31dbb4810e4554d169f9eedd9a6da08fc9f23bfcf96cae2eceae6e50f0982493

Analysis

max time kernel
142s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 22:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

filmora_setup_full846.exe
Size

1014KB
MD5

141420196cc69853bcb5c612c63c15a9
SHA1

fbfc92421709259704f5da19eaa5bf7efb5ae05b
SHA256

31dbb4810e4554d169f9eedd9a6da08fc9f23bfcf96cae2eceae6e50f0982493
SHA512

24436cbbd8113cc9f3ab8e0a4b898ba1b7552a2525387da54a42116ecbf8cfd84936d74f28f7858ff6b787175e1cb54f990d463bc52118d6eda484816fbeebb3
SSDEEP

12288:VMRfauvtHMxljmQ5rX+XbKNDkSzemWlWYwU0fClaLMDQPUtfvHB1+j4:gEmQ5ubKNDkSzem9Yw0WVUFvv+8

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	filmora_setup_full846.exe

Executes dropped EXE 1 IoCs

pid	Process
1080	NFWCHK.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
208	filmora_setup_full846.exe
208	filmora_setup_full846.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 208 wrote to memory of 1080	208	filmora_setup_full846.exe	86
PID 208 wrote to memory of 1080	208	filmora_setup_full846.exe	86

C:\Users\Admin\AppData\Local\Temp\filmora_setup_full846.exe
"C:\Users\Admin\AppData\Local\Temp\filmora_setup_full846.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:208
- C:\Users\Public\Documents\Wondershare\NFWCHK.exe
  C:\Users\Public\Documents\Wondershare\NFWCHK.exe
  2⤵
  - Executes dropped EXE
  PID:1080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Documents\Wondershare\NFWCHK.exe

Filesize
7KB

MD5
27cfb3990872caa5930fa69d57aefe7b

SHA1
5e1c80d61e8db0cdc0c9b9fa3b2e36d156d45f8f

SHA256
43881549228975c7506b050bce4d9b671412d3cdc08c7516c9dbbb7f50c25146

SHA512
a1509024872c99c1cf63f42d9f3c5f063afde4e9490c21611551ddd2322d136ce9240256113c525305346cf7b66ccca84c3df67637c8fecbfeebf14ffa373a2a

Download Submit
C:\Users\Public\Documents\Wondershare\NFWCHK.exe

Filesize
7KB

MD5
27cfb3990872caa5930fa69d57aefe7b

SHA1
5e1c80d61e8db0cdc0c9b9fa3b2e36d156d45f8f

SHA256
43881549228975c7506b050bce4d9b671412d3cdc08c7516c9dbbb7f50c25146

SHA512
a1509024872c99c1cf63f42d9f3c5f063afde4e9490c21611551ddd2322d136ce9240256113c525305346cf7b66ccca84c3df67637c8fecbfeebf14ffa373a2a

Download Submit
C:\Users\Public\Documents\Wondershare\NFWCHK.exe.config

Filesize
229B

MD5
ad0967a0ab95aa7d71b3dc92b71b8f7a

SHA1
ed63f517e32094c07a2c5b664ed1cab412233ab5

SHA256
9c1212bc648a2533b53a2d0afcec518846d97630afb013742a9622f0df7b04fc

SHA512
85766a907331f60044ec205cf345453fc3d44bfcac296ac93a12e8a752b84290dfd94f73b71de82f46f9503177d29602cbb87549f89dc61373d889b4ea26634b

Download Submit
memory/1080-6-0x00007FFD20DC0000-0x00007FFD21761000-memory.dmp

Filesize
9.6MB

Download
memory/1080-7-0x00007FFD20DC0000-0x00007FFD21761000-memory.dmp

Filesize
9.6MB

Download
memory/1080-8-0x00000000016C0000-0x00000000016D0000-memory.dmp

Filesize
64KB

Download
memory/1080-9-0x000000001BD20000-0x000000001BD44000-memory.dmp

Filesize
144KB

Download
memory/1080-10-0x000000001BD70000-0x000000001BD88000-memory.dmp

Filesize
96KB

Download
memory/1080-11-0x000000001BDB0000-0x000000001BDD0000-memory.dmp

Filesize
128KB

Download
memory/1080-12-0x000000001BDD0000-0x000000001C0DE000-memory.dmp

Filesize
3.1MB

Download
memory/1080-13-0x000000001C590000-0x000000001C5D9000-memory.dmp

Filesize
292KB

Download
memory/1080-14-0x000000001C650000-0x000000001C6B2000-memory.dmp

Filesize
392KB

Download
memory/1080-15-0x000000001CB90000-0x000000001D05E000-memory.dmp

Filesize
4.8MB

Download
memory/1080-16-0x000000001D100000-0x000000001D19C000-memory.dmp

Filesize
624KB

Download
memory/1080-17-0x000000001C520000-0x000000001C528000-memory.dmp

Filesize
32KB

Download
memory/1080-18-0x000000001D5D0000-0x000000001D60E000-memory.dmp

Filesize
248KB

Download
memory/1080-20-0x00007FFD20DC0000-0x00007FFD21761000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads