000000011000000-0x0000000011062000-memory.dmp

Download

memory/2420-128-0x0000000011000000-0x0000000011062000-memory.dmp

Download

memory/2420-129-0x0000000000400000-0x0000000000C8F000-memory.dmp

Download

memory/2420-130-0x0000000011000000-0x0000000011062000-memory.dmp

Download

memory/2420-132-0x0000000000260000-0x0000000000261000-memory.dmp

Download

memory/2420-131-0x00000000068C0000-0x00000000068F1000-memory.dmp

Download