General
-
Target
filmora_64bit_full846.exe
-
Size
444.6MB
-
Sample
221204-s69n5acf38
-
MD5
d0c1fd8374b9241906c3201f91eb7b35
-
SHA1
53ab7408b83d5163b70c4e792009a7a3b16b5cf1
-
SHA256
8d0ce60fb79cf6d404332ab17ba16ee54dd0c5c046c8e6b09424eea23223b534
-
SHA512
8a33d642e2edd3cf562f17429d0ba630e7368e1a2b294bde3a1f9529ecf45b980a5f8455187cfadcc0b3c2647316d18a58c9de1dc7eba422a675cb2e38953fba
-
SSDEEP
6291456:r+doXbLh28WlhAwUU+QrMRKBJdIQz8eMxtLwZsRTpqSNN2nL7iHMfZLfHnWs/u+h:uoNWA3ULHuoQ0WTV40Mt//zB0S
Static task
static1
Behavioral task
behavioral1
Sample
filmora_64bit_full846.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
filmora_64bit_full846.exe
Resource
win10v2004-20220812-en
Malware Config
Targets
-
-
Target
filmora_64bit_full846.exe
-
Size
444.6MB
-
MD5
d0c1fd8374b9241906c3201f91eb7b35
-
SHA1
53ab7408b83d5163b70c4e792009a7a3b16b5cf1
-
SHA256
8d0ce60fb79cf6d404332ab17ba16ee54dd0c5c046c8e6b09424eea23223b534
-
SHA512
8a33d642e2edd3cf562f17429d0ba630e7368e1a2b294bde3a1f9529ecf45b980a5f8455187cfadcc0b3c2647316d18a58c9de1dc7eba422a675cb2e38953fba
-
SSDEEP
6291456:r+doXbLh28WlhAwUU+QrMRKBJdIQz8eMxtLwZsRTpqSNN2nL7iHMfZLfHnWs/u+h:uoNWA3ULHuoQ0WTV40Mt//zB0S
Score9/10-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Executes dropped EXE
-
Modifies Installed Components in the registry
-
Registers COM server for autorun
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in System32 directory
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-