File name:

Xvid-1.3.7-20191228.exe

Full analysis: https://app.any.run/tasks/7dd752b5-2460-492f-98f8-c78187e7b641
Verdict: Malicious activity
Analysis date: February 04, 2024, 08:12:47
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
MD5:

0A2F190C7B8E2744733944822BD317F3

SHA1:

C2F2C0726ECB8230EBA1953C3120DDD24F16745B

SHA256:

7997CB88DB3331191042EEF5238FBF2EBA44B9D244F43554A712996EBA2FFF49

SSDEEP:

196608:b/k/IXN+BupbShmbuR7HY4QIA6TC6otdn3gY3QIA6TP:NChG6xo3e6P

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Xvid-1.3.7-20191228.exe (PID: 2204)

    • Registers / Runs the DLL via REGSVR32.EXE

      • Xvid-1.3.7-20191228.exe (PID: 2204)

    • Creates a writable file in the system directory

      • rundll32.exe (PID: 3416)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • rundll32.exe (PID: 3416)
      • Xvid-1.3.7-20191228.exe (PID: 2204)

    • Reads the Internet Settings

      • runonce.exe (PID: 3136)

    • Uses RUNDLL32.EXE to load library

      • Xvid-1.3.7-20191228.exe (PID: 2204)

  • INFO

    • Checks supported languages

      • Xvid-1.3.7-20191228.exe (PID: 2204)
      • setpriv32.exe (PID: 908)
      • setavi32.exe (PID: 3452)

    • Drops the executable file immediately after the start

      • rundll32.exe (PID: 3416)

    • Reads the time zone

      • runonce.exe (PID: 3136)
      • Xvid-1.3.7-20191228.exe (PID: 2204)

    • Reads the computer name

      • setpriv32.exe (PID: 908)
      • Xvid-1.3.7-20191228.exe (PID: 2204)

    • Process checks whether UAC notifications are on

      • Xvid-1.3.7-20191228.exe (PID: 2204)

    • Create files in a temporary directory

      • Xvid-1.3.7-20191228.exe (PID: 2204)

    • Reads Environment values

      • Xvid-1.3.7-20191228.exe (PID: 2204)

    • Reads CPU info

      • Xvid-1.3.7-20191228.exe (PID: 2204)

    • Creates files in the program directory

      • Xvid-1.3.7-20191228.exe (PID: 2204)

    • Reads Windows Product ID

      • Xvid-1.3.7-20191228.exe (PID: 2204)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (39.3)
.exe | Win32 EXE Yoda's Crypter (38.6)
.dll | Win32 Dynamic Link Library (generic) (9.5)
.exe | Win32 Executable (generic) (6.5)
.exe | Generic Win/DOS Executable (2.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2015:04:10 17:42:38+02:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Large address aware, 32-bit, No debug
PEType: PE32
LinkerVersion: 2.22
CodeSize: 905216
InitializedDataSize: 77824
UninitializedDataSize: 1994752
EntryPoint: 0x2c4190
OSVersion: 4
ImageVersion: 1
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.3.7.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Dynamic link library
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
ProductName: Xvid Video Codec
LegalTrademarks: -
FileDescription: -
InternalName: -
CompanyName: Xvid Team
FileVersion: 1.3.7.0
LegalCopyright: Copyright Xvid Team
OriginalFileName: Xvid-1.3.7-windows.exe
Comments: -
ProductVersion: 1.3.7
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
47
Monitored processes
8
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start xvid-1.3.7-20191228.exe rundll32.exe runonce.exe no specs grpconv.exe no specs regsvr32.exe no specs setpriv32.exe setavi32.exe xvid-1.3.7-20191228.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
572"C:\Users\admin\AppData\Local\Temp\Xvid-1.3.7-20191228.exe" C:\Users\admin\AppData\Local\Temp\Xvid-1.3.7-20191228.exe—explorer.exe
User:
admin
Company:
Xvid Team
Integrity Level:
MEDIUM
Exit code:
3221226540
Version:
1.3.7.0
Modules
Images
c:\users\admin\appdata\local\temp\xvid-1.3.7-20191228.exe
c:\windows\system32\ntdll.dll
908C:\Users\admin\AppData\Local\Temp\xvid_x86\SETPRI~1.EXEC:\Users\admin\AppData\Local\Temp\xvid_x86\setpriv32.exe
Xvid-1.3.7-20191228.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Modules
Images
c:\users\admin\appdata\local\temp\xvid_x86\setpriv32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\system32\ntmarta.dll
2204"C:\Users\admin\AppData\Local\Temp\Xvid-1.3.7-20191228.exe" C:\Users\admin\AppData\Local\Temp\Xvid-1.3.7-20191228.exe
explorer.exe
User:
admin
Company:
Xvid Team
Integrity Level:
HIGH
Exit code:
0
Version:
1.3.7.0
Modules
Images
c:\users\admin\appdata\local\temp\xvid-1.3.7-20191228.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
2776"C:\Windows\System32\grpconv.exe" -oC:\Windows\System32\grpconv.exe—runonce.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Progman Group Converter
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\grpconv.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3048C:\Windows\System32\regsvr32.exe /s C:\Windows\system32/xvid.axC:\Windows\System32\regsvr32.exe—Xvid-1.3.7-20191228.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3136"C:\Windows\system32\runonce.exe" -rC:\Windows\System32\runonce.exe—rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Run Once Wrapper
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\runonce.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3416C:\Windows\System32\rundll32.exe setupapi.dll,InstallHinfSection DefaultInstall 0 C:\Users\admin\AppData\Local\Temp/xvid_x86/xvid.infC:\Windows\System32\rundll32.exe
Xvid-1.3.7-20191228.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
3452C:\Users\admin\AppData\Local\Temp\xvid_x86\setavi32.exeC:\Users\admin\AppData\Local\Temp\xvid_x86\setavi32.exe
Xvid-1.3.7-20191228.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Modules
Images
c:\users\admin\appdata\local\temp\xvid_x86\setavi32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\system32\ntmarta.dll
Total events
711
Read events
696
Write events
12
Delete events
3

Modification events

(PID) Process:(2204) Xvid-1.3.7-20191228.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\Environment
Operation:delete valueName:BitRock
Value:
1
(PID) Process:(3136) runonce.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Operation:delete valueName:GrpConv
Value:
grpconv -o
(PID) Process:(3136) runonce.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3136) runonce.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3136) runonce.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3136) runonce.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3416) rundll32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:GlobalAssocChangedCounter
Value:
115
(PID) Process:(2204) Xvid-1.3.7-20191228.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32
Operation:writeName:msacm.l3acm
Value:
C:\Windows\System32\l3codeca.acm
(PID) Process:(2204) Xvid-1.3.7-20191228.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\drivers.desc
Operation:delete valueName:C:\Windows\System32\l3codeca.acm
Value:
Fraunhofer IIS MPEG Layer-3 Codec
(PID) Process:(2204) Xvid-1.3.7-20191228.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectShow\Preferred
Operation:writeName:{44495658-0000-0010-8000-00AA00389B71}
Value:
{2A11BAE2-FE6E-4249-864B-9E9ED6E8DBC2}
Executable files
37
Suspicious files
21
Text files
12
Unknown types
0

Dropped files

PID
Process
Filename
Type
2204Xvid-1.3.7-20191228.exeC:\Users\admin\AppData\Local\Temp\BR3F3C.tmpexecutable
MD5:145D5C49FE34A44662BEAFFE641D58C7
SHA256:59182F092B59A3005ADA6B2F2855C7E860E53E8ADF6E41CD8CD515578AE7815A
2204Xvid-1.3.7-20191228.exeC:\Users\admin\AppData\Local\Temp\BR3995.tmpexecutable
MD5:08AD4CD2A940379F1DCDBDB9884A1375
SHA256:78827E2B1EF0AAD4F8B1B42D0964064819AA22BFCD537EBAACB30D817EDC06D8
2204Xvid-1.3.7-20191228.exeC:\Users\admin\AppData\Local\Temp\BR39C5.tmpexecutable
MD5:4FF365A985DB06A0D705D2149CAFBE69
SHA256:C26277333C29E32837338613BD1B42E722601471FD703DCD30160CF89DAC9DA3
2204Xvid-1.3.7-20191228.exeC:\Users\admin\AppData\Local\Temp\BR3F1B.tmpexecutable
MD5:124E89D0FCC409EDE3595A253B788708
SHA256:27EA1B57A3024AEC4A03188E80FDB2AA301FA5179C19BE9C8B0DFC2AAC73A114
2204Xvid-1.3.7-20191228.exeC:\Users\admin\AppData\Local\Temp\BR3A15.tmpexecutable
MD5:C04970B55BCF614F24CA75B1DE641AE2
SHA256:5DDEE4AAB3CF33E505F52199D64809125B26DE04FB9970CA589CD8619C859D80
2204Xvid-1.3.7-20191228.exeC:\Users\admin\AppData\Local\Temp\BR39D5.tmpexecutable
MD5:027491B39A7B16B116E780F55ABC288E
SHA256:EEF69D005BF1C0B715C8D6205400D4755C261DD38DDFBBFE918E6EE91F21F1F0
2204Xvid-1.3.7-20191228.exeC:\Users\admin\AppData\Local\Temp\BR3EDA.tmpexecutable
MD5:924B90C3D9E645DFAD53F61EA4E91942
SHA256:41788435F245133EC5511111E2C5D52F7515E359876180067E0B5BA85C729322
2204Xvid-1.3.7-20191228.exeC:\Users\admin\AppData\Local\Temp\BR3EC9.tmpexecutable
MD5:B226B75915B944BF20F96ADDFD6E4F87
SHA256:91910BF7A630D272D5389AA6DAFC4E71F32298731B4F44D39B6A0B0D34BD1A3B
2204Xvid-1.3.7-20191228.exeC:\Users\admin\AppData\Local\Temp\BR38B8.tmpexecutable
MD5:D31FA7D86A093997DA6252A984B7B6BD
SHA256:32D6CBFB9433BEDFA29CC46A0B7D2AB0FB6D084E8F2E9A8C55295065BBAD5128
2204Xvid-1.3.7-20191228.exeC:\Users\admin\AppData\Local\Temp\BR3F2C.tmpexecutable
MD5:606F13D4D580B1F322B3F3D3DF423BBA
SHA256:C71A16B1056E522CD0365449448116D06F37A3273D77694D170340064511DD25
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
Process
Message
setpriv32.exe
Successfully changed DACL
setpriv32.exe
Successfully changed DACL
setavi32.exe
Successfully changed DACL
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Xvid-1.3.7-20191228.exe