Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
01-09-2024 23:06
Static task
static1
Behavioral task
behavioral1
Sample
MovaviVideoConverterSetupC_W8fbkfk_.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
MovaviVideoConverterSetupC_W8fbkfk_.exe
Resource
win10v2004-20240802-en
General
-
Target
MovaviVideoConverterSetupC_W8fbkfk_.exe
-
Size
5.0MB
-
MD5
c8d53fe5ad2dc573ba45daf8956b33bf
-
SHA1
56d3c06aca68be0ae379e790f0ce32186da9e2cf
-
SHA256
e494e421470fd9fc68fc842c3bf6d6b27bf86ca033217659eb4dd9596498926a
-
SHA512
a746f84efb524818246b2504568e575c724ff364824ba1c6e801007c062e9b3824d5e537d1e3580af7c2751010d7c41365c606f1b3fc198dd0111b3a62e88062
-
SSDEEP
98304:gqsDtGsBPiybKXjynAz39exNbSPaE1z8aQ2VfZ9LqgQoq:gqTs1iybKm0ENWP1w7U92gxq
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2844 installer.exe -
Loads dropped DLL 44 IoCs
pid Process 2168 MovaviVideoConverterSetupC_W8fbkfk_.exe 2844 installer.exe 2844 installer.exe 2844 installer.exe 2844 installer.exe 2844 installer.exe 2844 installer.exe 2844 installer.exe 2844 installer.exe 2844 installer.exe 2844 installer.exe 2844 installer.exe 2844 installer.exe 2844 installer.exe 2844 installer.exe 2844 installer.exe 2844 installer.exe 2844 installer.exe 2844 installer.exe 2844 installer.exe 2844 installer.exe 2844 installer.exe 2844 installer.exe 2844 installer.exe 2844 installer.exe 2844 installer.exe 2844 installer.exe 2844 installer.exe 2844 installer.exe 2844 installer.exe 2844 installer.exe 2844 installer.exe 2844 installer.exe 2844 installer.exe 2844 installer.exe 2844 installer.exe 2844 installer.exe 1620 WerFault.exe 1620 WerFault.exe 1620 WerFault.exe 1620 WerFault.exe 1620 WerFault.exe 1620 WerFault.exe 1620 WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2168 wrote to memory of 2844 2168 MovaviVideoConverterSetupC_W8fbkfk_.exe 31 PID 2168 wrote to memory of 2844 2168 MovaviVideoConverterSetupC_W8fbkfk_.exe 31 PID 2168 wrote to memory of 2844 2168 MovaviVideoConverterSetupC_W8fbkfk_.exe 31 PID 2844 wrote to memory of 1620 2844 installer.exe 32 PID 2844 wrote to memory of 1620 2844 installer.exe 32 PID 2844 wrote to memory of 1620 2844 installer.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\MovaviVideoConverterSetupC_W8fbkfk_.exe"C:\Users\Admin\AppData\Local\Temp\MovaviVideoConverterSetupC_W8fbkfk_.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\Movavi-installer-26161204-0aa5-4c8d-8bee-f390a7dced8b\installer.exeC:\Users\Admin\AppData\Local\Temp\Movavi-installer-26161204-0aa5-4c8d-8bee-f390a7dced8b\installer.exe "--distrib-name=C:\Users\Admin\AppData\Local\Temp\MovaviVideoConverterSetupC_W8fbkfk_.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2844 -s 2003⤵
- Loads dropped DLL
PID:1620
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Movavi-installer-26161204-0aa5-4c8d-8bee-f390a7dced8b\FndAppLocations.dll
Filesize39KB
MD5714c281d735775db48971b44c5d0ee2b
SHA1a50343cdb2091a942225a8bbe8e3bbbfcee8675d
SHA2560ad5b1125068dda35e178213a9d2b428e4540ddbc4cfeab7f27c44b31e93071c
SHA51298e7e102b09890da11296e3f7d322cded0face56fd5877192b149722354cc5214c32e2b14f1c9a98c00de1a86bc19dedeca4dc2a187df9b0fb63bb1f2effd73c
-
C:\Users\Admin\AppData\Local\Temp\Movavi-installer-26161204-0aa5-4c8d-8bee-f390a7dced8b\FndCrashHandler.dll
Filesize679KB
MD5d47fefae63f4e057e9133c9f73d06f09
SHA1b9b22078868ad76c736b38d91e725e260096a591
SHA25620643e31bfd7013c463886fc16e834ad00bd17274e6d6844efb195488b52e90b
SHA512a823b0f85dd0208e170376a4c58b5c563b29e081ca6aa37f88e324f624b2ce3a180a3081170a3ec288c5beb7c80e090e20ae1934459cf0ac0c0fb789c9c28bcb
-
C:\Users\Admin\AppData\Local\Temp\Movavi-installer-26161204-0aa5-4c8d-8bee-f390a7dced8b\FndFilesystem.dll
Filesize289KB
MD5aaf5a3eb8d4b9f0bf8f5c32b4ed2a2af
SHA1fced5431476f3dd6cb18a1e02ccf2a1855e89672
SHA256a0cff41f6fd7e5b104538b76ee41087e88c02745c6a0365e3d1ba3dc36f75403
SHA5129ff1f5939d4fc766481a9a53ccf31645e12badca6b9b365487c50d04fd9b7e458ad619165dfb16a02bc730a5ec9e5ddb5067d3e4154acebfa586af4a38e06277
-
Filesize
90KB
MD5d76fabe5f54211a08542f91614042e54
SHA145d49266d254ce57154c01fa0a32d5926d536238
SHA25679d65304dcc5b217012d93b57666402a9dd90f4246d3cc307f2457ba198b1847
SHA51226703c21ec0607b7e0a838a4c0fc129f5f323dad857d97fa282d18cfad6cbbe189535ec3201f9f19c0e2b185de0f19e9344f896629ca5be3717049862ba23014
-
C:\Users\Admin\AppData\Local\Temp\Movavi-installer-26161204-0aa5-4c8d-8bee-f390a7dced8b\FndPointer.dll
Filesize24KB
MD52d180f2de924ece89b15cfe51285fa09
SHA191168137d7be26f4953946b62027f49002cdbc87
SHA2569d75a0d11d2893e0665354c4d38d58bf2288dc97734895e6b1971da5114958bb
SHA512f7e057c244823a936bff292af678930b0ae0d743e9c51209373a456436a5b39e065659f242be8603077cc31a022c28cbf05d472db10a608cc213c238ea8a417b
-
C:\Users\Admin\AppData\Local\Temp\Movavi-installer-26161204-0aa5-4c8d-8bee-f390a7dced8b\MSVCP140.dll
Filesize552KB
MD529c6c243cfb1cec96b4a1008274f9600
SHA1c54b10ef6305cc3814c68e6c8fd6daecbb27622a
SHA25644a5af24f8d5f9c50a9e5a200a0486100afb6a0e86377e2e3e622a7bbb57cb04
SHA51239c34554ea7b6d433c2aecfdeff87959e625e943bf7a446ebca8e5878eaf24198c1b188359a0343fb78478f2bc8b986ca4d0e69d39bac6ff80cb901fe4f113ee
-
C:\Users\Admin\AppData\Local\Temp\Movavi-installer-26161204-0aa5-4c8d-8bee-f390a7dced8b\VCRUNTIME140.dll
Filesize94KB
MD502794a29811ba0a78e9687a0010c37ce
SHA197b5701d18bd5e25537851614099e2ffce25d6d8
SHA2561729421a22585823493d5a125cd43a470889b952a2422f48a7bc8193f5c23b0f
SHA512caf2a478e9c78c8e93dd2288ed98a9261fcf2b7e807df84f2e4d76f8130c2e503eb2470c947a678ac63e59d7d54f74e80e743d635428aa874ec2d06df68d0272
-
Filesize
3.5MB
MD54291af0f96592aa83c16a3b6d39d9ab3
SHA1d4fbd74bc8458eafdeb43f7f986cc957b72efc8a
SHA256465dec58e18c48f8db2fb49914af48f38feba428484467fd699b7f9ae7761c36
SHA5124ddbf42a1884e46870bc551adedcf7eaf1fe65ffd07aed9eb8876a39422ef4130e5f8c00e415b18baf00884c0569b2882c91c0c7576a3318d6abf81e7263bdc5
-
C:\Users\Admin\AppData\Local\Temp\Movavi-installer-26161204-0aa5-4c8d-8bee-f390a7dced8b\api-ms-win-core-processthreads-l1-1-1.dll
Filesize11KB
MD57e8b61d27a9d04e28d4dae0bfa0902ed
SHA1861a7b31022915f26fb49c79ac357c65782c9f4b
SHA2561ef06c600c451e66e744b2ca356b7f4b7b88ba2f52ec7795858d21525848ac8c
SHA5121c5b35026937b45beb76cb8d79334a306342c57a8e36cc15d633458582fc8f7d9ab70ace7a92144288c6c017f33ecfc20477a04432619b40a21c9cda8d249f6d
-
C:\Users\Admin\AppData\Local\Temp\Movavi-installer-26161204-0aa5-4c8d-8bee-f390a7dced8b\api-ms-win-crt-environment-l1-1-0.dll
Filesize11KB
MD57a859e91fdcf78a584ac93aa85371bc9
SHA11fa9d9cad7cc26808e697373c1f5f32aaf59d6b7
SHA256b7ee468f5b6c650dada7db3ad9e115a0e97135b3df095c3220dfd22ba277b607
SHA512a368f21eca765afca86e03d59cf953500770f4a5bff8b86b2ac53f1b5174c627e061ce9a1f781dc56506774e0d0b09725e9698d4dc2d3a59e93da7ef3d900887
-
C:\Users\Admin\AppData\Local\Temp\Movavi-installer-26161204-0aa5-4c8d-8bee-f390a7dced8b\api-ms-win-crt-locale-l1-1-0.dll
Filesize11KB
MD5dd8176e132eedea3322443046ac35ca2
SHA1d13587c7cc52b2c6fbcaa548c8ed2c771a260769
SHA2562eb96422375f1a7b687115b132a4005d2e7d3d5dc091fb0eb22a6471e712848e
SHA51277cb8c44c8cc8dd29997fba4424407579ac91176482db3cf7bc37e1f9f6aa4c4f5ba14862d2f3a9c05d1fdd7ca5a043b5f566bd0e9a9e1ed837da9c11803b253
-
C:\Users\Admin\AppData\Local\Temp\Movavi-installer-26161204-0aa5-4c8d-8bee-f390a7dced8b\api-ms-win-crt-math-l1-1-0.dll
Filesize20KB
MD5a6a3d6d11d623e16866f38185853facd
SHA1fbeadd1e9016908ecce5753de1d435d6fcf3d0b5
SHA256a768339f0b03674735404248a039ec8591fcba6ff61a3c6812414537badd23b0
SHA512abbf32ceb35e5ec6c1562f9f3b2652b96b7dbd97bfc08d918f987c0ec0503e8390dd697476b2a2389f0172cd8cf16029fd2ec5f32a9ba3688bf2ebeefb081b2c
-
C:\Users\Admin\AppData\Local\Temp\Movavi-installer-26161204-0aa5-4c8d-8bee-f390a7dced8b\api-ms-win-crt-runtime-l1-1-0.dll
Filesize15KB
MD5f1a23c251fcbb7041496352ec9bcffbe
SHA1be4a00642ec82465bc7b3d0cc07d4e8df72094e8
SHA256d899c2f061952b3b97ab9cdbca2450290b0f005909ddd243ed0f4c511d32c198
SHA51231f8c5cd3b6e153073e2e2edf0ca8072d0f787784f1611a57219349c1d57d6798a3adbd6942b0f16cef781634dd8691a5ec0b506df21b24cb70aee5523a03fd9
-
C:\Users\Admin\AppData\Local\Temp\Movavi-installer-26161204-0aa5-4c8d-8bee-f390a7dced8b\api-ms-win-crt-stdio-l1-1-0.dll
Filesize17KB
MD555b2eb7f17f82b2096e94bca9d2db901
SHA144d85f1b1134ee7a609165e9c142188c0f0b17e0
SHA256f9d3f380023a4c45e74170fe69b32bca506ee1e1fbe670d965d5b50c616da0cb
SHA5120cf0770f5965a83f546253decfa967d8f85c340b5f6ea220d3caa14245f3cdb37c53bf8d3da6c35297b22a3fa88e7621202634f6b3649d7d9c166a221d3456a5
-
C:\Users\Admin\AppData\Local\Temp\Movavi-installer-26161204-0aa5-4c8d-8bee-f390a7dced8b\api-ms-win-crt-string-l1-1-0.dll
Filesize17KB
MD59b79965f06fd756a5efde11e8d373108
SHA13b9de8bf6b912f19f7742ad34a875cbe2b5ffa50
SHA2561a916c0db285deb02c0b9df4d08dad5ea95700a6a812ea067bd637a91101a9f6
SHA5127d4155c00d65c3554e90575178a80d20dc7c80d543c4b5c4c3f508f0811482515638fe513e291b82f958b4d7a63c9876be4e368557b07ff062961197ed4286fb
-
C:\Users\Admin\AppData\Local\Temp\Movavi-installer-26161204-0aa5-4c8d-8bee-f390a7dced8b\api-ms-win-crt-time-l1-1-0.dll
Filesize13KB
MD51d48a3189a55b632798f0e859628b0fb
SHA161569a8e4f37adc353986d83efc90dc043cdc673
SHA256b56bc94e8539603dd2f0fea2f25efd17966315067442507db4bffafcbc2955b0
SHA51247f329102b703bfbb1ebaeb5203d1c8404a0c912019193c93d150a95bb0c5ba8dc101ac56d3283285f9f91239fc64a66a5357afe428a919b0be7194bada1f64f
-
Filesize
135KB
MD590566194f4a5c5ee360f31f1942e673b
SHA160fe9840941831eef262c7688eb9ffad85d35eb8
SHA25682e29b2226cdf681b198046eb555bc4c64a66f4ce7f1abd54937d2f1d7245b76
SHA5122c1cb31f16a33f71c7926981c8b4439934b35788d1475c08ef94e56e51be02f8bcc31447a1cc0559f98419b97ba8d4beccad3dc048ef8155c702622b84640994
-
Filesize
179KB
MD5df35e832d29aafd33e7d540133bb51e4
SHA1b0b1436b4e6dc3c0a828fda5d994fd4d5820b547
SHA256aa86005c5530712db8a91612f8d247806106ebfb77cad1758c47e41a20b7f943
SHA512b0fafa4289a8bf8d51b69c57533b4af62b20b40c07712e32aeb984016a335bde4aee451a9a96b30c369c2d7655908764afd78e873dd34e8bdb37c956c9ee51b4
-
Filesize
43KB
MD505a071fe19649da585a5376412f190a4
SHA1fd8c48b6a2eb2cbfc29ebfcf1d2425537dd7d864
SHA25632007a1946001967115c04e381dd8e48ba58dc60c57f038083fedbcccfda8465
SHA51272de491a940465a922a5c929409fb451c2cd571b2e346cdb0aa60c0a2d55096e0a415e0fcd3198096be1db26a08668ed8709a08582f972d85be8e1ce2eb4bba5
-
\Users\Admin\AppData\Local\Temp\Movavi-installer-26161204-0aa5-4c8d-8bee-f390a7dced8b\api-ms-win-core-file-l1-2-0.dll
Filesize11KB
MD55a72a803df2b425d5aaff21f0f064011
SHA14b31963d981c07a7ab2a0d1a706067c539c55ec5
SHA256629e52ba4e2dca91b10ef7729a1722888e01284eed7dda6030d0a1ec46c94086
SHA512bf44997c405c2ba80100eb0f2ff7304938fc69e4d7ae3eac52b3c236c3188e80c9f18bda226b5f4fde0112320e74c198ad985f9ffd7cea99aca22980c39c7f69
-
\Users\Admin\AppData\Local\Temp\Movavi-installer-26161204-0aa5-4c8d-8bee-f390a7dced8b\api-ms-win-core-file-l2-1-0.dll
Filesize11KB
MD5721b60b85094851c06d572f0bd5d88cd
SHA14d0ee4d717aeb9c35da8621a545d3e2b9f19b4e7
SHA256dac867476caa42ff8df8f5dfe869ffd56a18dadee17d47889afb69ed6519afbf
SHA512430a91fcecde4c8cc4ac7eb9b4c6619243ab244ee88c34c9e93ca918e54bd42b08aca8ea4475d4c0f5fa95241e4aacb3206cbae863e92d15528c8e7c9f45601b
-
\Users\Admin\AppData\Local\Temp\Movavi-installer-26161204-0aa5-4c8d-8bee-f390a7dced8b\api-ms-win-core-localization-l1-2-0.dll
Filesize14KB
MD51ed0b196ab58edb58fcf84e1739c63ce
SHA1ac7d6c77629bdee1df7e380cc9559e09d51d75b7
SHA2568664222823e122fca724620fd8b72187fc5336c737d891d3cef85f4f533b8de2
SHA512e1fa7f14f39c97aaa3104f3e13098626b5f7cfd665ba52dcb2312a329639aaf5083a9177e4686d11c4213e28acc40e2c027988074b6cc13c5016d5c5e9ef897b
-
\Users\Admin\AppData\Local\Temp\Movavi-installer-26161204-0aa5-4c8d-8bee-f390a7dced8b\api-ms-win-core-synch-l1-2-0.dll
Filesize11KB
MD5e86cfc5e1147c25972a5eefed7be989f
SHA10075091c0b1f2809393c5b8b5921586bdd389b29
SHA25672c639d1afda32a65143bcbe016fe5d8b46d17924f5f5190eb04efe954c1199a
SHA512ea58a8d5aa587b7f5bde74b4d394921902412617100ed161a7e0bef6b3c91c5dae657065ea7805a152dd76992997017e070f5415ef120812b0d61a401aa8c110
-
\Users\Admin\AppData\Local\Temp\Movavi-installer-26161204-0aa5-4c8d-8bee-f390a7dced8b\api-ms-win-core-timezone-l1-1-0.dll
Filesize11KB
MD591a2ae3c4eb79cf748e15a58108409ad
SHA1d402b9df99723ea26a141bfc640d78eaf0b0111b
SHA256b0eda99eabd32fefecc478fd9fe7439a3f646a864fdab4ec3c1f18574b5f8b34
SHA5128527af610c1e2101b6f336a142b1a85ac9c19bb3af4ad4a245cfb6fd602dc185da0f7803358067099475102f3a8f10a834dc75b56d3e6ded2ed833c00ad217ed
-
\Users\Admin\AppData\Local\Temp\Movavi-installer-26161204-0aa5-4c8d-8bee-f390a7dced8b\api-ms-win-crt-convert-l1-1-0.dll
Filesize15KB
MD54ec4790281017e616af632da1dc624e1
SHA1342b15c5d3e34ab4ac0b9904b95d0d5b074447b7
SHA2565cf5bbb861608131b5f560cbf34a3292c80886b7c75357acc779e0bf98e16639
SHA51280c4e20d37eff29c7577b2d0ed67539a9c2c228edb48ab05d72648a6ed38f5ff537715c130342beb0e3ef16eb11179b9b484303354a026bda3a86d5414d24e69
-
\Users\Admin\AppData\Local\Temp\Movavi-installer-26161204-0aa5-4c8d-8bee-f390a7dced8b\api-ms-win-crt-filesystem-l1-1-0.dll
Filesize13KB
MD5972544ade7e32bfdeb28b39bc734cdee
SHA187816f4afabbdec0ec2cfeb417748398505c5aa9
SHA2567102f8d9d0f3f689129d7fe071b234077fba4dd3687071d1e2aeaa137b123f86
SHA5125e1131b405e0c7a255b1c51073aff99e2d5c0d28fd3e55cabc04d463758a575a954008ea1ba5b4e2b345b49af448b93ad21dfc4a01573b3cb6e7256d9ecceef1
-
\Users\Admin\AppData\Local\Temp\Movavi-installer-26161204-0aa5-4c8d-8bee-f390a7dced8b\api-ms-win-crt-heap-l1-1-0.dll
Filesize12KB
MD58906279245f7385b189a6b0b67df2d7c
SHA1fcf03d9043a2daafe8e28dee0b130513677227e4
SHA256f5183b8d7462c01031992267fe85680ab9c5b279bedc0b25ab219f7c2184766f
SHA51267cac89ae58cc715976107f3bdf279b1e78945afd07e6f657e076d78e92ee1a98e3e7b8feae295af5ce35e00c804f3f53a890895badb1eed32377d85c21672b9
-
\Users\Admin\AppData\Local\Temp\Movavi-installer-26161204-0aa5-4c8d-8bee-f390a7dced8b\api-ms-win-crt-utility-l1-1-0.dll
Filesize11KB
MD5dbc27d384679916ba76316fb5e972ea6
SHA1fb9f021f2220c852f6ff4ea94e8577368f0616a4
SHA256dd14133adf5c534539298422f6c4b52739f80aca8c5a85ca8c966dea9964ceb1
SHA512cc0d8c56749ccb9d007b6d3f5c4a8f1d4e368bb81446ebcd7cc7b40399bbd56d0acaba588ca172ecb7472a8cbddbd4c366ffa38094a832f6d7e343b813ba565e
-
\Users\Admin\AppData\Local\Temp\Movavi-installer-26161204-0aa5-4c8d-8bee-f390a7dced8b\boost_filesystem-mt-x64.dll
Filesize149KB
MD5ba22aa95ff577c57ddbb3d70b55161fd
SHA1ed30f95f8eb6f98e80a1dfa2ac1e2ab6048b6e28
SHA2566c0acecd9b02cd2fd3f3fc1b51ab6ed3e7d3150c85b92654de21f8363426cff9
SHA51227d7b608b9bc8b5cd85ced0530d326e29b2ec8cdc5a3854dd831bf7b01af0b5fec290bb2d0cbc6f84ecd70dc1784bd2082e7cfa57ff890244c89ef307a48731c
-
Filesize
4.3MB
MD5431c375d80e1c102463bf9a3410c75e7
SHA149dbc500791a351879e9d602327699ea58978456
SHA256852d1f3d3525e1cf3ff795454d1ffb4613284ee0def2aecb96983cdbaabae3ee
SHA5121a6d25ec1594249ea1a2219beb8f77d7994467d6184e0217a8599687ab8a2a1f797a643fa204328d64694f532cd9e59db1af504cf43a84f2168272476f85d33a
-
Filesize
1011KB
MD5849959a003fa63c5a42ae87929fcd18b
SHA1d1b80b3265e31a2b5d8d7da6183146bbd5fb791b
SHA2566238cbfe9f57c142b75e153c399c478d492252fda8cb40ee539c2dcb0f2eb232
SHA51264958dabdb94d21b59254c2f074db5d51e914ddbc8437452115dff369b0c134e50462c3fdbbc14b6fa809a6ee19ab2fb83d654061601cc175cddcb7d74778e09
-
\Users\Admin\AppData\Local\Temp\Movavi-installer-26161204-0aa5-4c8d-8bee-f390a7dced8b\vcruntime140_1.dll
Filesize36KB
MD5d8d1a08176ba2542c58669c1c04da1b7
SHA1e0d0059baf23fb5e1d2dadedc12e2f53c930256d
SHA25626c29d01df73a8e35d32e430c892d925abb6e4ad62d3630ae42b69daacba1a0d
SHA5125308790fbcf6348e87e7d5b9235ed66942527326f7ba556c910d68d94617bdd247a4ed540b4b9f8d4e73d15cf4a7204c0a57d4fd348ec26e53f39b91be8617fb