617f845935d428ecaf15057713f3d08a10f8257b90ee669a2afac591678bac30

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21/07/2024, 18:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Video Enhancerv2013汉化绿色破解版/!)绿化.bat
Size

94B
MD5

354f875b10d4d5bfe8da627718044c4f
SHA1

b4c1bdda81065c1d7022faea7749c22d4bab5ed2
SHA256

f31685867320b48b5045678658aa0d8bb04c2879f9377cb6e7be063bfdfe3b47
SHA512

00a57317693babb9f0b7fb7bdc9bb3fda0a2228ab93c523eacce69866b9525b4bed1a352d5644ed8e6eae788531e450a9e2133e2160d09efb182860a1fd544e0

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2848	2836	WerFault.exe	30

Modifies registry class 60 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{890300E7-87C0-4DC3-9471-89C38EC33EF9}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{6CD44B99-8406-4E8B-A522-911FCFBEA2F2}\CLSID = "{6CD44B99-8406-4E8B-A522-911FCFBEA2F2}"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{29516102-A7F6-4DEE-B084-64A437BB21BA}\FilterData = 0200000000002000020000000000000030706933000000000000000001000000000000000000000030747933000000006000000070000000317069330000000000000000010000000000000000000000307479330000000080000000700000007669647300001000800000aa00389b71000000000000000000000000000000006175647300001000800000aa00389b71	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CE012A8E-2462-4200-8A9C-AE57593B64EC}\ = "Parallelizer"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{CE012A8E-2462-4200-8A9C-AE57593B64EC}\FriendlyName = "Parallelizer2"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{CE012A8E-2462-4200-8A9C-AE57593B64EC}\FilterData = 02000000000020000200000000000000307069330000000000000000010000000000000000000000307479330000000060000000600000003170693308000000000000000100000000000000000000003074793300000000600000006000000000000000000000000000000000000000	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{29516102-A7F6-4DEE-B084-64A437BB21BA}\FriendlyName = "Dee Mon's Avi Writer"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{60AC281F-8333-44CF-9856-2CE2D6C0A1EB}\CLSID = "{60AC281F-8333-44CF-9856-2CE2D6C0A1EB}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{890300E7-87C0-4DC3-9471-89C38EC33EF9}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{890300E7-87C0-4DC3-9471-89C38EC33EF9}\InprocServer32	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{6CD44B99-8406-4E8B-A522-911FCFBEA2F2}\FilterData = 0200000000002000020000000000000030706933000000000000000001000000000000000000000030747933000000006000000070000000317069330800000000000000010000000000000000000000307479330000000060000000700000007669647300001000800000aa00389b7100000000000000000000000000000000	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{60AC281F-8333-44CF-9856-2CE2D6C0A1EB}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{890300E7-87C0-4DC3-9471-89C38EC33EF9}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Video Enhancerv2013???????\\VDFilter.ax"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{539B4F58-16E7-4E47-8EC8-83BF91481D00}	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{60AC281F-8333-44CF-9856-2CE2D6C0A1EB}\FilterData = 0200000000002000020000000000000030706933000000000000000001000000000000000000000030747933000000006000000070000000317069330800000000000000010000000000000000000000307479330000000060000000700000007669647300001000800000aa00389b7100000000000000000000000000000000	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{CE012A8E-2462-4200-8A9C-AE57593B64EC}\CLSID = "{CE012A8E-2462-4200-8A9C-AE57593B64EC}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C8CDD2A9-A6BC-45D9-A5FD-E9EB1C60A94A}\ = "VidInfoHead Property Page"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{29516102-A7F6-4DEE-B084-64A437BB21BA}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Video Enhancerv2013???????\\aviwr.ax"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{539B4F58-16E7-4E47-8EC8-83BF91481D00}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{29516102-A7F6-4DEE-B084-64A437BB21BA}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{29516102-A7F6-4DEE-B084-64A437BB21BA}\CLSID = "{29516102-A7F6-4DEE-B084-64A437BB21BA}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{6CD44B99-8406-4E8B-A522-911FCFBEA2F2}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CE012A8E-2462-4200-8A9C-AE57593B64EC}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{CE012A8E-2462-4200-8A9C-AE57593B64EC}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{539B4F58-16E7-4E47-8EC8-83BF91481D00}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Video Enhancerv2013???????\\VIH.ax"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{29516102-A7F6-4DEE-B084-64A437BB21BA}\ = "Dee Mon's Avi Writer"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6CD44B99-8406-4E8B-A522-911FCFBEA2F2}\ = "VDFilter"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{539B4F58-16E7-4E47-8EC8-83BF91481D00}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{539B4F58-16E7-4E47-8EC8-83BF91481D00}\FriendlyName = "Dee Mon's VIH"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{29516102-A7F6-4DEE-B084-64A437BB21BA}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{60AC281F-8333-44CF-9856-2CE2D6C0A1EB}\ = "Dee Mon's Super Resolution"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6CD44B99-8406-4E8B-A522-911FCFBEA2F2}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Video Enhancerv2013???????\\VDFilter.ax"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C8CDD2A9-A6BC-45D9-A5FD-E9EB1C60A94A}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3B9FF6E0-8D9D-4590-A7B8-D702BC52777A}\ = "Super Resolution Property Page"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{890300E7-87C0-4DC3-9471-89C38EC33EF9}\ = "VDFilter Property Page"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{60AC281F-8333-44CF-9856-2CE2D6C0A1EB}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3B9FF6E0-8D9D-4590-A7B8-D702BC52777A}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{60AC281F-8333-44CF-9856-2CE2D6C0A1EB}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C8CDD2A9-A6BC-45D9-A5FD-E9EB1C60A94A}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{60AC281F-8333-44CF-9856-2CE2D6C0A1EB}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{60AC281F-8333-44CF-9856-2CE2D6C0A1EB}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Video Enhancerv2013???????\\SR.ax"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6CD44B99-8406-4E8B-A522-911FCFBEA2F2}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{539B4F58-16E7-4E47-8EC8-83BF91481D00}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3B9FF6E0-8D9D-4590-A7B8-D702BC52777A}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CE012A8E-2462-4200-8A9C-AE57593B64EC}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{539B4F58-16E7-4E47-8EC8-83BF91481D00}\ = "Dee Mon's VIH"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3B9FF6E0-8D9D-4590-A7B8-D702BC52777A}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3B9FF6E0-8D9D-4590-A7B8-D702BC52777A}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Video Enhancerv2013???????\\SR.ax"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CE012A8E-2462-4200-8A9C-AE57593B64EC}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{6CD44B99-8406-4E8B-A522-911FCFBEA2F2}\FriendlyName = "VDFilter"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CE012A8E-2462-4200-8A9C-AE57593B64EC}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Video Enhancerv2013???????\\Parallelizer.ax"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C8CDD2A9-A6BC-45D9-A5FD-E9EB1C60A94A}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Video Enhancerv2013???????\\VIH.ax"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6CD44B99-8406-4E8B-A522-911FCFBEA2F2}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{29516102-A7F6-4DEE-B084-64A437BB21BA}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{60AC281F-8333-44CF-9856-2CE2D6C0A1EB}\FriendlyName = "Dee Mon's Super Resolution"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C8CDD2A9-A6BC-45D9-A5FD-E9EB1C60A94A}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{539B4F58-16E7-4E47-8EC8-83BF91481D00}\CLSID = "{539B4F58-16E7-4E47-8EC8-83BF91481D00}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{29516102-A7F6-4DEE-B084-64A437BB21BA}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6CD44B99-8406-4E8B-A522-911FCFBEA2F2}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{539B4F58-16E7-4E47-8EC8-83BF91481D00}\FilterData = 0200000000002000020000000000000030706933000000000000000001000000000000000000000030747933000000006000000000000000317069330800000000000000010000000000000000000000307479330000000060000000000000007669647300001000800000aa00389b71	regsvr32.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2300	regsvr32.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 2300	2160	cmd.exe	29
PID 2160 wrote to memory of 2300	2160	cmd.exe	29
PID 2160 wrote to memory of 2300	2160	cmd.exe	29
PID 2160 wrote to memory of 2300	2160	cmd.exe	29
PID 2160 wrote to memory of 2300	2160	cmd.exe	29
PID 2300 wrote to memory of 2836	2300	regsvr32.exe	30
PID 2300 wrote to memory of 2836	2300	regsvr32.exe	30
PID 2300 wrote to memory of 2836	2300	regsvr32.exe	30
PID 2300 wrote to memory of 2836	2300	regsvr32.exe	30
PID 2300 wrote to memory of 2836	2300	regsvr32.exe	30
PID 2300 wrote to memory of 2836	2300	regsvr32.exe	30
PID 2300 wrote to memory of 2836	2300	regsvr32.exe	30
PID 2836 wrote to memory of 2848	2836	regsvr32.exe	31
PID 2836 wrote to memory of 2848	2836	regsvr32.exe	31
PID 2836 wrote to memory of 2848	2836	regsvr32.exe	31
PID 2836 wrote to memory of 2848	2836	regsvr32.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Video Enhancerv2013汉化绿色破解版\!)绿化.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Windows\system32\regsvr32.exe
  regsvr32 /s SR.ax VDFilter.ax Parallelizer.ax VIH.ax aviwr.ax skinengine.dll
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of WriteProcessMemory
  PID:2300
- - C:\Windows\SysWOW64\regsvr32.exe
    /s SR.ax VDFilter.ax Parallelizer.ax VIH.ax aviwr.ax skinengine.dll
    3⤵
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2836
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2836 -s 352
      4⤵
      Program crash
      PID:2848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2836-1-0x0000000000160000-0x0000000000162000-memory.dmp

Filesize
8KB

Download
memory/2836-0-0x00000000024B0000-0x000000000260D000-memory.dmp

Filesize
1.4MB

Download
memory/2836-2-0x00000000024B0000-0x000000000260D000-memory.dmp

Filesize
1.4MB

Download
memory/2836-4-0x0000000000160000-0x0000000000162000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads