555c80afd45bc9a558a2af29044745fdb84a3c00900d6d47e5725971f260a006

Analysis

max time kernel
86s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2023, 17:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

filmora_setup_full7598.exe
Size

1.9MB
MD5

13dd51bc806ab1f1bde9484fc7fd6fef
SHA1

2e925afc31308a787cbe6691366675429ad597bf
SHA256

555c80afd45bc9a558a2af29044745fdb84a3c00900d6d47e5725971f260a006
SHA512

5238caede25c98a7a2b97f60728d6c5dc7fd1d2a4f049575a7bf204ccd4e941af6f9cb1f185e5e2421986cd4a947e5fbe55795dcd425ac9bc89fb665ea3a84db
SSDEEP

49152:ziDGQapGSAT03UF3+oSSzG/fvPrvfsTiY2o+NTZ7pKD:ziDGQrkkVNovPjw2o+Ng

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2988	NFWCHK.exe

Modifies Control Panel 1 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\Desktop\MuiCached	filmora_setup_full7598.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2680	filmora_setup_full7598.exe
2680	filmora_setup_full7598.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 2988	2680	filmora_setup_full7598.exe	83
PID 2680 wrote to memory of 2988	2680	filmora_setup_full7598.exe	83

C:\Users\Admin\AppData\Local\Temp\filmora_setup_full7598.exe
"C:\Users\Admin\AppData\Local\Temp\filmora_setup_full7598.exe"
1⤵
- Modifies Control Panel
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Users\Public\Documents\Wondershare\NFWCHK.exe
  C:\Users\Public\Documents\Wondershare\NFWCHK.exe
  2⤵
  - Executes dropped EXE
  PID:2988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Wondershare\WAE\wsWAE.log

Filesize
504B

MD5
d53e62a83673539f7ba98f474d60baff

SHA1
1f18a390993ed4cb496a0675467b3d4a7ffc30ad

SHA256
07c6181dfcd530a99f4c9d617ca8da1390d25072b7060f229bfca792c082888e

SHA512
98968bd2800a2ba205ec7d19132657e7ba7c516a636a2d5ae7e64f1ce8272c17d88bc09e9499427810fef75e0abe6ce63f090f8930904ec9780d90e64ddf6595

Download Submit
C:\Users\Admin\AppData\Local\Temp\wsduilib.log

Filesize
7KB

MD5
2c02b510401b2bb9c7dc7154502a088b

SHA1
de61ce96fbe2699a72cc1bfae6bb55aad556c0f1

SHA256
8725c2ea5cc38e79178151c46a7732455fd7c9133228989169c259115def111b

SHA512
b4e3b242596028e791bb3f332953ce9a321edad7cd23eb531df89dd415eada1498e331470d2ebe5ab51174532f8dd12b14a3d9e54397d5daab52d4e90864efc6

Download Submit
C:\Users\Admin\AppData\Local\Temp\wsduilib.log

Filesize
8KB

MD5
59dcb722ed91b8a6c0d2eebe5c7b2944

SHA1
5177622dfb24c1d8f7be3aa9bf1b6cfb0f617185

SHA256
75e5e34191160185a3f7c28dac87dfa6bc4dcc4f4c233556125486e6fcc21e9e

SHA512
12e0a5461d95fe53c92623e52cbb0f6d4165a8cf6b1fda5ce9ef8ce2183fd7555b77056e251e095abc44886a688060de0c7c530006d556ef31e6126998186145

Download Submit
C:\Users\Public\Documents\Wondershare\NFWCHK.exe

Filesize
7KB

MD5
27cfb3990872caa5930fa69d57aefe7b

SHA1
5e1c80d61e8db0cdc0c9b9fa3b2e36d156d45f8f

SHA256
43881549228975c7506b050bce4d9b671412d3cdc08c7516c9dbbb7f50c25146

SHA512
a1509024872c99c1cf63f42d9f3c5f063afde4e9490c21611551ddd2322d136ce9240256113c525305346cf7b66ccca84c3df67637c8fecbfeebf14ffa373a2a

Download Submit
C:\Users\Public\Documents\Wondershare\NFWCHK.exe

Filesize
7KB

MD5
27cfb3990872caa5930fa69d57aefe7b

SHA1
5e1c80d61e8db0cdc0c9b9fa3b2e36d156d45f8f

SHA256
43881549228975c7506b050bce4d9b671412d3cdc08c7516c9dbbb7f50c25146

SHA512
a1509024872c99c1cf63f42d9f3c5f063afde4e9490c21611551ddd2322d136ce9240256113c525305346cf7b66ccca84c3df67637c8fecbfeebf14ffa373a2a

Download Submit
C:\Users\Public\Documents\Wondershare\NFWCHK.exe.config

Filesize
229B

MD5
ad0967a0ab95aa7d71b3dc92b71b8f7a

SHA1
ed63f517e32094c07a2c5b664ed1cab412233ab5

SHA256
9c1212bc648a2533b53a2d0afcec518846d97630afb013742a9622f0df7b04fc

SHA512
85766a907331f60044ec205cf345453fc3d44bfcac296ac93a12e8a752b84290dfd94f73b71de82f46f9503177d29602cbb87549f89dc61373d889b4ea26634b

Download Submit
memory/2988-1251-0x00000000011E0000-0x00000000011F8000-memory.dmp

Filesize
96KB

Download
memory/2988-1250-0x0000000001190000-0x00000000011B4000-memory.dmp

Filesize
144KB

Download
memory/2988-1249-0x00000000008A0000-0x00000000008A8000-memory.dmp

Filesize
32KB

Download
memory/2988-1253-0x000000001C130000-0x000000001C150000-memory.dmp

Filesize
128KB

Download
memory/2988-1252-0x0000000001200000-0x0000000001210000-memory.dmp

Filesize
64KB

Download
memory/2988-1254-0x000000001C150000-0x000000001C45E000-memory.dmp

Filesize
3.1MB

Download
memory/2988-1255-0x000000001C910000-0x000000001C959000-memory.dmp

Filesize
292KB

Download
memory/2988-1256-0x000000001C9D0000-0x000000001CA32000-memory.dmp

Filesize
392KB

Download
memory/2988-1257-0x000000001CF10000-0x000000001D3DE000-memory.dmp

Filesize
4.8MB

Download
memory/2988-1258-0x000000001D480000-0x000000001D51C000-memory.dmp

Filesize
624KB

Download
memory/2988-1259-0x000000001C8A0000-0x000000001C8A8000-memory.dmp

Filesize
32KB

Download
memory/2988-1260-0x000000001D860000-0x000000001D89E000-memory.dmp

Filesize
248KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads