efb17008e2b9c7fba95699a7c98db92f7fe5d51e3c74e9cd02b68c6b29bbb84b

Resubmissions

15/07/2026, 05:17

260715-fyzsqsct8k6

15/07/2026, 05:11

260715-ft9gdae16v6

Analysis

user interaction
yes
max time kernel
148s
max time network
120s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 05:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Wondershare_Filmora_Installer.exe
Size 2.2MB
Sample260715-ft9gdae16v
SHA256 efb17008e2b9c7fba95699a7c98db92f7fe5d51e3c74e9cd02b68c6b29bbb84b
MD5 4c289ccff12c9ee195f7052e0e205c06
SHA1 dead5c48ac8c488f5fd8ba9a3861693618d3dbd7
SHA512 7a06d926d459151619aef831cd3a8a2caa7088cb0bbfe84f2ceba45374bbc53ae34cc7f64586599737150fed64f2f7ac3ec05b9159736c7c808f4b4df578a472
SSDEEP 49152:4nzmgTzt5lizxGbZZZErinuIkMPTxlZ9NSaxlL11:4nzmgtIkZZmIu69N
TLSH
T1FCB5BF13BBC1C0B7E26306304466A73959B9BE60573489EFA3D43E5C6D706C2E93A367
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Wondershare_Filmora_Installer.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Control Panel\Desktop\MuiCached	Wondershare_Filmora_Installer.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	Wondershare_Filmora_Installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 5c0000000100000004000000000800006b00000001000000200000004348a0e9444c78cb265e058d5e8944b4d84f9662bd26db257f8934a443c701610f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000004348a0e9444c78cb265e058d5e8944b4d84f9662bd26db257f8934a443c7016114000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd97f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d701030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	Wondershare_Filmora_Installer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4956	Wondershare_Filmora_Installer.exe
4956	Wondershare_Filmora_Installer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4956	Wondershare_Filmora_Installer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4956	Wondershare_Filmora_Installer.exe
4956	Wondershare_Filmora_Installer.exe

C:\Users\Admin\AppData\Local\Temp\Wondershare_Filmora_Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Wondershare_Filmora_Installer.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4956

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wsWAE.log

Path C:\Users\Admin\AppData\Local\Temp\Wondershare\WAE\wsWAE.log
Size 2KB
SHA256 4ef112b3b39bc589b384a94d02b5c0045a512b8d7bd520d88a0c3001b8791fcb
MD5 8b570db08bab6b3031facfd4bc2d792e
SHA1 d2739ef35382e0997ed2b0f1e7ac4e0c6e9dff4d
SHA512 ffc4fa47affb5a929ff5bb82f420ea01d16e85a1af70204f85f41abc4415f2128ac105c40e77a1d1cc92b427ec9d0d22be07b5a0b98eb633c4018c502185e9d0
TLSH
T18B514789E4FE457AC1864D50967A1FA7FEF4BA1A4E021D31B38C9D402B0CD47BF1E151
MD5 SHA1 SHA512 TLSH

Submit Download

wsWAE.log

Path C:\Users\Admin\AppData\Local\Temp\Wondershare\WAE\wsWAE.log
Size 1KB
SHA256 01facbbd97460fbe000b084b8d1070723e478189f96287f902c175a65ef81949
MD5 c17e67d76bf8ded4e74ce7ff5ed9daf1
SHA1 b5f8e565e26785db80b56d89a99c7b0bf2705eca
SHA512 8ffe6c1712345c154b7aaed7383ead9843971dbb804fb18bc011aa81c4f11b8aaaf8ad3927e03fa4d24d50849f43b4fe0d09abc444c68d7cc63664cfef89d624
TLSH
T1E711A8C174EE1077C1C64A00A66A0F57AFF8B95A8E124C3B778C9D415B6CD427F1E650
MD5 SHA1 SHA512 TLSH

Submit Download

wsWAE.log

Path C:\Users\Admin\AppData\Local\Temp\Wondershare\WAE\wsWAE.log
Size 3KB
SHA256 725d584812ef8247eaf9baab6827970d27cd4e769af5c09adf4c0e2b8a1269d5
MD5 32aab910380bf8ee3f0ea32231b59999
SHA1 352126275c285af03ab34caaffc7752b3e0b5d2b
SHA512 ac38b47b6ae7c6706dc93ce9c427ece021d9b6961f1ac215446a26db2bea5e2bd65009a86901c46a571cc514c3d5fa4f39d4332e59582cbdddaa8f049f3f010b
TLSH
T1D8817C89E5BE4536C2964D6096BA1FABFEF4BA2A4E420D30738C9D402B0CD47BF1E155
MD5 SHA1 SHA512 TLSH

Submit Download

wsWAE.log

Path C:\Users\Admin\AppData\Local\Temp\Wondershare\WAE\wsWAE.log
Size 5KB
SHA256 a6029d9be616c6eef8bd14d6622afe09872fe228b4ea96ec7992184fa0599fdf
MD5 6adfb4433c0d9ceed2c958209b42d725
SHA1 01448b30670138972c940b2f47585f21e3207dcd
SHA512 b6c771b5fa3687793215ea87496dd6637d3bdffcee61b9484356ac0027a1f2d7cf7e37b7b6ebf2bfff04f8dcb068efcab903fd57f3cf6a8b8cab3c537736add3
SSDEEP 96:oJwFZ+zhgFiY9LJLfGyLrob+4hgFiLKELiLESLTJhViYQ5+A4J4zatxbMvV5Tkgk:aaImQehZoN5TkTTBb
TLSH
T19EC1C1CAE5FE453AD2960E6092BA1FABF9F5B52949421D31B3889D402F0CC436F1F136
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsduilib.log

Path C:\Users\Admin\AppData\Local\Temp\wsduilib.log
Size 1KB
SHA256 a13d4791c5871fd94bca0ce101c9abbba6d2170acea42ac99d8b994e35d77145
MD5 ad31b528a437227d8c6c910c1e10fe9b
SHA1 53abcd83b43142115d32ec37db3eca4cea2e9865
SHA512 a54597870e2ba83062da299e1647138e7b37b05e59a10468b19c323ab7c01c8ca030c6c8b733af9416855432317dec6051a233190a5b6c96d166cf9fa2c43123
TLSH
T1A1318158AAFE1121C4FB1A2084293FCBDDE1B43996244DBF77A80C952F2CD66173E356
MD5 SHA1 SHA512 TLSH

Submit Download

wsduilib.log

Path C:\Users\Admin\AppData\Local\Temp\wsduilib.log
Size 3KB
SHA256 5f1d22ecb67127d4a9c462153631ca760d1d5cc7f7b93c66aff870ec2841411f
MD5 7bfe7dd53d530139e3d88ce6ff01af20
SHA1 5204a12e0629829dcf488c13e232eb7d2e1430a9
SHA512 e3284958b51ccd904784398c8f62c4ecb1fda7f95b8f8410ac34056d579770c64e061479f3503679c1b79b70ce460636721e901744836330f364eb6248f27f58
TLSH
T19271BA58ABBE1125C4FB1A2084693FCBDDD1B43995284DBB77A40CA12F2CD62172E397
MD5 SHA1 SHA512 TLSH

Submit Download

wsduilib.log

Path C:\Users\Admin\AppData\Local\Temp\wsduilib.log
Size 5KB
SHA256 8898f6489bf84b9d6abefeec49dc7f02570e4d55cbac4bbf7e389ff6a95b639c
MD5 6b15f5af9cfe4024582bf8489f9bcdd2
SHA1 a614340859869c9b3422eb3e41e3beef290381aa
SHA512 fa1781893bed4f94baff1739f88850d106f2acf53ee84e1c1088471ecf3f5fa6eea28a01e8e0b6d496b127566be1e6ff641f1ea92862e7b3938f3baa4365a218
SSDEEP 48:o14iqkqRqVyhqXqfqxqqqcyhyhyayayPyPywywyFyFyOyOyFlyFlyUyUyZyZySyR:owabZw
TLSH
T144C1E758ABBE1125C4FB1A2084693FCFDDD1B43995284DBB77A40CA12F2CD62172E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsduilib.log

Path C:\Users\Admin\AppData\Local\Temp\wsduilib.log
Size 4KB
SHA256 6e626d4f96ee8ba6248fba42433ab5b72a71823d6ba2057d5cfa53ab40a6a675
MD5 b2a57b6be37550c8b7c9afe93ba89b0a
SHA1 719c7525e1cdd3010dad6869d4bfa0664d230064
SHA512 922aaa1af9bd9e180c00c062fa56f9169468a0f5e5325a0d7e4cccffed285e77d0f62fa0e46fc523e652aa3b32d28ae9aaf3f900731a356cef27a43a23566353
SSDEEP 48:o14iqkqRqVyhqXqfqxqqqcyhyhyayayPyPywywyFyFyOyOyFlyFlyUyUyZyZySyk:owabZT
TLSH
T14691C958ABBE1125C4FB1A2084693FCFDDD1B43995284DBB77A40CA12F2CD62172E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsduilib.log

Path C:\Users\Admin\AppData\Local\Temp\wsduilib.log
Size 7KB
SHA256 68ddf9ba73b1e7fd122f8cb6d9a73e81c06232c9ed54ed6ed8ca81de2e1715ba
MD5 fef17ec834ba9e8fa302acaa63817b76
SHA1 0dcf2053001007540a0bd58af02a5feb4659a445
SHA512 d072d6e6b3a2f0c7682b31b6a03075a6cdef8a189ff8bc4e22e9f562091b9d435e5b051e48e98c889ac12743da55944afd2df9b9e98ffe5010deec7ad90569d3
SSDEEP 48:o14iqkqRqVyhqXqfqxqqqcyhyhyayayPyPywywyFyFyOyOyFlyFlyUyUyZyZySyZ:owabZ4
TLSH
T18DF1E658ABBE1125C4FB1A2084693FCFDDD1B43995284DBB77A40CA12F2CD62172E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download