94fef3ee9512941ff1aa4c8a951598ae67c42b71fbc047d28f3164570497d0b0

Analysis

max time kernel
149s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 03:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Filters/register.cmd
Size

88B
MD5

26cb1034edd008abd00d7a1f935b61c5
SHA1

2e45fddd2280a14a96b8cb1ed8b8e4c9707f9c41
SHA256

f4e0fbc265020d01aaf4f451ffd9319ab3742aeef949af7a38260790ff6e4670
SHA512

ea300163b36c9ee397812b6dc4fba07849014f6c57d5c2f07e243414c4ee1e156a4100d7eb4bc555ac48b3eda2c7990d0329d3c1adede29f54ae1ff7c17fb480

Score

1^/10

Malware Config

Signatures

Modifies registry class 52 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{13DEF622-983C-4FA4-91CD-238C72DE4F3F}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Filters\\LC.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{BC4EB321-771F-4E9F-AF67-37C631ECA106}\CLSID = "{BC4EB321-771F-4E9F-AF67-37C631ECA106}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6C4C97D-FBFF-433F-B099-B96A12D32393}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6C4C97D-FBFF-433F-B099-B96A12D32393}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6C4C97D-FBFF-433F-B099-B96A12D32393}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Filters\\elaudec.ax"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08C10075-CA5C-4EDE-A033-AD28827A2F66}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Filters\\LC.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D677B967-820F-4E84-B43A-118270FFFB80}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6C4C97D-FBFF-433F-B099-B96A12D32392}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BC4EB321-771F-4E9F-AF67-37C631ECA106}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BC4EB321-771F-4E9F-AF67-37C631ECA106}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Filters\\em2vd.ax"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{F6C4C97D-FBFF-433F-B099-B96A12D32391}\FriendlyName = "Elecard Audio Decoder"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08C10075-CA5C-4EDE-A033-AD28827A2F66}\ = "Elecard LC"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6C4C97D-FBFF-433F-B099-B96A12D32393}\ = "About"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5611AC6E-60BD-4C61-B1B2-793037310CA7}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{BC4EB321-771F-4E9F-AF67-37C631ECA106}\Capabilities	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6C4C97D-FBFF-433F-B099-B96A12D32391}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Filters\\elaudec.ax"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{F6C4C97D-FBFF-433F-B099-B96A12D32391}	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{F6C4C97D-FBFF-433F-B099-B96A12D32391}\FilterData = 0200000000000050020000000000000030706933000000000000000013000000000000000000000030747933000000008001000090010000317479330000000080010000a0010000327479330000000080010000b00100003374793300000000c0010000b00100003474793300000000d0010000b0010000357479330000000080010000e0010000367479330000000080010000f00100003774793300000000800100000002000038747933000000008001000010020000397479330000000080010000200200003a7479330000000080010000300200003b74793300000000d0010000200200003c7479330000000040020000f00100003d7479330000000080010000500200003e7479330000000080010000600200003f74793300000000d001000060020000407479330000000080010000700200004174793300000000800100008002000042747933000000008001000090020000317069330800000000000000010000000000000000000000307479330000000080010000a00100006175647300001000800000aa00389b71000000000000000000000000000000000100000000001000800000aa00389b712c806de046dbcf11b4d100805f6cbbea6a910bed4d04d111aa7800c04fc31d6020806de046dbcf11b4d100805f6cbbea0020000000001000800000aa00389b7187eb36e44f52ce119f530020af0ba77080eb36e44f52ce119f530020af0ba77081eb36e44f52ce119f530020af0ba7705000000000001000800000aa00389b712b806de046dbcf11b4d100805f6cbbea83eb36e44f52ce119f530020af0ba7705500000000001000800000aa00389b7132806de046dbcf11b4d100805f6cbbeaff00000000001000800000aa00389b717802000000001000800000aa00389b714d50344100001000800000aa00389b71	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6C4C97D-FBFF-433F-B099-B96A12D32391}\Options = f976defa1eafda0100000000	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BC4EB321-771F-4E9F-AF67-37C631ECA106}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5611AC6E-60BD-4C61-B1B2-793037310CA7}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Filters\\em2vd.ax"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6C4C97D-FBFF-433F-B099-B96A12D32391}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08C10075-CA5C-4EDE-A033-AD28827A2F66}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6C4C97D-FBFF-433F-B099-B96A12D32392}\ = "Settings"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6C4C97D-FBFF-433F-B099-B96A12D32392}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{13DEF622-983C-4FA4-91CD-238C72DE4F3F}\InprocServer32\ThreadingModel = "both"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{BC4EB321-771F-4E9F-AF67-37C631ECA106}\FilterData = 020000000100800004000000000000003070693300000000000000000400000000000000000000003074793300000000600100007001000031747933000000006001000080010000327479330000000060010000900100003374793300000000a001000090010000317069330800000000000000070000000000000000000000307479330000000060010000b0010000317479330000000060010000c0010000327479330000000060010000d0010000337479330000000060010000e0010000347479330000000060010000f001000035747933000000006001000000020000367479330000000060010000100200003270693300000000000000000200000000000000000000003074793300000000a0010000200200003174793300000000600100002002000033706933080000000000000002000000000000000000000030747933000000003002000040020000317479330000000030020000500200007669647300001000800000aa00389b7180eb36e44f52ce119f530020af0ba77081eb36e44f52ce119f530020af0ba77026806de046dbcf11b4d100805f6cbbea6a910bed4d04d111aa7800c04fc31d605559565900001000800000aa00389b715955593200001000800000aa00389b717eeb36e44f52ce119f530020af0ba7707deb36e44f52ce119f530020af0ba7707beb36e44f52ce119f530020af0ba7707ceb36e44f52ce119f530020af0ba7707aeb36e44f52ce119f530020af0ba7702d806de046dbcf11b4d100805f6cbbea80ea0a67823ad011b79b00aa003767a7234a8d6e0c31d011b79a00aa003767a7224a8d6e0c31d011b79a00aa003767a7	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6C4C97D-FBFF-433F-B099-B96A12D32391}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6C4C97D-FBFF-433F-B099-B96A12D32393}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08C10075-CA5C-4EDE-A033-AD28827A2F66}\InprocServer32\ThreadingModel = "both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BC4EB321-771F-4E9F-AF67-37C631ECA106}\ = "Elecard MPEG-2 Video Decoder"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5611AC6E-60BD-4C61-B1B2-793037310CA7}\ = "Settings"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BC4EB321-771F-4E9F-AF67-37C631ECA106}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D677B967-820F-4E84-B43A-118270FFFB80}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{F6C4C97D-FBFF-433F-B099-B96A12D32391}\CLSID = "{F6C4C97D-FBFF-433F-B099-B96A12D32391}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{13DEF622-983C-4FA4-91CD-238C72DE4F3F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{BC4EB321-771F-4E9F-AF67-37C631ECA106}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6C4C97D-FBFF-433F-B099-B96A12D32391}\ = "Elecard Audio Decoder"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BC4EB321-771F-4E9F-AF67-37C631ECA106}\Options = 7c9ec6fa1eafda0100000000	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6C4C97D-FBFF-433F-B099-B96A12D32391}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{13DEF622-983C-4FA4-91CD-238C72DE4F3F}\ = "Elecard LC"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{13DEF622-983C-4FA4-91CD-238C72DE4F3F}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D677B967-820F-4E84-B43A-118270FFFB80}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Filters\\em2vd.ax"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{BC4EB321-771F-4E9F-AF67-37C631ECA106}\FriendlyName = "Elecard MPEG-2 Video Decoder"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5611AC6E-60BD-4C61-B1B2-793037310CA7}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5611AC6E-60BD-4C61-B1B2-793037310CA7}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D677B967-820F-4E84-B43A-118270FFFB80}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6C4C97D-FBFF-433F-B099-B96A12D32392}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6C4C97D-FBFF-433F-B099-B96A12D32392}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Filters\\elaudec.ax"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08C10075-CA5C-4EDE-A033-AD28827A2F66}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D677B967-820F-4E84-B43A-118270FFFB80}\ = "About"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{BC4EB321-771F-4E9F-AF67-37C631ECA106}\Capabilities\{374ac4df-7c98-4257-b13d-36087dbee458} = "1"	regsvr32.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3076 wrote to memory of 5056	3076	cmd.exe	85
PID 3076 wrote to memory of 5056	3076	cmd.exe	85
PID 5056 wrote to memory of 2384	5056	regsvr32.exe	86
PID 5056 wrote to memory of 2384	5056	regsvr32.exe	86
PID 5056 wrote to memory of 2384	5056	regsvr32.exe	86
PID 3076 wrote to memory of 1732	3076	cmd.exe	88
PID 3076 wrote to memory of 1732	3076	cmd.exe	88
PID 1732 wrote to memory of 4520	1732	regsvr32.exe	89
PID 1732 wrote to memory of 4520	1732	regsvr32.exe	89
PID 1732 wrote to memory of 4520	1732	regsvr32.exe	89
PID 3076 wrote to memory of 4728	3076	cmd.exe	90
PID 3076 wrote to memory of 4728	3076	cmd.exe	90
PID 3076 wrote to memory of 4764	3076	cmd.exe	91
PID 3076 wrote to memory of 4764	3076	cmd.exe	91
PID 4764 wrote to memory of 2304	4764	regsvr32.exe	92
PID 4764 wrote to memory of 2304	4764	regsvr32.exe	92
PID 4764 wrote to memory of 2304	4764	regsvr32.exe	92

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Filters\register.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:3076
- C:\Windows\system32\regsvr32.exe
  regsvr32 /s LC.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5056
- - C:\Windows\SysWOW64\regsvr32.exe
    /s LC.dll
    3⤵
    - Modifies registry class
    PID:2384
- C:\Windows\system32\regsvr32.exe
  regsvr32 /s em2vd.ax
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1732
- - C:\Windows\SysWOW64\regsvr32.exe
    /s em2vd.ax
    3⤵
    - Modifies registry class
    PID:4520
- C:\Windows\system32\regsvr32.exe
  regsvr32 /s el2ad.ax
  2⤵
  PID:4728
- C:\Windows\system32\regsvr32.exe
  regsvr32 /s elaudec.ax
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4764
- - C:\Windows\SysWOW64\regsvr32.exe
    /s elaudec.ax
    3⤵
    - Modifies registry class
    PID:2304

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads