File name:

Wondershare Filmora 12 License.rar

Full analysis: https://app.any.run/tasks/431bd8a2-215b-4f31-b0a0-995b1d718b41
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: October 08, 2023, 14:57:44
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
autoit
stealer
raccoon
recordbreaker
loader
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

B669BE8F6C1C93181939177293F533EE

SHA1:

DE03166932E418D457297CD3DBAED4C4B9DEC1FC

SHA256:

1933FC2B8CF4D7D316B8375451C7257B3BA05DAF6591F373EB38B7AA9F0A5B52

SSDEEP:

24576:/5A4+lf1pOYVwmq0V2VvXlQ6r1dIDcQ5nyiPyMvoeKlsuV3sSkFrEz3kIKwFR8HY:/5A4+ldpHVwmV2VvXlQY1dIDcQ5nyiPK

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Wondershare Filmora 12 License.exe (PID: 3176)
      • Virus.pif (PID: 528)
      • Wondershare Filmora 12 License.exe (PID: 3728)
      • Virus.pif (PID: 2548)

    • Drops the executable file immediately after the start

      • Wondershare Filmora 12 License.exe (PID: 3176)
      • Wondershare Filmora 12 License.exe (PID: 3728)
      • cmd.exe (PID: 2052)
      • cmd.exe (PID: 3376)

    • Connects to the CnC server

      • attrib.exe (PID: 3828)

    • RACCOON was detected

      • attrib.exe (PID: 3828)

    • RACCOON has been detected (YARA)

      • attrib.exe (PID: 3828)

  • SUSPICIOUS

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 3720)
      • cmd.exe (PID: 2264)

    • Starts CMD.EXE for commands execution

      • Wondershare Filmora 12 License.exe (PID: 3176)
      • cmd.exe (PID: 2344)
      • cmd.exe (PID: 3720)
      • Wondershare Filmora 12 License.exe (PID: 3728)
      • cmd.exe (PID: 2268)
      • cmd.exe (PID: 2264)

    • Get information on the list of running processes

      • cmd.exe (PID: 3720)
      • cmd.exe (PID: 2264)

    • Application launched itself

      • cmd.exe (PID: 2344)
      • cmd.exe (PID: 3720)
      • cmd.exe (PID: 2268)
      • cmd.exe (PID: 2264)

    • Drops the AutoIt3 executable file

      • cmd.exe (PID: 3376)
      • cmd.exe (PID: 2052)

    • Starts application with an unusual extension

      • cmd.exe (PID: 3720)
      • cmd.exe (PID: 2264)

    • Reads the Internet Settings

      • attrib.exe (PID: 3828)

    • The process drops Mozilla's DLL files

      • attrib.exe (PID: 3828)

    • Connects to the server without a host name

      • attrib.exe (PID: 3828)

    • Process requests binary or script from the Internet

      • attrib.exe (PID: 3828)

    • Process drops legitimate windows executable

      • attrib.exe (PID: 3828)

    • The process drops C-runtime libraries

      • attrib.exe (PID: 3828)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 2264)
      • cmd.exe (PID: 3720)

  • INFO

    • Create files in a temporary directory

      • Wondershare Filmora 12 License.exe (PID: 3176)
      • Wondershare Filmora 12 License.exe (PID: 3728)

    • Checks supported languages

      • Wondershare Filmora 12 License.exe (PID: 3176)
      • Wondershare Filmora 12 License.exe (PID: 3728)
      • Virus.pif (PID: 2548)
      • Virus.pif (PID: 528)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3820)
      • attrib.exe (PID: 3828)

    • The executable file from the user directory is run by the CMD process

      • Virus.pif (PID: 528)
      • Virus.pif (PID: 2548)

    • Reads mouse settings

      • Virus.pif (PID: 528)
      • Virus.pif (PID: 2548)

    • Reads the computer name

      • Virus.pif (PID: 528)
      • Virus.pif (PID: 2548)

    • Checks proxy server information

      • attrib.exe (PID: 3828)

    • Manual execution by a user

      • attrib.exe (PID: 3828)

    • Creates files or folders in the user directory

      • attrib.exe (PID: 3828)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Raccoon

(PID) Process(3828) attrib.exe
C2 (1)http://193.178.170.44:80
Keys
xorc43570bcc01e0a8be3631c0370fb5142
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
57
Monitored processes
20
Malicious processes
8
Suspicious processes
4

Behavior graph

Click at the process to see the details
drop and start drop and start start winrar.exe no specs wondershare filmora 12 license.exe no specs cmd.exe no specs cmd.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs cmd.exe no specs virus.pif no specs ping.exe no specs #RACCOON attrib.exe wondershare filmora 12 license.exe no specs cmd.exe no specs cmd.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs cmd.exe no specs virus.pif no specs ping.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
116ping -n 5 localhostC:\Windows\System32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ping.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
c:\windows\system32\rpcrt4.dll
52822322\Virus.pif 22322\r C:\Users\admin\AppData\Local\Temp\19337\22322\Virus.pif—cmd.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script (Beta)
Exit code:
0
Version:
3, 3, 15, 4
Modules
Images
c:\users\admin\appdata\local\temp\19337\22322\virus.pif
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\version.dll
2052cmd /c copy /b Verify + Accent + September + Brazilian + Hardcover + Wives + Flour + Seminar 22450\Virus.pifC:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\cmd.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2064tasklist C:\Windows\System32\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\tasklist.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2084ping -n 5 localhostC:\Windows\System32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
2148tasklist C:\Windows\System32\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\tasklist.exe
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
2264cmd C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2268cmd /k cmd < Heard & exitC:\Windows\System32\cmd.exe—Wondershare Filmora 12 License.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2344cmd /k cmd < Heard & exitC:\Windows\System32\cmd.exe—Wondershare Filmora 12 License.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2488findstr /I "avastui.exe avgui.exe nswscsvc.exe"C:\Windows\System32\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\findstr.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
Total events
2 178
Read events
2 149
Write events
29
Delete events
0

Modification events

(PID) Process:(3820) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\178\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3820) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3820) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3820) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3820) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3820) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3820) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3820) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3820) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3820) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
Executable files
12
Suspicious files
14
Text files
8
Unknown types
0

Dropped files

PID
Process
Filename
Type
3820WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3820.6950\License\Wondershare Filmora 12 License.exeexecutable
MD5:BD1DA33BF689D6633D68AC9011ECC768
SHA256:DC7956C9AF448BF9BAF986B3E727F3E4897E36CFB8540EA9E79797260D9BD19C
3176Wondershare Filmora 12 License.exeC:\Users\admin\AppData\Local\Temp\19337\Septemberbinary
MD5:4478A57D55DD9DB69490303E2C39E644
SHA256:F4345FDD99EC623D91736A764D356CE1FA2240AEC52D94F883B6B7C98C85109F
3720cmd.exeC:\Users\admin\AppData\Local\Temp\19337\22322\rtext
MD5:7586F460340C41D9EEC47F8A2F7D869F
SHA256:D1C9D5AD16F50BF78226C175E2A081964DF4F155A84C56AC0C5D03997E69ACA7
3176Wondershare Filmora 12 License.exeC:\Users\admin\AppData\Local\Temp\19337\Flourbinary
MD5:C8ED4F3EE0126B2AAE394B3489686ADD
SHA256:FC75D7C1614D447FE6D44AF9ED0ADE8144386B2DE1CAB6615683D6F1B7E24772
3176Wondershare Filmora 12 License.exeC:\Users\admin\AppData\Local\Temp\19337\Accentbinary
MD5:0A4265999A2BDC6788050FEA7DE17B54
SHA256:B1C6AECA6EAAE6909B63C18CE9BCBB41BCC37ECD745F12F2B55B5EE667E61863
3176Wondershare Filmora 12 License.exeC:\Users\admin\AppData\Local\Temp\19337\Hardcoverbinary
MD5:F310C4248E4ED0D80017BF432CC67490
SHA256:CC29CDCB697C0BFC6EA768D218B49B20840121C3916B6D5C3A954440DE985561
3728Wondershare Filmora 12 License.exeC:\Users\admin\AppData\Local\Temp\58572\Seminarbinary
MD5:F47BE5D73CD4CF2C3E6370F9ABFB9B4F
SHA256:D3CC5DEDAA88F5A21AE77153098391B84DA56E4D38F61838D78CF28F8DC11970
3376cmd.exeC:\Users\admin\AppData\Local\Temp\19337\22322\Virus.pifexecutable
MD5:848164D084384C49937F99D5B894253E
SHA256:F58D3A4B2F3F7F10815C24586FAE91964EEED830369E7E0701B43895B0CEFBD3
3176Wondershare Filmora 12 License.exeC:\Users\admin\AppData\Local\Temp\19337\Heardtext
MD5:3C9930017995A8F36199F6D773E88FD6
SHA256:B94F8DDE4ECDCD0F0C8E33312619C72FFE4BC3F3E3FA1C870B204FD05712FA61
3176Wondershare Filmora 12 License.exeC:\Users\admin\AppData\Local\Temp\19337\Teachingtext
MD5:7586F460340C41D9EEC47F8A2F7D869F
SHA256:D1C9D5AD16F50BF78226C175E2A081964DF4F155A84C56AC0C5D03997E69ACA7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
4
DNS requests
1
Threats
16

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
193.178.170.44:80
http://193.178.170.44/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3.dll
unknown
executable
1.95 Mb
unknown
3828
attrib.exe
GET
200
193.178.170.44:80
http://193.178.170.44/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140.dll
unknown
executable
438 Kb
unknown
3828
attrib.exe
GET
200
193.178.170.44:80
http://193.178.170.44/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue.dll
unknown
executable
612 Kb
unknown
3828
attrib.exe
GET
200
193.178.170.44:80
http://193.178.170.44/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3.dll
unknown
executable
248 Kb
unknown
—
—
POST
200
193.178.170.44:80
http://193.178.170.44/
unknown
text
7.29 Kb
unknown
3828
attrib.exe
GET
200
193.178.170.44:80
http://193.178.170.44/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140.dll
unknown
executable
78.2 Kb
unknown
3828
attrib.exe
GET
200
193.178.170.44:80
http://193.178.170.44/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3.dll
unknown
executable
668 Kb
unknown
3828
attrib.exe
GET
—
193.178.170.44:80
http://193.178.170.44/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3.dll
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2656
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3828
attrib.exe
193.178.170.44:80
—
Hosting technology LTD
RU
unknown

DNS requests

Domain
IP
Reputation
lnvVyuNeTAw.lnvVyuNeTAw
  • —
unknown

Threats

PID
Process
Class
Message
3828
attrib.exe
A Network Trojan was detected
ET MALWARE Win32/RecordBreaker CnC Checkin M1
3828
attrib.exe
A Network Trojan was detected
ET MALWARE Win32/RecordBreaker CnC Checkin - Server Response
3828
attrib.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
3828
attrib.exe
A suspicious filename was detected
ET HUNTING HTTP GET Request for nss3.dll - Possible Infostealer Activity
3828
attrib.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3828
attrib.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
3828
attrib.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
3828
attrib.exe
A suspicious filename was detected
ET HUNTING HTTP GET Request for vcruntime140.dll - Possible Infostealer Activity
3828
attrib.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
3828
attrib.exe
A suspicious filename was detected
ET HUNTING HTTP GET Request for mozglue.dll - Possible Infostealer Activity
Process
Message
attrib.exe
log: wzqp6c4u
attrib.exe
log: rkh7fcrb
attrib.exe
log: rkizjfza
attrib.exe
log: wzqp6c4u
attrib.exe
log: 2wh3jior
attrib.exe
log: rzl0989j
attrib.exe
log: b4hyckhe
attrib.exe
log: nzevc3nv
attrib.exe
log: 5qvdjrlo
attrib.exe
log: vwtbxe4f
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Wondershare Filmora 12 License.rar