Malware analysis filmora-idco_setup_full1901.exe Malicious activity

Add for printing

File name:	filmora-idco_setup_full1901.exe
Full analysis:	https://app.any.run/tasks/189015b6-b861-4fb3-820b-3b32816df867
Verdict:	Malicious activity
Analysis date:	January 22, 2019, 11:40:01
OS:	Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME:	application/x-dosexec
File info:	PE32 executable (GUI) Intel 80386, for MS Windows
MD5:	DD1898D5D7F53F0BCCD88424F7318892
SHA1:	1A02FBD1EA20B8D72392CD04A1E63CFF56E43CA6
SHA256:	BD2B78F9F1168C7ED02F08C77DCA327E4190FF39382C7732210A494D3392E689
SSDEEP:	12288:nw8Jiq97i32bkQoTHHYn5iwhDLcA1TR+t+iBXgGQPUtfvHB1+j+8Pvp:xw9QoTQiwhDLcARR+m3UFvv+C83

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 120 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: 60 seconds
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 8.0.7601.17514 undefined
Adobe Acrobat Reader DC MUI (15.023.20070)
Adobe Flash Player 26 ActiveX (26.0.0.131)
Adobe Flash Player 26 NPAPI (26.0.0.131)
Adobe Flash Player 26 PPAPI (26.0.0.131)
Adobe Refresh Manager (1.8.0)
CCleaner (5.35)
FileZilla Client 3.36.0 (3.36.0)
Google Chrome (68.0.3440.106)
Google Update Helper (1.3.33.17)
Java 8 Update 92 (8.0.920.14)
Java Auto Updater (2.8.92.14)
Microsoft .NET Framework 4.6.1 (4.6.01055)
Microsoft Office Access MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Excel MUI (English) 2010 (14.0.6029.1000)
Microsoft Office OneNote MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Outlook MUI (English) 2010 (14.0.6029.1000)
Microsoft Office PowerPoint MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Professional 2010 (14.0.6029.1000)
Microsoft Office Proof (English) 2010 (14.0.6029.1000)
Microsoft Office Proof (French) 2010 (14.0.6029.1000)
Microsoft Office Proof (Spanish) 2010 (14.0.6029.1000)
Microsoft Office Proofing (English) 2010 (14.0.6029.1000)
Microsoft Office Publisher MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Single Image 2010 (14.0.6029.1000)
Microsoft Office Word MUI (English) 2010 (14.0.6029.1000)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (10.0.40219)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2017 Redistributable (x86) - 14.15.26706 (14.15.26706.0)
Microsoft Visual C++ 2017 x86 Additional Runtime - 14.15.26706 (14.15.26706)
Microsoft Visual C++ 2017 x86 Minimum Runtime - 14.15.26706 (14.15.26706)
Mozilla Firefox 61.0.2 (x86 en-US) (61.0.2)
Notepad++ (32-bit x86) (7.5.1)
Opera 12.15 (12.15.1748)
Skype version 8.29 (8.29)
VLC media player (2.2.6)
WinRAR 5.60 (32-bit) (5.60.0)

Hotfixes

Client LanguagePack Package
Client Refresh LanguagePack Package
CodecPack Basic Package
Foundation Package
IE Troubleshooters Package
InternetExplorer Optional Package
KB2534111
KB2999226
KB976902
LocalPack AU Package
LocalPack CA Package
LocalPack GB Package
LocalPack US Package
LocalPack ZA Package
ProfessionalEdition
UltimateEdition

Add for printing

MALICIOUS
- Application was dropped or rewritten from another process
  - NLEBuildFontProcess.exe (PID: 2688)
  - Wondershare Helper Compact.exe (PID: 3956)
  - ImageHost.exe (PID: 2760)
  - WSHelper.exe (PID: 2928)
  - CheckGraphicsType.exe (PID: 4052)
  - Filmora.exe (PID: 292)
  - WSHelper.exe (PID: 2348)
  - WSResDownloader.exe (PID: 2444)
- Loads dropped or rewritten executable
  - NLEBuildFontProcess.exe (PID: 2688)
  - WSHelper.exe (PID: 2928)
  - ImageHost.exe (PID: 2760)
  - CheckGraphicsType.exe (PID: 4052)
  - Filmora.exe (PID: 292)
  - WSResDownloader.exe (PID: 2444)
  - WSHelper.exe (PID: 2348)
- Changes the autorun value in the registry
  - Wondershare Helper Compact.tmp (PID: 2996)
  - filmora-idco_full1901.tmp (PID: 3016)
- Registers / Runs the DLL via REGSVR32.EXE
  - filmora-idco_full1901.tmp (PID: 3016)
SUSPICIOUS
- Executable content was dropped or overwritten
  - filmora-idco_full1901.exe (PID: 3976)
  - Wondershare Helper Compact.exe (PID: 3956)
  - Wondershare Helper Compact.tmp (PID: 2996)
  - filmora-idco_full1901.tmp (PID: 3016)
- Reads the Windows organization settings
  - filmora-idco_full1901.tmp (PID: 3016)
- Modifies the open verb of a shell class
  - filmora-idco_full1901.tmp (PID: 3016)
- Creates files in the program directory
  - NLEBuildFontProcess.exe (PID: 2688)
  - CheckGraphicsType.exe (PID: 4052)
  - WSHelper.exe (PID: 2348)
  - Filmora.exe (PID: 292)
  - WSResDownloader.exe (PID: 2444)
- Low-level read access rights to disk partition
  - filmora-idco_setup_full1901.exe (PID: 3964)
- Creates files in the Windows directory
  - filmora-idco_full1901.tmp (PID: 3016)
- Reads Windows owner or organization settings
  - filmora-idco_full1901.tmp (PID: 3016)
- Uses TASKKILL.EXE to kill process
  - filmora-idco_full1901.tmp (PID: 3016)
- Reads internet explorer settings
  - filmora-idco_setup_full1901.exe (PID: 3964)
- Reads Internet Cache Settings
  - filmora-idco_setup_full1901.exe (PID: 3964)
- Changes IE settings (feature browser emulation)
  - filmora-idco_full1901.tmp (PID: 3016)
- Starts Internet Explorer
  - filmora-idco_setup_full1901.exe (PID: 3964)
- Reads CPU info
  - Filmora.exe (PID: 292)
INFO
- Loads dropped or rewritten executable
  - filmora-idco_full1901.tmp (PID: 3016)
  - Wondershare Helper Compact.tmp (PID: 2996)
- Application was dropped or rewritten from another process
  - filmora-idco_full1901.tmp (PID: 3016)
  - Wondershare Helper Compact.tmp (PID: 2996)
- Dropped object may contain Bitcoin addresses
  - filmora-idco_full1901.tmp (PID: 3016)
  - WSResDownloader.exe (PID: 2444)
- Creates a software uninstall entry
  - Wondershare Helper Compact.tmp (PID: 2996)
  - filmora-idco_full1901.tmp (PID: 3016)
- Creates files in the program directory
  - Wondershare Helper Compact.tmp (PID: 2996)
  - filmora-idco_full1901.tmp (PID: 3016)
- Changes internet zones settings
  - iexplore.exe (PID: 3716)
- Creates files in the user directory
  - iexplore.exe (PID: 3848)
- Reads Internet Cache Settings
  - iexplore.exe (PID: 3848)
- Changes settings of System certificates
  - iexplore.exe (PID: 3848)
- Adds / modifies Windows certificates
  - iexplore.exe (PID: 3848)
- Reads internet explorer settings
  - iexplore.exe (PID: 3848)
- Application launched itself
  - iexplore.exe (PID: 3716)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.exe	\|	Win32 Executable MS Visual C++ (generic) (16.3)
.exe	\|	Win64 Executable (generic) (14.5)
.dll	\|	Win32 Dynamic Link Library (generic) (3.4)
.exe	\|	Win32 Executable (generic) (2.3)

EXIF

EXE

ProductVersion:	8.5.5
ProductName:	Wondershare Filmora (CPC)
LegalCopyright:	Copyright©2017 Wondershare. All rights reserved.
FileVersion:	2.0.9.2
FileDescription:	wondershare-filmora-(cpc)_setup_full1901.exe
CharacterSet:	Unicode
LanguageCode:	English (U.S.)
FileSubtype:	-
ObjectFileType:	Executable application
FileOS:	Win32
FileFlags:	(none)
FileFlagsMask:	0x0017
ProductVersionNumber:	2.0.9.2
FileVersionNumber:	2.0.9.2
Subsystem:	Windows GUI
SubsystemVersion:	5
ImageVersion:	-
OSVersion:	5
EntryPoint:	0x51167
UninitializedDataSize:	-
InitializedDataSize:	575488
CodeSize:	451072
LinkerVersion:	9
PEType:	PE32
TimeStamp:	2018:05:31 17:17:14+02:00
MachineType:	Intel 386 or later, and compatibles

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
3152	"C:\Users\admin\AppData\Local\Temp\filmora-idco_setup_full1901.exe"	C:\Users\admin\AppData\Local\Temp\filmora-idco_setup_full1901.exe	—	explorer.exe
User: admin Integrity Level: MEDIUM Description: wondershare-filmora-(cpc)_setup_full1901.exe Exit code: 3221226540 Version: 2.0.9.2
3964	"C:\Users\admin\AppData\Local\Temp\filmora-idco_setup_full1901.exe"	C:\Users\admin\AppData\Local\Temp\filmora-idco_setup_full1901.exe		explorer.exe
User: admin Integrity Level: HIGH Description: wondershare-filmora-(cpc)_setup_full1901.exe Exit code: 0 Version: 2.0.9.2
3944	C:\Users\Public\Documents\Wondershare\NFWCHK.exe	C:\Users\Public\Documents\Wondershare\NFWCHK.exe	—	filmora-idco_setup_full1901.exe
User: admin Integrity Level: HIGH Exit code: 0
3976	"C:\Users\Public\Documents\Wondershare\filmora-idco_full1901.exe" /VERYSILENT /NOPAGE /LANG=ENG /LOG="C:\Users\admin\AppData\Local\Temp\WAE-Wondershare Filmora (CPC).log" /installpath: "C:\Program Files\Wondershare\Wondershare Filmora (CPC)\" /DIR="C:\Program Files\Wondershare\Wondershare Filmora (CPC)\"	C:\Users\Public\Documents\Wondershare\filmora-idco_full1901.exe		filmora-idco_setup_full1901.exe
User: admin Company: Integrity Level: HIGH Description: Wondershare Filmora Setup Exit code: 0 Version: 7.8.9.1
3016	"C:\Users\admin\AppData\Local\Temp\is-25Q7T.tmp\filmora-idco_full1901.tmp" /SL5="$40110,169119532,361984,C:\Users\Public\Documents\Wondershare\filmora-idco_full1901.exe" /VERYSILENT /NOPAGE /LANG=ENG /LOG="C:\Users\admin\AppData\Local\Temp\WAE-Wondershare Filmora (CPC).log" /installpath: "C:\Program Files\Wondershare\Wondershare Filmora (CPC)\" /DIR="C:\Program Files\Wondershare\Wondershare Filmora (CPC)\"	C:\Users\admin\AppData\Local\Temp\is-25Q7T.tmp\filmora-idco_full1901.tmp		filmora-idco_full1901.exe
User: admin Integrity Level: HIGH Description: Setup/Uninstall Exit code: 0 Version: 51.1052.0.0
2176	"C:\Windows\system32\TASKKILL.exe" /F /IM VideoEditor.exe	C:\Windows\system32\TASKKILL.exe	—	filmora-idco_full1901.tmp
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Terminates Processes Exit code: 128 Version: 6.1.7600.16385 (win7_rtm.090713-1255)
2676	"C:\Windows\system32\TASKKILL.exe" /F /IM Filmora.exe	C:\Windows\system32\TASKKILL.exe	—	filmora-idco_full1901.tmp
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Terminates Processes Exit code: 128 Version: 6.1.7600.16385 (win7_rtm.090713-1255)
2332	"C:\Windows\system32\TASKKILL.exe" /F /IM CheckGraphicsType.exe	C:\Windows\system32\TASKKILL.exe	—	filmora-idco_full1901.tmp
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Terminates Processes Exit code: 128 Version: 6.1.7600.16385 (win7_rtm.090713-1255)
3992	"C:\Windows\system32\TASKKILL.exe" /F /IM VEConverter.exe	C:\Windows\system32\TASKKILL.exe	—	filmora-idco_full1901.tmp
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Terminates Processes Exit code: 128 Version: 6.1.7600.16385 (win7_rtm.090713-1255)
3688	"C:\Windows\system32\TASKKILL.exe" /F /IM ImageHost.exe	C:\Windows\system32\TASKKILL.exe	—	filmora-idco_full1901.tmp
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Terminates Processes Exit code: 128 Version: 6.1.7600.16385 (win7_rtm.090713-1255)

Add for printing

Total events

1 521

Read events

1 165

Write events

Delete events

Modification events

No data

Add for printing

Executable files

249

Suspicious files

Text files

1 338

Unknown types

179

Dropped files

PID	Process	Filename		Type
3964	filmora-idco_setup_full1901.exe	C:\Users\Public\Documents\Wondershare\NFWCHK.exe		—
		MD5:—	SHA256:—
3964	filmora-idco_setup_full1901.exe	C:\Users\Public\Documents\Wondershare\NFWCHK.exe.config		—
		MD5:—	SHA256:—
3964	filmora-idco_setup_full1901.exe	C:\Users\Public\Documents\Wondershare\filmora-idco_full1901.exe.~P2S		—
		MD5:—	SHA256:—
3964	filmora-idco_setup_full1901.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\1901-20180806150115[1].htm		—
		MD5:—	SHA256:—
3964	filmora-idco_setup_full1901.exe	C:\Users\Public\Documents\Wondershare\filmora-idco_full1901.exe		—
		MD5:—	SHA256:—
3964	filmora-idco_setup_full1901.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D2YPIJ90\5[1].png		image
		MD5:77636EC8321D95FA5FF9E18FB8D89DE8	SHA256:9B6EC11459C74A73C2128E0DCF69084F88BFA08EFC1F72C1BEDEEC3DE96FF38E
3964	filmora-idco_setup_full1901.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\1901-20180806150115[1].htm		html
		MD5:9525398707756B8B62378611DAD9603A	SHA256:6177F5937DFE5FDB35715D1F032B63B0A42B290087568B23D5C96C813CE96A13
3964	filmora-idco_setup_full1901.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\2[1].png		image
		MD5:BB77961508DA7BF2EA3A488015B3FC4A	SHA256:0268B5DECCFFA20722A2112501A96E37BAEF624E1F03D5E8AF553010913BA734
3964	filmora-idco_setup_full1901.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D2YPIJ90\4[1].png		image
		MD5:76A8E42486D8A0261140C9E8A2C89BD8	SHA256:FCCF78B573D66F4011DB1078F6C87EAE025EA74419087195A9A7DABF34271BC2
3964	filmora-idco_setup_full1901.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0UU90R59\1[1].png		image
		MD5:B1531E37B941C5C018573F01ECA0C24E	SHA256:007E620B61E4AB9D6FAD0511CC17119E1B9049D4B796D7ECB25AB9C69D1CDFB3

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
3964	filmora-idco_setup_full1901.exe	GET	—	2.16.186.83:80	http://download.wondershare.net/cbs_down/filmora-idco_full1901.exe	unknown	—	—	whitelisted
3964	filmora-idco_setup_full1901.exe	GET	—	2.16.186.90:80	http://download.wondershare.net/cbs_down/filmora-idco_full1901.exe	unknown	—	—	whitelisted
3964	filmora-idco_setup_full1901.exe	GET	—	2.16.186.83:80	http://download.wondershare.net/cbs_down/filmora-idco_full1901.exe	unknown	—	—	whitelisted
3964	filmora-idco_setup_full1901.exe	HEAD	200	2.16.186.90:80	http://download.wondershare.net/cbs_down/filmora-idco_full1901.exe	unknown	—	—	whitelisted
3964	filmora-idco_setup_full1901.exe	HEAD	200	2.16.186.83:80	http://download.wondershare.net/cbs_down/filmora-idco_full1901.exe	unknown	—	—	whitelisted
3964	filmora-idco_setup_full1901.exe	GET	—	63.159.217.165:80	http://dlinst.wondershare.com/player/style/orbit-1.3.0.css	US	—	—	suspicious
3964	filmora-idco_setup_full1901.exe	GET	—	2.16.186.90:80	http://download.wondershare.net/cbs_down/filmora-idco_full1901.exe	unknown	—	—	whitelisted
3964	filmora-idco_setup_full1901.exe	GET	—	2.16.186.83:80	http://download.wondershare.net/cbs_down/filmora-idco_full1901.exe	unknown	—	—	whitelisted
3964	filmora-idco_setup_full1901.exe	GET	200	63.159.217.165:80	http://dlinst.wondershare.com/player/1901-20180806150115.html	US	html	890 b	suspicious
3964	filmora-idco_setup_full1901.exe	GET	200	63.159.217.165:80	http://dlinst.wondershare.com/player/1901-20180806150115.html	US	html	890 b	suspicious

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
3964	filmora-idco_setup_full1901.exe	2.16.186.90:80	download.wondershare.net	Akamai International B.V.	—	whitelisted
3964	filmora-idco_setup_full1901.exe	2.16.186.83:80	download.wondershare.net	Akamai International B.V.	—	whitelisted
3964	filmora-idco_setup_full1901.exe	47.254.50.155:80	platform.wondershare.com	Alibaba (China) Technology Co., Ltd.	US	unknown
3964	filmora-idco_setup_full1901.exe	63.159.217.165:80	dlinst.wondershare.com	QUANTIL, INC	US	unknown

DNS requests

Domain	IP	Reputation
platform.wondershare.com	47.254.50.155 47.254.50.214	suspicious
download.wondershare.net	2.16.186.90 2.16.186.83	whitelisted
dlinst.wondershare.com	63.159.217.165	suspicious

Threats

PID	Process	Class	Message
3964	filmora-idco_setup_full1901.exe	Potential Corporate Privacy Violation	ET POLICY PE EXE or DLL Windows file download HTTP
3964	filmora-idco_setup_full1901.exe	Potential Corporate Privacy Violation	ET POLICY PE EXE or DLL Windows file download HTTP

Add for printing

Process	Message
Filmora.exe	Media Streaming Kit for Windows Version V15.4 'Patriot' ( 0x20150306 ) Copyright (c) Rocket Division Software 2001-2010. All rights reserved. Copyright (c) StarBurn Software 2009-2010. All rights reserved.
Filmora.exe	Http Request Host: resource.wondershare.com, URL: /002/153/Category.xml
Filmora.exe	HTTP/1.1 200 OK
WSHelper.exe	HTTP/1.1 200 OK
WSHelper.exe	HTTP/1.1 200 OK
WSHelper.exe	HTTP/1.1 404 Not Found
WSHelper.exe	HTTP/1.1 200 OK
WSHelper.exe	HTTP/1.1 404 Not Found
WSResDownloader.exe	Http Request Host: resource.wondershare.com, URL: /001/536/Online2_3.zip
WSResDownloader.exe	HTTP/1.1 200 OK

General Info

filmora-idco_setup_full1901.exe

DD1898D5D7F53F0BCCD88424F7318892

1A02FBD1EA20B8D72392CD04A1E63CFF56E43CA6

BD2B78F9F1168C7ED02F08C77DCA327E4190FF39382C7732210A494D3392E689

12288:nw8Jiq97i32bkQoTHHYn5iwhDLcA1TR+t+iBXgGQPUtfvHB1+j+8Pvp:xw9QoTQiwhDLcARR+m3UFvv+C83

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Application was dropped or rewritten from another process

Loads dropped or rewritten executable

Changes the autorun value in the registry

Registers / Runs the DLL via REGSVR32.EXE

SUSPICIOUS

Executable content was dropped or overwritten

Reads the Windows organization settings

Modifies the open verb of a shell class

Creates files in the program directory

Low-level read access rights to disk partition

Creates files in the Windows directory

Reads Windows owner or organization settings

Uses TASKKILL.EXE to kill process

Reads internet explorer settings

Reads Internet Cache Settings

Changes IE settings (feature browser emulation)

Starts Internet Explorer

Reads CPU info

INFO

Loads dropped or rewritten executable

Application was dropped or rewritten from another process

Dropped object may contain Bitcoin addresses

Creates a software uninstall entry

Creates files in the program directory

Changes internet zones settings

Creates files in the user directory

Reads Internet Cache Settings

Changes settings of System certificates

Adds / modifies Windows certificates

Reads internet explorer settings

Application launched itself

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings