6f11b2269c38bb075439a4b480f0da8bb3a912e1160e6b4b6d3e0cb8810ec0b6

Analysis

max time kernel
1198s
max time network
1216s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
25-05-2024 18:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Wondershare_Filmora_13.0.60.5095/filmora_64bit_13.0.60_full846.exe
Size

506.8MB
MD5

1c2471a5d46b0aac3ddb2757a72a2b62
SHA1

fb4e1450e506712480ae72c696a381f49e3670e5
SHA256

1467d00b1c386bf826613a42b09ce18664f59076ee78dcfcd010ef0e98bc73e2
SHA512

956ac3186d7356c726f6c76ad42ca673acb40767561f3f868e7837feb853c4645615392ace6e8db6f00f8c49099faf08095bdf66ebe3ad8bef7bd2f3d62a92d0
SSDEEP

12582912:33Ms0X3yYGTI/NNKlA3qBuS4QaT5d2CVd+vh4Z8ph3DS8dYXXmig60F:3crytM/Nsl8uuSs5sCVwvhrzzfYHmig/

Score

4^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

filmora_64bit_13.0.60_full846.tmp

pid process

1856 filmora_64bit_13.0.60_full846.tmp

pid	process
1856	filmora_64bit_13.0.60_full846.tmp

Loads dropped DLL 7 IoCs

Processes:

filmora_64bit_13.0.60_full846.exefilmora_64bit_13.0.60_full846.tmp

pid	process
1824	filmora_64bit_13.0.60_full846.exe
1856	filmora_64bit_13.0.60_full846.tmp
1856	filmora_64bit_13.0.60_full846.tmp
1856	filmora_64bit_13.0.60_full846.tmp
1856	filmora_64bit_13.0.60_full846.tmp
1856	filmora_64bit_13.0.60_full846.tmp
1856	filmora_64bit_13.0.60_full846.tmp

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

filmora_64bit_13.0.60_full846.tmp

pid process

1856 filmora_64bit_13.0.60_full846.tmp

pid	process
1856	filmora_64bit_13.0.60_full846.tmp

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

filmora_64bit_13.0.60_full846.exe

description	pid	process	target process
PID 1824 wrote to memory of 1856	1824	filmora_64bit_13.0.60_full846.exe	filmora_64bit_13.0.60_full846.tmp
PID 1824 wrote to memory of 1856	1824	filmora_64bit_13.0.60_full846.exe	filmora_64bit_13.0.60_full846.tmp
PID 1824 wrote to memory of 1856	1824	filmora_64bit_13.0.60_full846.exe	filmora_64bit_13.0.60_full846.tmp
PID 1824 wrote to memory of 1856	1824	filmora_64bit_13.0.60_full846.exe	filmora_64bit_13.0.60_full846.tmp
PID 1824 wrote to memory of 1856	1824	filmora_64bit_13.0.60_full846.exe	filmora_64bit_13.0.60_full846.tmp
PID 1824 wrote to memory of 1856	1824	filmora_64bit_13.0.60_full846.exe	filmora_64bit_13.0.60_full846.tmp
PID 1824 wrote to memory of 1856	1824	filmora_64bit_13.0.60_full846.exe	filmora_64bit_13.0.60_full846.tmp

C:\Users\Admin\AppData\Local\Temp\Wondershare_Filmora_13.0.60.5095\filmora_64bit_13.0.60_full846.exe
"C:\Users\Admin\AppData\Local\Temp\Wondershare_Filmora_13.0.60.5095\filmora_64bit_13.0.60_full846.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Users\Admin\AppData\Local\Temp\is-NE1SO.tmp\filmora_64bit_13.0.60_full846.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-NE1SO.tmp\filmora_64bit_13.0.60_full846.tmp" /SL5="$40016,529318872,421888,C:\Users\Admin\AppData\Local\Temp\Wondershare_Filmora_13.0.60.5095\filmora_64bit_13.0.60_full846.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1856

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\is-D0JL2.tmp\InstallHelper.dll

Filesize
122KB

MD5
650afaaba451c668629dd01248c81264

SHA1
623f583d82aefae7691afedc077a6684d536a545

SHA256
ec3dd19d446eaf62d396d65029c1c627205bd1fd33608e122be7f4d8af7b5ad4

SHA512
3476bfa801e506ae3c9afd6861519b9a3782e70566ef6df49dc01f605f70fc990a7b59dd8e19b99caa937dbd75bbbfd4246b2e4e6a995e70290cef603c995511

Download Submit
\Users\Admin\AppData\Local\Temp\is-D0JL2.tmp\WSUtilities_Setup.dll

Filesize
202KB

MD5
665603698f4a865a873082309712aae2

SHA1
b3f2c3d1d679181d9c080419b1dfe0563c518c67

SHA256
b42085777505d324d56122f2bd6195ec3a6ce47030a31f9ce6b853c5fa8cd5a8

SHA512
0444b1b63980f9b762e6e01b7cdc4efc2fd6f713887c07d8cf8b20ab2582f611e1c8434f8b59b8ee4fb6dba497c2c1f80fc6e758dc02c07d2964dd6e1f0b6ace

Download Submit
\Users\Admin\AppData\Local\Temp\is-D0JL2.tmp\WS_Log_Setup.dll

Filesize
104KB

MD5
943e0025c5b5c4e0cddb7a9cc7b7d123

SHA1
5dd92f9fa572eac7ebc467d8835c64af77dd37a2

SHA256
43391e665a63b5e9e1288a3c608691f73ece57478e0655363918e8195d85cf81

SHA512
cb42c329e0d5f01a224e4e5b89b4ccc54fefc658d37caea40198f4483e5387f08cbdd0e85af7b0618e6ec72c5e5874098c5946bf749c218978003ad99c5fa852

Download Submit
\Users\Admin\AppData\Local\Temp\is-D0JL2.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-D0JL2.tmp\innocallback.dll

Filesize
63KB

MD5
1c55ae5ef9980e3b1028447da6105c75

SHA1
f85218e10e6aa23b2f5a3ed512895b437e41b45c

SHA256
6afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f

SHA512
1ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b

Download Submit
\Users\Admin\AppData\Local\Temp\is-NE1SO.tmp\filmora_64bit_13.0.60_full846.tmp

Filesize
1.4MB

MD5
3af0b779427bf3f69df82f46d852aff6

SHA1
3d80064d18578f12ce1e98bf985f627cdc29e08e

SHA256
b9cbd40fac892b2660d03f0b0ef2611ba594c6f2b616cd60c6b2d6e718857b71

SHA512
36caf5e6734a1aea11cfe70a85ef7c77e4c2bb10fdbd00e252660fe4768ac6aa1d527a7181c04a8e740ebb185b3f6feab9754b24c3e0e2ad80a1632f47176d30

Download Submit
memory/1824-2-0x0000000000401000-0x0000000000417000-memory.dmp

Filesize
88KB

Download
memory/1824-0-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1824-38-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1856-8-0x0000000000400000-0x000000000056A000-memory.dmp

Filesize
1.4MB

Download
memory/1856-27-0x0000000001FC0000-0x0000000001FD5000-memory.dmp

Filesize
84KB

Download
memory/1856-39-0x0000000000400000-0x000000000056A000-memory.dmp

Filesize
1.4MB

Download
memory/1856-40-0x0000000001FC0000-0x0000000001FD5000-memory.dmp

Filesize
84KB

Download