File name:

Wondershare Filmora 12 License.rar

Full analysis: https://app.any.run/tasks/431bd8a2-215b-4f31-b0a0-995b1d718b41
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: October 08, 2023, 14:57:44
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
autoit
stealer
raccoon
recordbreaker
loader
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

B669BE8F6C1C93181939177293F533EE

SHA1:

DE03166932E418D457297CD3DBAED4C4B9DEC1FC

SHA256:

1933FC2B8CF4D7D316B8375451C7257B3BA05DAF6591F373EB38B7AA9F0A5B52

SSDEEP:

24576:/5A4+lf1pOYVwmq0V2VvXlQ6r1dIDcQ5nyiPyMvoeKlsuV3sSkFrEz3kIKwFR8HY:/5A4+ldpHVwmV2VvXlQY1dIDcQ5nyiPK

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Wondershare Filmora 12 License.exe (PID: 3176)
      • Virus.pif (PID: 528)
      • Wondershare Filmora 12 License.exe (PID: 3728)
      • Virus.pif (PID: 2548)

    • Drops the executable file immediately after the start

      • Wondershare Filmora 12 License.exe (PID: 3176)
      • cmd.exe (PID: 3376)
      • Wondershare Filmora 12 License.exe (PID: 3728)
      • cmd.exe (PID: 2052)

    • RACCOON was detected

      • attrib.exe (PID: 3828)

    • Connects to the CnC server

      • attrib.exe (PID: 3828)

    • RACCOON has been detected (YARA)

      • attrib.exe (PID: 3828)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • Wondershare Filmora 12 License.exe (PID: 3176)
      • cmd.exe (PID: 2344)
      • cmd.exe (PID: 3720)
      • Wondershare Filmora 12 License.exe (PID: 3728)
      • cmd.exe (PID: 2268)
      • cmd.exe (PID: 2264)

    • Application launched itself

      • cmd.exe (PID: 2344)
      • cmd.exe (PID: 3720)
      • cmd.exe (PID: 2268)
      • cmd.exe (PID: 2264)

    • Get information on the list of running processes

      • cmd.exe (PID: 3720)
      • cmd.exe (PID: 2264)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 3720)
      • cmd.exe (PID: 2264)

    • Drops the AutoIt3 executable file

      • cmd.exe (PID: 3376)
      • cmd.exe (PID: 2052)

    • Starts application with an unusual extension

      • cmd.exe (PID: 3720)
      • cmd.exe (PID: 2264)

    • Reads the Internet Settings

      • attrib.exe (PID: 3828)

    • The process drops Mozilla's DLL files

      • attrib.exe (PID: 3828)

    • Connects to the server without a host name

      • attrib.exe (PID: 3828)

    • Process drops legitimate windows executable

      • attrib.exe (PID: 3828)

    • Process requests binary or script from the Internet

      • attrib.exe (PID: 3828)

    • The process drops C-runtime libraries

      • attrib.exe (PID: 3828)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 2264)
      • cmd.exe (PID: 3720)

  • INFO

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3820)
      • attrib.exe (PID: 3828)

    • Checks supported languages

      • Wondershare Filmora 12 License.exe (PID: 3176)
      • Virus.pif (PID: 528)
      • Wondershare Filmora 12 License.exe (PID: 3728)
      • Virus.pif (PID: 2548)

    • Create files in a temporary directory

      • Wondershare Filmora 12 License.exe (PID: 3176)
      • Wondershare Filmora 12 License.exe (PID: 3728)

    • The executable file from the user directory is run by the CMD process

      • Virus.pif (PID: 528)
      • Virus.pif (PID: 2548)

    • Manual execution by a user

      • attrib.exe (PID: 3828)

    • Reads the computer name

      • Virus.pif (PID: 528)
      • Virus.pif (PID: 2548)

    • Checks proxy server information

      • attrib.exe (PID: 3828)

    • Creates files or folders in the user directory

      • attrib.exe (PID: 3828)

    • Reads mouse settings

      • Virus.pif (PID: 2548)
      • Virus.pif (PID: 528)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Raccoon

(PID) Process(3828) attrib.exe
C2 (1)http://193.178.170.44:80
Keys
xorc43570bcc01e0a8be3631c0370fb5142
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
57
Monitored processes
20
Malicious processes
8
Suspicious processes
4

Behavior graph

Click at the process to see the details
drop and start drop and start start winrar.exe no specs wondershare filmora 12 license.exe no specs cmd.exe no specs cmd.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs cmd.exe no specs virus.pif no specs ping.exe no specs #RACCOON attrib.exe wondershare filmora 12 license.exe no specs cmd.exe no specs cmd.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs cmd.exe no specs virus.pif no specs ping.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
116ping -n 5 localhostC:\Windows\System32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ping.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
c:\windows\system32\rpcrt4.dll
52822322\Virus.pif 22322\r C:\Users\admin\AppData\Local\Temp\19337\22322\Virus.pif—cmd.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script (Beta)
Exit code:
0
Version:
3, 3, 15, 4
Modules
Images
c:\users\admin\appdata\local\temp\19337\22322\virus.pif
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\version.dll
2052cmd /c copy /b Verify + Accent + September + Brazilian + Hardcover + Wives + Flour + Seminar 22450\Virus.pifC:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\cmd.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2064tasklist C:\Windows\System32\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\tasklist.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2084ping -n 5 localhostC:\Windows\System32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
2148tasklist C:\Windows\System32\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\tasklist.exe
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
2264cmd C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2268cmd /k cmd < Heard & exitC:\Windows\System32\cmd.exe—Wondershare Filmora 12 License.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2344cmd /k cmd < Heard & exitC:\Windows\System32\cmd.exe—Wondershare Filmora 12 License.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2488findstr /I "avastui.exe avgui.exe nswscsvc.exe"C:\Windows\System32\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\findstr.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
Total events
2 178
Read events
2 149
Write events
29
Delete events
0

Modification events

(PID) Process:(3820) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\178\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3820) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3820) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3820) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3820) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3820) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3820) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3820) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3820) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3820) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
Executable files
12
Suspicious files
14
Text files
8
Unknown types
0

Dropped files

PID
Process
Filename
Type
3820WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3820.6950\License\Wondershare Filmora 12 License.exeexecutable
MD5:BD1DA33BF689D6633D68AC9011ECC768
SHA256:DC7956C9AF448BF9BAF986B3E727F3E4897E36CFB8540EA9E79797260D9BD19C
3176Wondershare Filmora 12 License.exeC:\Users\admin\AppData\Local\Temp\19337\Wivesbinary
MD5:B1571A6C468733C3FE3857F935936657
SHA256:A6D0AEEF4FED28D113147126748E3F4A315E86A64DF9583C05B9D9A274AD6EFF
3820WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3820.6950\INSTRUCTIONS.txttext
MD5:03589C1AAB0EF40D47E87A90D40DA302
SHA256:76EA451C989E3C6D7BDAA8A34D6AB8E6814AE32E9B8C7E35EBEFF85C38256D4E
3176Wondershare Filmora 12 License.exeC:\Users\admin\AppData\Local\Temp\19337\Verifyexecutable
MD5:724457AE3AE35E9FE5BA7FF6D84A9305
SHA256:821CA194A12D0085B5EA043EFC6417E53227244DA585AF0BCC8995E1946CBEBD
3176Wondershare Filmora 12 License.exeC:\Users\admin\AppData\Local\Temp\19337\Flourbinary
MD5:C8ED4F3EE0126B2AAE394B3489686ADD
SHA256:FC75D7C1614D447FE6D44AF9ED0ADE8144386B2DE1CAB6615683D6F1B7E24772
3176Wondershare Filmora 12 License.exeC:\Users\admin\AppData\Local\Temp\19337\Septemberbinary
MD5:4478A57D55DD9DB69490303E2C39E644
SHA256:F4345FDD99EC623D91736A764D356CE1FA2240AEC52D94F883B6B7C98C85109F
3720cmd.exeC:\Users\admin\AppData\Local\Temp\19337\22322\rtext
MD5:7586F460340C41D9EEC47F8A2F7D869F
SHA256:D1C9D5AD16F50BF78226C175E2A081964DF4F155A84C56AC0C5D03997E69ACA7
3176Wondershare Filmora 12 License.exeC:\Users\admin\AppData\Local\Temp\19337\Teachingtext
MD5:7586F460340C41D9EEC47F8A2F7D869F
SHA256:D1C9D5AD16F50BF78226C175E2A081964DF4F155A84C56AC0C5D03997E69ACA7
3176Wondershare Filmora 12 License.exeC:\Users\admin\AppData\Local\Temp\19337\Accentbinary
MD5:0A4265999A2BDC6788050FEA7DE17B54
SHA256:B1C6AECA6EAAE6909B63C18CE9BCBB41BCC37ECD745F12F2B55B5EE667E61863
3176Wondershare Filmora 12 License.exeC:\Users\admin\AppData\Local\Temp\19337\Heardtext
MD5:3C9930017995A8F36199F6D773E88FD6
SHA256:B94F8DDE4ECDCD0F0C8E33312619C72FFE4BC3F3E3FA1C870B204FD05712FA61
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
4
DNS requests
1
Threats
16

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3828
attrib.exe
GET
200
193.178.170.44:80
http://193.178.170.44/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue.dll
unknown
executable
612 Kb
unknown
3828
attrib.exe
GET
200
193.178.170.44:80
http://193.178.170.44/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3.dll
unknown
executable
248 Kb
unknown
—
—
GET
200
193.178.170.44:80
http://193.178.170.44/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3.dll
unknown
executable
1.95 Mb
unknown
—
—
POST
200
193.178.170.44:80
http://193.178.170.44/
unknown
text
7.29 Kb
unknown
3828
attrib.exe
GET
200
193.178.170.44:80
http://193.178.170.44/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140.dll
unknown
executable
438 Kb
unknown
3828
attrib.exe
GET
200
193.178.170.44:80
http://193.178.170.44/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140.dll
unknown
executable
78.2 Kb
unknown
3828
attrib.exe
GET
200
193.178.170.44:80
http://193.178.170.44/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3.dll
unknown
executable
668 Kb
unknown
3828
attrib.exe
GET
—
193.178.170.44:80
http://193.178.170.44/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3.dll
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2656
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3828
attrib.exe
193.178.170.44:80
—
Hosting technology LTD
RU
unknown

DNS requests

Domain
IP
Reputation
lnvVyuNeTAw.lnvVyuNeTAw
  • —
unknown

Threats

PID
Process
Class
Message
3828
attrib.exe
A Network Trojan was detected
ET MALWARE Win32/RecordBreaker CnC Checkin M1
3828
attrib.exe
A Network Trojan was detected
ET MALWARE Win32/RecordBreaker CnC Checkin - Server Response
3828
attrib.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
3828
attrib.exe
A suspicious filename was detected
ET HUNTING HTTP GET Request for nss3.dll - Possible Infostealer Activity
3828
attrib.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3828
attrib.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
3828
attrib.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
3828
attrib.exe
A suspicious filename was detected
ET HUNTING HTTP GET Request for vcruntime140.dll - Possible Infostealer Activity
3828
attrib.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
3828
attrib.exe
A suspicious filename was detected
ET HUNTING HTTP GET Request for mozglue.dll - Possible Infostealer Activity
Process
Message
attrib.exe
log: wzqp6c4u
attrib.exe
log: rkh7fcrb
attrib.exe
log: rkizjfza
attrib.exe
log: wzqp6c4u
attrib.exe
log: 2wh3jior
attrib.exe
log: rzl0989j
attrib.exe
log: b4hyckhe
attrib.exe
log: nzevc3nv
attrib.exe
log: 5qvdjrlo
attrib.exe
log: vwtbxe4f
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Wondershare Filmora 12 License.rar