94fef3ee9512941ff1aa4c8a951598ae67c42b71fbc047d28f3164570497d0b0

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 03:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Filters/register.cmd
Size

88B
MD5

26cb1034edd008abd00d7a1f935b61c5
SHA1

2e45fddd2280a14a96b8cb1ed8b8e4c9707f9c41
SHA256

f4e0fbc265020d01aaf4f451ffd9319ab3742aeef949af7a38260790ff6e4670
SHA512

ea300163b36c9ee397812b6dc4fba07849014f6c57d5c2f07e243414c4ee1e156a4100d7eb4bc555ac48b3eda2c7990d0329d3c1adede29f54ae1ff7c17fb480

Score

1^/10

Malware Config

Signatures

Modifies registry class 52 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{13DEF622-983C-4FA4-91CD-238C72DE4F3F}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Filters\\LC.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D677B967-820F-4E84-B43A-118270FFFB80}\ = "About"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BC4EB321-771F-4E9F-AF67-37C631ECA106}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Filters\\em2vd.ax"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F6C4C97D-FBFF-433F-B099-B96A12D32392}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{F6C4C97D-FBFF-433F-B099-B96A12D32391}\FriendlyName = "Elecard Audio Decoder"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{F6C4C97D-FBFF-433F-B099-B96A12D32391}\CLSID = "{F6C4C97D-FBFF-433F-B099-B96A12D32391}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{F6C4C97D-FBFF-433F-B099-B96A12D32391}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{BC4EB321-771F-4E9F-AF67-37C631ECA106}\CLSID = "{BC4EB321-771F-4E9F-AF67-37C631ECA106}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F6C4C97D-FBFF-433F-B099-B96A12D32392}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D677B967-820F-4E84-B43A-118270FFFB80}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{BC4EB321-771F-4E9F-AF67-37C631ECA106}\FilterData = 020000000100800004000000000000003070693300000000000000000400000000000000000000003074793300000000600100007001000031747933000000006001000080010000327479330000000060010000900100003374793300000000a001000090010000317069330800000000000000070000000000000000000000307479330000000060010000b0010000317479330000000060010000c0010000327479330000000060010000d0010000337479330000000060010000e0010000347479330000000060010000f001000035747933000000006001000000020000367479330000000060010000100200003270693300000000000000000200000000000000000000003074793300000000a0010000200200003174793300000000600100002002000033706933080000000000000002000000000000000000000030747933000000003002000040020000317479330000000030020000500200007669647300001000800000aa00389b7180eb36e44f52ce119f530020af0ba77081eb36e44f52ce119f530020af0ba77026806de046dbcf11b4d100805f6cbbea6a910bed4d04d111aa7800c04fc31d605559565900001000800000aa00389b715955593200001000800000aa00389b717eeb36e44f52ce119f530020af0ba7707deb36e44f52ce119f530020af0ba7707beb36e44f52ce119f530020af0ba7707ceb36e44f52ce119f530020af0ba7707aeb36e44f52ce119f530020af0ba7702d806de046dbcf11b4d100805f6cbbea80ea0a67823ad011b79b00aa003767a7234a8d6e0c31d011b79a00aa003767a7224a8d6e0c31d011b79a00aa003767a7	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{BC4EB321-771F-4E9F-AF67-37C631ECA106}\Capabilities\{374ac4df-7c98-4257-b13d-36087dbee458} = "1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F6C4C97D-FBFF-433F-B099-B96A12D32393}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5611AC6E-60BD-4C61-B1B2-793037310CA7}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{BC4EB321-771F-4E9F-AF67-37C631ECA106}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F6C4C97D-FBFF-433F-B099-B96A12D32393}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BC4EB321-771F-4E9F-AF67-37C631ECA106}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{BC4EB321-771F-4E9F-AF67-37C631ECA106}\FriendlyName = "Elecard MPEG-2 Video Decoder"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F6C4C97D-FBFF-433F-B099-B96A12D32391}\ = "Elecard Audio Decoder"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5611AC6E-60BD-4C61-B1B2-793037310CA7}\ = "Settings"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D677B967-820F-4E84-B43A-118270FFFB80}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Filters\\em2vd.ax"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F6C4C97D-FBFF-433F-B099-B96A12D32391}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Filters\\elaudec.ax"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{F6C4C97D-FBFF-433F-B099-B96A12D32391}\FilterData = 0200000000000050020000000000000030706933000000000000000013000000000000000000000030747933000000008001000090010000317479330000000080010000a0010000327479330000000080010000b00100003374793300000000c0010000b00100003474793300000000d0010000b0010000357479330000000080010000e0010000367479330000000080010000f00100003774793300000000800100000002000038747933000000008001000010020000397479330000000080010000200200003a7479330000000080010000300200003b74793300000000d0010000200200003c7479330000000040020000f00100003d7479330000000080010000500200003e7479330000000080010000600200003f74793300000000d001000060020000407479330000000080010000700200004174793300000000800100008002000042747933000000008001000090020000317069330800000000000000010000000000000000000000307479330000000080010000a00100006175647300001000800000aa00389b71000000000000000000000000000000000100000000001000800000aa00389b712c806de046dbcf11b4d100805f6cbbea6a910bed4d04d111aa7800c04fc31d6020806de046dbcf11b4d100805f6cbbea0020000000001000800000aa00389b7187eb36e44f52ce119f530020af0ba77080eb36e44f52ce119f530020af0ba77081eb36e44f52ce119f530020af0ba7705000000000001000800000aa00389b712b806de046dbcf11b4d100805f6cbbea83eb36e44f52ce119f530020af0ba7705500000000001000800000aa00389b7132806de046dbcf11b4d100805f6cbbeaff00000000001000800000aa00389b717802000000001000800000aa00389b714d50344100001000800000aa00389b71	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F6C4C97D-FBFF-433F-B099-B96A12D32391}\Options = 406155f51eafda0100000000	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{13DEF622-983C-4FA4-91CD-238C72DE4F3F}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{08C10075-CA5C-4EDE-A033-AD28827A2F66}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{08C10075-CA5C-4EDE-A033-AD28827A2F66}\ = "Elecard LC"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D677B967-820F-4E84-B43A-118270FFFB80}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F6C4C97D-FBFF-433F-B099-B96A12D32392}\ = "Settings"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F6C4C97D-FBFF-433F-B099-B96A12D32392}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F6C4C97D-FBFF-433F-B099-B96A12D32392}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Filters\\elaudec.ax"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{13DEF622-983C-4FA4-91CD-238C72DE4F3F}\ = "Elecard LC"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{08C10075-CA5C-4EDE-A033-AD28827A2F66}\InprocServer32\ThreadingModel = "both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BC4EB321-771F-4E9F-AF67-37C631ECA106}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D677B967-820F-4E84-B43A-118270FFFB80}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F6C4C97D-FBFF-433F-B099-B96A12D32391}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5611AC6E-60BD-4C61-B1B2-793037310CA7}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{08C10075-CA5C-4EDE-A033-AD28827A2F66}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BC4EB321-771F-4E9F-AF67-37C631ECA106}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BC4EB321-771F-4E9F-AF67-37C631ECA106}\Options = 607a49f51eafda0100000000	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{13DEF622-983C-4FA4-91CD-238C72DE4F3F}\InprocServer32\ThreadingModel = "both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5611AC6E-60BD-4C61-B1B2-793037310CA7}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F6C4C97D-FBFF-433F-B099-B96A12D32393}\ = "About"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{13DEF622-983C-4FA4-91CD-238C72DE4F3F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BC4EB321-771F-4E9F-AF67-37C631ECA106}\ = "Elecard MPEG-2 Video Decoder"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F6C4C97D-FBFF-433F-B099-B96A12D32393}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{BC4EB321-771F-4E9F-AF67-37C631ECA106}\Capabilities	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F6C4C97D-FBFF-433F-B099-B96A12D32391}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F6C4C97D-FBFF-433F-B099-B96A12D32393}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Filters\\elaudec.ax"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{08C10075-CA5C-4EDE-A033-AD28827A2F66}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Filters\\LC.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5611AC6E-60BD-4C61-B1B2-793037310CA7}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Filters\\em2vd.ax"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F6C4C97D-FBFF-433F-B099-B96A12D32391}\InprocServer32	regsvr32.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 4 IoCs

pid	Process
2860	regsvr32.exe
2548	regsvr32.exe
3028	regsvr32.exe
2596	regsvr32.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 2860	1988	cmd.exe	29
PID 1988 wrote to memory of 2860	1988	cmd.exe	29
PID 1988 wrote to memory of 2860	1988	cmd.exe	29
PID 1988 wrote to memory of 2860	1988	cmd.exe	29
PID 1988 wrote to memory of 2860	1988	cmd.exe	29
PID 2860 wrote to memory of 3008	2860	regsvr32.exe	30
PID 2860 wrote to memory of 3008	2860	regsvr32.exe	30
PID 2860 wrote to memory of 3008	2860	regsvr32.exe	30
PID 2860 wrote to memory of 3008	2860	regsvr32.exe	30
PID 2860 wrote to memory of 3008	2860	regsvr32.exe	30
PID 2860 wrote to memory of 3008	2860	regsvr32.exe	30
PID 2860 wrote to memory of 3008	2860	regsvr32.exe	30
PID 1988 wrote to memory of 2548	1988	cmd.exe	31
PID 1988 wrote to memory of 2548	1988	cmd.exe	31
PID 1988 wrote to memory of 2548	1988	cmd.exe	31
PID 1988 wrote to memory of 2548	1988	cmd.exe	31
PID 1988 wrote to memory of 2548	1988	cmd.exe	31
PID 2548 wrote to memory of 1636	2548	regsvr32.exe	32
PID 2548 wrote to memory of 1636	2548	regsvr32.exe	32
PID 2548 wrote to memory of 1636	2548	regsvr32.exe	32
PID 2548 wrote to memory of 1636	2548	regsvr32.exe	32
PID 2548 wrote to memory of 1636	2548	regsvr32.exe	32
PID 2548 wrote to memory of 1636	2548	regsvr32.exe	32
PID 2548 wrote to memory of 1636	2548	regsvr32.exe	32
PID 1988 wrote to memory of 3028	1988	cmd.exe	33
PID 1988 wrote to memory of 3028	1988	cmd.exe	33
PID 1988 wrote to memory of 3028	1988	cmd.exe	33
PID 1988 wrote to memory of 3028	1988	cmd.exe	33
PID 1988 wrote to memory of 3028	1988	cmd.exe	33
PID 1988 wrote to memory of 2596	1988	cmd.exe	34
PID 1988 wrote to memory of 2596	1988	cmd.exe	34
PID 1988 wrote to memory of 2596	1988	cmd.exe	34
PID 1988 wrote to memory of 2596	1988	cmd.exe	34
PID 1988 wrote to memory of 2596	1988	cmd.exe	34
PID 2596 wrote to memory of 2584	2596	regsvr32.exe	35
PID 2596 wrote to memory of 2584	2596	regsvr32.exe	35
PID 2596 wrote to memory of 2584	2596	regsvr32.exe	35
PID 2596 wrote to memory of 2584	2596	regsvr32.exe	35
PID 2596 wrote to memory of 2584	2596	regsvr32.exe	35
PID 2596 wrote to memory of 2584	2596	regsvr32.exe	35
PID 2596 wrote to memory of 2584	2596	regsvr32.exe	35

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Filters\register.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\system32\regsvr32.exe
  regsvr32 /s LC.dll
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of WriteProcessMemory
  PID:2860
- - C:\Windows\SysWOW64\regsvr32.exe
    /s LC.dll
    3⤵
    - Modifies registry class
    PID:3008
- C:\Windows\system32\regsvr32.exe
  regsvr32 /s em2vd.ax
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of WriteProcessMemory
  PID:2548
- - C:\Windows\SysWOW64\regsvr32.exe
    /s em2vd.ax
    3⤵
    - Modifies registry class
    PID:1636
- C:\Windows\system32\regsvr32.exe
  regsvr32 /s el2ad.ax
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:3028
- C:\Windows\system32\regsvr32.exe
  regsvr32 /s elaudec.ax
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of WriteProcessMemory
  PID:2596
- - C:\Windows\SysWOW64\regsvr32.exe
    /s elaudec.ax
    3⤵
    - Modifies registry class
    PID:2584

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads