Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

essetup.exe

PE32 executable (GUI) Intel 80386, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	7.99647901070941
Filename:	essetup.exe
Filesize:	1335024
MD5:	3cb6d589a774c51a099ab6ef738e3e36
SHA1:	e597a0d1fa0bc47ac06d13fe2efc4637fa7c0416
SHA256:	fbb8e38c891b8f385804a2b4ff540830cef7c440ea34ebb696d15224cfbbfe6b
SHA512:	d5fb428190ce539eb0358c9cde02228737c5de625b16c2971e2907487af7d7e0c37835dee172fd8edf08e6d392b8a5121e8bfd6f519f308378cdf57def0df8eb
SSDEEP:	24576:KXJAMgUJXKu3FSwdndX74wpfDH3UMQqbfm14I2D3Nrq7yF3lqnYwt:02pu3l2wpfDEjqa14IS5qfn/
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......W.!z..O)..O)..O)...)..O)..N)3.O)...)..O)...)..O)...)..O)Rich..O)................PE..L...nZ{f...................................

Signature Hits	Behavior Group	Mitre Attack
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion
PE file contains executable resources (Code or Archives)	System Summary
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary	Masquerading
PE file has section (not .text) which is very likely to contain packed code (zlib compression ratio < 0.011)	System Summary	Software Packing
Creates temporary files	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion
PE file has an executable .text section and no other executable section	System Summary
Reads ini files	System Summary	File and Directory Discovery
Reads software policies	System Summary	System Information Discovery
Sample might require command line arguments	System Summary
Tries to load missing DLLs	System Summary	DLL Side-Loading
URLs found in memory or binary data	Networking
Uses an in-process (OLE) Automation server	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file has a big raw section	System Summary
PE / OLE file has a valid certificate	Compliance, System Summary
Submission file is bigger than most known malware samples	System Summary

C:\Users\user\AppData\Local\Temp\n1s\nchdata.cab

Microsoft Cabinet archive data, Windows 2000/XP setup, 433993 bytes, 1 file, at 0x2c +A "resource.dat", number 1, 25 datablocks, 0x1503 compression

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\n1s\nchdata.cab
Category:	dropped
Dump:	nchdata.cab.0.dr
ID:	dr_2
Target ID:	0
Process:	C:\Users\user\Desktop\essetup.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 433993 bytes, 1 file, at 0x2c +A "resource.dat", number 1, 25 datablocks, 0x1503 compression
Entropy:	7.9991830347405966
Encrypted:	true
Ssdeep:	12288:mlbsSAMgUHrFXAlJu32OS6nyadnqoFfnRHDfs4:mJAMgUJXKu3FSwdndXn
Size:	433993
Whitelisted:	false
Reputation:	low

C:\Users\user\AppData\Local\Temp\n1s\nchdata.dat

PE32+ executable (DLL) (GUI) x86-64, for MS Windows

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\n1s\nchdata.dat
Category:	dropped
Dump:	nchdata.dat.0.dr
ID:	dr_3
Target ID:	0
Process:	C:\Users\user\Desktop\essetup.exe
Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy:	5.994837242938757
Encrypted:	false
Ssdeep:	12288:QFzS6ZJfchnqF2XXCUCo6B706kqwx1EADjWCsDOmfZs:izSok22XSFn7UTiSmfZs
Size:	805215
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion
Spawns processes	System Summary	Process Injection

C:\Users\user\AppData\Local\Temp\n1s\nchsetup.cab

Microsoft Cabinet archive data, Windows 2000/XP setup, 864221 bytes, 1 file, at 0x2c +A "Scribe.exe", number 1, 71 datablocks, 0x1503 compression

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\n1s\nchsetup.cab
Category:	dropped
Dump:	nchsetup.cab.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\essetup.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 864221 bytes, 1 file, at 0x2c +A "Scribe.exe", number 1, 71 datablocks, 0x1503 compression
Entropy:	7.999734709500922
Encrypted:	true
Ssdeep:	24576:04wpfDH3UMQqbfm14I2D3Nrq7yF3lqnYwU:NwpfDEjqa14IS5qfni
Size:	864221
Whitelisted:	false
Reputation:	low

C:\Users\user\AppData\Local\Temp\n1s\nchsetup.exe

PE32 executable (GUI) Intel 80386, for MS Windows

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\n1s\nchsetup.exe
Category:	dropped
Dump:	nchsetup.exe.0.dr
ID:	dr_1
Target ID:	0
Process:	C:\Users\user\Desktop\essetup.exe
Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	6.268152982076055
Encrypted:	false
Ssdeep:	24576:/pyFpD64I/zLKECN0qYViCwxsGZJVBS+BCXtOGmh8EpRq5sWAMODrUY:eNI/TPrMd4AGmKlKMov
Size:	2294512
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Drops PE files	Persistence and Installation Behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)	Malware Analysis System Evasion
Sigma detected: CurrentVersion Autorun Keys Modification	System Summary
Creates an autostart registry key	Boot Survival	Registry Run Keys / Startup Folder
Creates files inside the user directory	System Summary	Masquerading
Creates guard pages, often used to prevent reverse engineering and debugging	Anti Debugging	Disable or Modify Tools
Spawns processes	System Summary	Process Injection
Tries to load missing DLLs	System Summary	DLL Side-Loading
Found GUI installer (many successful clicks)	System Summary

C:\Users\user\AppData\Local\Temp\n2s\nchdata.cab

Microsoft Cabinet archive data, Windows 2000/XP setup, 433993 bytes, 1 file, at 0x2c +A "resource.dat", number 1, 25 datablocks, 0x1503 compression

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\n2s\nchdata.cab
Category:	dropped
Dump:	nchdata.cab.5.dr
ID:	dr_6
Target ID:	5
Process:	C:\Users\user\Desktop\essetup.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 433993 bytes, 1 file, at 0x2c +A "resource.dat", number 1, 25 datablocks, 0x1503 compression
Entropy:	7.9991830347405966
Encrypted:	true
Ssdeep:	12288:mlbsSAMgUHrFXAlJu32OS6nyadnqoFfnRHDfs4:mJAMgUJXKu3FSwdndXn
Size:	433993
Whitelisted:	false
Reputation:	low

C:\Users\user\AppData\Local\Temp\n2s\nchdata.dat

PE32+ executable (DLL) (GUI) x86-64, for MS Windows

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\n2s\nchdata.dat
Category:	dropped
Dump:	nchdata.dat.5.dr
ID:	dr_7
Target ID:	5
Process:	C:\Users\user\Desktop\essetup.exe
Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy:	5.994837242938757
Encrypted:	false
Ssdeep:	12288:QFzS6ZJfchnqF2XXCUCo6B706kqwx1EADjWCsDOmfZs:izSok22XSFn7UTiSmfZs
Size:	805215
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion
Spawns processes	System Summary	Process Injection

C:\Users\user\AppData\Local\Temp\n2s\nchsetup.cab

Microsoft Cabinet archive data, Windows 2000/XP setup, 864221 bytes, 1 file, at 0x2c +A "Scribe.exe", number 1, 71 datablocks, 0x1503 compression

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\n2s\nchsetup.cab
Category:	dropped
Dump:	nchsetup.cab.5.dr
ID:	dr_4
Target ID:	5
Process:	C:\Users\user\Desktop\essetup.exe
Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 864221 bytes, 1 file, at 0x2c +A "Scribe.exe", number 1, 71 datablocks, 0x1503 compression
Entropy:	7.999734709500922
Encrypted:	true
Ssdeep:	24576:04wpfDH3UMQqbfm14I2D3Nrq7yF3lqnYwU:NwpfDEjqa14IS5qfni
Size:	864221
Whitelisted:	false
Reputation:	low

C:\Users\user\AppData\Local\Temp\n2s\nchsetup.exe

PE32 executable (GUI) Intel 80386, for MS Windows

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\n2s\nchsetup.exe
Category:	dropped
Dump:	nchsetup.exe.5.dr
ID:	dr_5
Target ID:	5
Process:	C:\Users\user\Desktop\essetup.exe
Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	6.268152982076055
Encrypted:	false
Ssdeep:	24576:/pyFpD64I/zLKECN0qYViCwxsGZJVBS+BCXtOGmh8EpRq5sWAMODrUY:eNI/TPrMd4AGmKlKMov
Size:	2294512
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Drops PE files	Persistence and Installation Behavior
Spawns processes	System Summary	Process Injection
Tries to load missing DLLs	System Summary	DLL Side-Loading

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\essetup.exe

"C:\Users\user\Desktop\essetup.exe"

Details

Is windows:	false
Is dropped:	false
PID:	7488
Target ID:	0
Parent PID:	2580
Name:	essetup.exe
Path:	C:\Users\user\Desktop\essetup.exe
Commandline:	"C:\Users\user\Desktop\essetup.exe"
Size:	1335024
MD5:	3CB6D589A774C51A099AB6EF738E3E36
Time:	06:55:59
Date:	31/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0xb20000
Modulesize:	1327104
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
PE file contains executable resources (Code or Archives)	System Summary
Sample file is different than original file name gathered from version info	System Summary
Sigma detected: CurrentVersion Autorun Keys Modification	System Summary
Uses 32bit PE files	Compliance, System Summary
PE file has section (not .text) which is very likely to contain packed code (zlib compression ratio < 0.011)	System Summary	Software Packing
PE file has an executable .text section and no other executable section	System Summary
Sample might require command line arguments	System Summary	Command and Scripting Interpreter
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file has a big raw section	System Summary
PE / OLE file has a valid certificate	Compliance, System Summary
Submission file is bigger than most known malware samples	System Summary

C:\Users\user\Desktop\essetup.exe

"C:\Users\user\Desktop\essetup.exe"

Details

Is windows:	false
Is dropped:	false
PID:	7616
Target ID:	2
Parent PID:	2580
Name:	essetup.exe
Path:	C:\Users\user\Desktop\essetup.exe
Commandline:	"C:\Users\user\Desktop\essetup.exe"
Size:	1335024
MD5:	3CB6D589A774C51A099AB6EF738E3E36
Time:	06:56:07
Date:	31/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	false
Is elevated:	false
Modulebase:	0xb20000
Modulesize:	1327104
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
PE file contains executable resources (Code or Archives)	System Summary
Sample file is different than original file name gathered from version info	System Summary
Sigma detected: CurrentVersion Autorun Keys Modification	System Summary
Uses 32bit PE files	Compliance, System Summary
PE file has section (not .text) which is very likely to contain packed code (zlib compression ratio < 0.011)	System Summary	Software Packing
PE file has an executable .text section and no other executable section	System Summary
Sample might require command line arguments	System Summary	Command and Scripting Interpreter
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file has a big raw section	System Summary
PE / OLE file has a valid certificate	Compliance, System Summary
Submission file is bigger than most known malware samples	System Summary

C:\Users\user\Desktop\essetup.exe

"C:\Users\user\Desktop\essetup.exe"

Details

Is windows:	false
Is dropped:	false
PID:	7668
Target ID:	5
Parent PID:	2580
Name:	essetup.exe
Path:	C:\Users\user\Desktop\essetup.exe
Commandline:	"C:\Users\user\Desktop\essetup.exe"
Size:	1335024
MD5:	3CB6D589A774C51A099AB6EF738E3E36
Time:	06:56:08
Date:	31/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0xb20000
Modulesize:	1327104
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
PE file contains executable resources (Code or Archives)	System Summary
Sample file is different than original file name gathered from version info	System Summary
Sigma detected: CurrentVersion Autorun Keys Modification	System Summary
Uses 32bit PE files	Compliance, System Summary
PE file has section (not .text) which is very likely to contain packed code (zlib compression ratio < 0.011)	System Summary	Software Packing
PE file has an executable .text section and no other executable section	System Summary
Sample might require command line arguments	System Summary	Command and Scripting Interpreter
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file has a big raw section	System Summary
PE / OLE file has a valid certificate	Compliance, System Summary
Submission file is bigger than most known malware samples	System Summary

C:\Users\user\Desktop\essetup.exe

"C:\Users\user\Desktop\essetup.exe"

Details

Is windows:	false
Is dropped:	false
PID:	7784
Target ID:	7
Parent PID:	2580
Name:	essetup.exe
Path:	C:\Users\user\Desktop\essetup.exe
Commandline:	"C:\Users\user\Desktop\essetup.exe"
Size:	1335024
MD5:	3CB6D589A774C51A099AB6EF738E3E36
Time:	06:56:15
Date:	31/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	false
Is elevated:	false
Modulebase:	0xb20000
Modulesize:	1327104
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
PE file contains executable resources (Code or Archives)	System Summary
Sample file is different than original file name gathered from version info	System Summary
Sigma detected: CurrentVersion Autorun Keys Modification	System Summary
Uses 32bit PE files	Compliance, System Summary
PE file has section (not .text) which is very likely to contain packed code (zlib compression ratio < 0.011)	System Summary	Software Packing
PE file has an executable .text section and no other executable section	System Summary
Sample might require command line arguments	System Summary	Command and Scripting Interpreter
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file has a big raw section	System Summary
PE / OLE file has a valid certificate	Compliance, System Summary
Submission file is bigger than most known malware samples	System Summary

C:\Users\user\Desktop\essetup.exe

"C:\Users\user\Desktop\essetup.exe"

Details

Is windows:	false
Is dropped:	false
PID:	7844
Target ID:	10
Parent PID:	2580
Name:	essetup.exe
Path:	C:\Users\user\Desktop\essetup.exe
Commandline:	"C:\Users\user\Desktop\essetup.exe"
Size:	1335024
MD5:	3CB6D589A774C51A099AB6EF738E3E36
Time:	06:56:16
Date:	31/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0xb20000
Modulesize:	1327104
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion	Security Software Discovery
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
PE file contains executable resources (Code or Archives)	System Summary
Sample file is different than original file name gathered from version info	System Summary
Sigma detected: CurrentVersion Autorun Keys Modification	System Summary
Uses 32bit PE files	Compliance, System Summary
PE file has section (not .text) which is very likely to contain packed code (zlib compression ratio < 0.011)	System Summary	Software Packing
PE file has an executable .text section and no other executable section	System Summary
Sample might require command line arguments	System Summary	Command and Scripting Interpreter
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking
Binary contains paths to debug symbols	Compliance, System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file has a big raw section	System Summary
PE / OLE file has a valid certificate	Compliance, System Summary
Submission file is bigger than most known malware samples	System Summary

C:\Users\user\AppData\Local\Temp\n1s\nchsetup.exe

"C:\Users\user\AppData\Local\Temp\n1s\nchsetup.exe" -installer "C:\Users\user\Desktop\essetup.exe" -instdata "C:\Users\user\AppData\Local\Temp\n1s\nchdata.dat"

Details

Is windows:	false
Is dropped:	true
PID:	7528
Target ID:	1
Parent PID:	7488
Name:	nchsetup.exe
Path:	C:\Users\user\AppData\Local\Temp\n1s\nchsetup.exe
Commandline:	"C:\Users\user\AppData\Local\Temp\n1s\nchsetup.exe" -installer "C:\Users\user\Desktop\essetup.exe" -instdata "C:\Users\user\AppData\Local\Temp\n1s\nchdata.dat"
Size:	2294512
MD5:	BA3E5C54EA069C5A70A2D0F1CDC68BA8
Time:	06:55:59
Date:	31/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0xe50000
Modulesize:	2899968
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Drops PE files	Persistence and Installation Behavior
Sigma detected: CurrentVersion Autorun Keys Modification	System Summary
Sample might require command line arguments	System Summary	Command and Scripting Interpreter
Spawns processes	System Summary	Process Injection
Binary contains paths to debug symbols	Compliance, System Summary

C:\Users\user\AppData\Local\Temp\n2s\nchsetup.exe

"C:\Users\user\AppData\Local\Temp\n2s\nchsetup.exe" -installer "C:\Users\user\Desktop\essetup.exe" -instdata "C:\Users\user\AppData\Local\Temp\n2s\nchdata.dat"

Details

Is windows:	false
Is dropped:	true
PID:	7700
Target ID:	6
Parent PID:	7668
Name:	nchsetup.exe
Path:	C:\Users\user\AppData\Local\Temp\n2s\nchsetup.exe
Commandline:	"C:\Users\user\AppData\Local\Temp\n2s\nchsetup.exe" -installer "C:\Users\user\Desktop\essetup.exe" -instdata "C:\Users\user\AppData\Local\Temp\n2s\nchdata.dat"
Size:	2294512
MD5:	BA3E5C54EA069C5A70A2D0F1CDC68BA8
Time:	06:56:08
Date:	31/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0xf60000
Modulesize:	2899968
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Drops PE files	Persistence and Installation Behavior
Sigma detected: CurrentVersion Autorun Keys Modification	System Summary
Sample might require command line arguments	System Summary	Command and Scripting Interpreter
Spawns processes	System Summary	Process Injection
Binary contains paths to debug symbols	Compliance, System Summary

C:\Users\user\AppData\Local\Temp\n2s\nchsetup.exe

"C:\Users\user\AppData\Local\Temp\n2s\nchsetup.exe" -installer "C:\Users\user\Desktop\essetup.exe" -instdata "C:\Users\user\AppData\Local\Temp\n2s\nchdata.dat"

Details

Is windows:	false
Is dropped:	true
PID:	7928
Target ID:	11
Parent PID:	7844
Name:	nchsetup.exe
Path:	C:\Users\user\AppData\Local\Temp\n2s\nchsetup.exe
Commandline:	"C:\Users\user\AppData\Local\Temp\n2s\nchsetup.exe" -installer "C:\Users\user\Desktop\essetup.exe" -instdata "C:\Users\user\AppData\Local\Temp\n2s\nchdata.dat"
Size:	2294512
MD5:	BA3E5C54EA069C5A70A2D0F1CDC68BA8
Time:	06:56:17
Date:	31/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0xb30000
Modulesize:	2899968
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Drops PE files	Persistence and Installation Behavior
Sigma detected: CurrentVersion Autorun Keys Modification	System Summary
Sample might require command line arguments	System Summary	Command and Scripting Interpreter
Spawns processes	System Summary	Process Injection
Binary contains paths to debug symbols	Compliance, System Summary

URLs

Name

Malicious

https://www.youtube.com/t/terms).

unknown

http://ffmpeg.orgavutil-52.nch.dllswscale-2.nch.dllswresample-0.nch.dllavcodec-55.nch.dllavformat-55

unknown

http://ocsp.entrust.net03

unknown

http://ocsp.entrust.net02

unknown

http://cgi.nch.com.au/cgi-bin/regcheck-it.exe?cmd=v&id=%d&magic=%d&magicb=%d

unknown

https://%s/software/it/thanks.html&secsfr=%d&active10s=%dRunsRunsSinceLastInstallMinutesRunSinceLast

unknown

https://www.nch.com.au/support/it/reg.htmlhttps://www.nch.com.au/upgrade/it/index.htmlCodice

unknown

http://www.audiochannel.net/versions/components/%s_it.txt1.00.0Verifica

unknown

https://www.nch.com.au/delegate/it/index.htmlServerIndirizzo:es:

unknown

http://www.audiochannel.net/components/it/notifications/scribe.txtpn

unknown

http://cgi.nch.com.au/cgi-bin/report-it.exetestfolderLaunch

unknown

http://www.nchsoftware.com/prism/it/index.htmlConverti

unknown

https://www.nch.com.au/software/it/bug.html?software=Scribe&version=13.18&lang=it&iid=%s&data=%s&rdf

unknown

https://www.nch.com.au/software/it/thanksforusing.htmlwww.nch.com.auInstallerDomain&usage=%04X%02XNC

unknown

http://www.audiochannel.net/versions/scribe_it.txt

unknown

http://crl.entrust.net/ts1ca.crl0

unknown

https://www.nch.com.au/it/index.htmlComponente

unknown

https://www.nch.com.au/software/it/bug.html?software=Scribe&version=13.18&lang=it&xi=GUI-%s&iid=%s&d

unknown

http://www.audiochannel.net/software/de/scribesetup_de.exehttps://www.nch.com.au/scribe/de/essetup.e

unknown

https://www.twitter.com/?status=%s%shttp://www.linkedin.com/shareArticle?url=%s&title=NCH

unknown

https://www.nch.com.au/software/it/audio.html

unknown

https://www.nch.com.au/kb/it/10271.htmlEsegui

unknown

https://%sit/index.html?ref=nchiodaboutScarica

unknown

https://www.nch.com.au/upgrade/it/index.html?software=scribe&upgradeid=%d&upgradekey=%shttps://www.n

unknown

http://www.nch.com.au/components/%s.exeDownload

unknown

http://cgi.nch.com.au/cgi-bin/regcheck-it.exe?cmd=v&id=%d&magic=%d&magicb=%dConvalidare

unknown

http://canberra.nchsoftware.com:120/minidumpupload

unknown

http://www.entrust.net/rpa03

unknown

http://www.nch.com.au/components/index.html

unknown

http://www.nch.com.au/switch/it/index.htmlConverti

unknown

http://www.opensource.org/licenses/lgpl-license.php

unknown

http://aia.entrust.net/ts1-chain256.cer01

unknown

https://www.nch.com.au/hardware/it/pedals.htmlAcquista

unknown

http://canberra.nchsoftware.com:120/minidumpupload%.4dWin%d%d%sUkn0(Msg%dLstCmd%d)GloIni1GuiIni2GuiD

unknown

http://www.nch.com.au/software/win2000/index.html-bootstrap-bseldlg

unknown

https://www.nch.com.au/software/it/bug.html?software=Scribe&version=13.18&lang=it&xi=%s-Win%d%d%s-MA

unknown

https://secure.nch.com.au/cgi-bin/getrefdata.exe?software=Scribe&lang=IT&platform=Win&download=%s&ii

unknown

https://secure.nch.com.au/cgi-bin/register.exe?software=scribeAcquista

unknown

http://www.nch.com.au/software/win98/index.htmlWindows

unknown

https://www.nch.com.au/software/it/rateit.html?software=Scribe&appname=%s&version=13.18&rating=%d&bu

unknown

http://www.audiochannel.net/versions/components/%s_it.txt

unknown

https://www.nchsoftware.com/%s.htmlit/indexhttps://www.nchsoftware.com/it/index.htmlhttps://www.nch.

unknown

https://secure.nch.com.au/cgi-bin/register-it.exe?action=q&id=%u&magica=%u&magicb=%u

unknown

http://www.audiochannel.net/versions/scribe_it.txtinfo=download=Nessuna

unknown

https://secure.nch.com.au/cgi-bin/register-it.exe?software=scribe&version=13.18%s%s%s%s%s%s%s&instby

unknown

http://%s/components/shared/%s.zipSoftware

unknown

https://secure.nch.com.au/cgi-bin/register-it.exe?software=scribeAcquista

unknown

http://crl.entrust.net/2048ca.crl0

unknown

https://nch.invisionzone.com/forum/239-italiano/https://www.nch.com.au/suggestions/it/index.html?sof

unknown

https://www.nchsoftware.com/%s/it/index.html?ref=nchsuitehttps://www.nch.com.au/%s/it/index.html?ref

unknown

https://www.entrust.net/rpa0

unknown

There are 41 hidden URLs, click here to show them.

Registry

Path

Value

Malicious

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

ScribeInstall

Details

TargetID:	1
Path:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Value name:	ScribeInstall
Value data:	C:\Users\user\Desktop\essetup.exe

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: CurrentVersion Autorun Keys Modification	System Summary
Creates an autostart registry key	Boot Survival	Registry Run Keys / Startup Folder

HKEY_CURRENT_USER\SOFTWARE\NCH Software\Scribe\Software

SVar

HKEY_CURRENT_USER\SOFTWARE\NCH Software\Scribe\Settings

DefaultFont

HKEY_CURRENT_USER\SOFTWARE\NCH Software\Scribe\Software

SVar

Memdumps

Base Address

Regiontype

Protect

Malicious

1250000

heap

page read and write

2FED000

heap

page read and write

2FEE000

heap

page read and write

2AA7000

heap

page read and write

6BB000

stack

page read and write

1113000

unkown

page read and write

2C65000

heap

page read and write

59A000

stack

page read and write

B31000

unkown

page execute read

357C000

stack

page read and write

FDE000

stack

page read and write

110C000

unkown

page write copy

59E000

stack

page read and write

EAB000

heap

page read and write

2FED000

heap

page read and write

8D0000

heap

page read and write

DC0000

heap

page read and write

B21000

unkown

page execute read

B24000

unkown

page readonly

AEA000

heap

page read and write

31FE000

stack

page read and write

7CB000

stack

page read and write

2C69000

heap

page read and write

156E000

stack

page read and write

2A6F000

heap

page read and write

F61000

unkown

page execute read

B20000

unkown

page readonly

B20000

unkown

page readonly

2A84000

heap

page read and write

30FF000

heap

page read and write

A80000

heap

page read and write

30F7000

heap

page read and write

B20000

unkown

page readonly

2C62000

heap

page read and write

B21000

unkown

page execute read

35BE000

stack

page read and write

E51000

unkown

page execute read

2C66000

heap

page read and write

30F3000

heap

page read and write

1003000

unkown

page read and write

B20000

unkown

page readonly

AE0000

heap

page read and write

AC0000

heap

page read and write

CDC000

unkown

page write copy

1260000

heap

page read and write

B22000

unkown

page readonly

26FF000

heap

page read and write

B24000

unkown

page readonly

109E000

unkown

page readonly

2ADE000

stack

page read and write

CF0000

unkown

page read and write

320C000

stack

page read and write

30FC000

heap

page read and write

A20000

heap

page read and write

31BF000

stack

page read and write

49B000

stack

page read and write

A50000

heap

page read and write

2C69000

heap

page read and write

11A7000

unkown

page readonly

E4C000

stack

page read and write

2B5B000

heap

page read and write

2B50000

heap

page read and write

90B000

heap

page read and write

29EE000

stack

page read and write

2B7D000

heap

page read and write

B30000

unkown

page readonly

2C62000

heap

page read and write

942000

heap

page read and write

B21000

unkown

page execute read

2C63000

heap

page read and write

AB8000

heap

page read and write

11A0000

heap

page read and write

110C000

unkown

page read and write

1120000

unkown

page read and write

E78000

heap

page read and write

D70000

heap

page read and write

2B37000

heap

page read and write

30FD000

heap

page read and write

2B5E000

heap

page read and write

310C000

stack

page read and write

2B6F000

heap

page read and write

D77000

unkown

page readonly

29BC000

stack

page read and write

2745000

heap

page read and write

2EB0000

heap

page read and write

DEE000

stack

page read and write

A30000

heap

page read and write

E70000

heap

page read and write

2A50000

heap

page read and write

11A7000

unkown

page readonly

B22000

unkown

page readonly

30BF000

stack

page read and write

30FB000

heap

page read and write

2C6B000

heap

page read and write

B10000

heap

page read and write

EDC000

heap

page read and write

347B000

stack

page read and write

30F4000

heap

page read and write

E51000

unkown

page execute read

30F3000

heap

page read and write

100E000

unkown

page read and write

2B20000

heap

page read and write

B21000

unkown

page execute read

B21000

unkown

page execute read

30F7000

heap

page read and write

ACF000

stack

page read and write

1010000

unkown

page read and write

A55000

heap

page read and write

B22000

unkown

page readonly

B21000

unkown

page execute read

2C63000

heap

page read and write

C6E000

unkown

page readonly

32FF000

stack

page read and write

B20000

unkown

page readonly

2D8E000

stack

page read and write

FFC000

unkown

page write copy

2AB5000

heap

page read and write

B24000

unkown

page readonly

A6E000

stack

page read and write

1097000

unkown

page readonly

5A0000

heap

page read and write

1268000

heap

page read and write

F60000

unkown

page readonly

2FEE000

heap

page read and write

2FEE000

heap

page read and write

109E000

unkown

page readonly

B20000

unkown

page readonly

800000

heap

page read and write

7BC000

stack

page read and write

F8E000

unkown

page readonly

A79000

stack

page read and write

2B5B000

heap

page read and write

120E000

stack

page read and write

A3D000

stack

page read and write

2B53000

heap

page read and write

DAF000

stack

page read and write

B22000

unkown

page readonly

343F000

stack

page read and write

B21000

unkown

page execute read

F30000

heap

page read and write

2B5E000

heap

page read and write

2C6F000

heap

page read and write

2C6E000

heap

page read and write

B20000

unkown

page readonly

93A000

heap

page read and write

F61000

unkown

page execute read

30F5000

heap

page read and write

343F000

stack

page read and write

A39000

stack

page read and write

E50000

unkown

page readonly

2C68000

heap

page read and write

D18000

heap

page read and write

26BD000

stack

page read and write

1097000

unkown

page readonly

317F000

stack

page read and write

327F000

stack

page read and write

B30000

unkown

page readonly

111E000

unkown

page read and write

B17000

heap

page read and write

B20000

unkown

page readonly

30FE000

heap

page read and write

2C6D000

heap

page read and write

B22000

unkown

page readonly

4CC000

stack

page read and write

D77000

unkown

page readonly

1115000

unkown

page read and write

E50000

unkown

page readonly

2C6C000

heap

page read and write

31FE000

stack

page read and write

118C000

stack

page read and write

DCE000

heap

page read and write

FFC000

unkown

page read and write

B24000

unkown

page readonly

E00000

heap

page read and write

E05000

heap

page read and write

5EE000

stack

page read and write

2C64000

heap

page read and write

CE5000

unkown

page read and write

333E000

stack

page read and write

166E000

stack

page read and write

B21000

unkown

page execute read

CE3000

unkown

page read and write

AE0000

heap

page read and write

2FEB000

heap

page read and write

B24000

unkown

page readonly

550000

heap

page read and write

30F3000

heap

page read and write

B1B000

heap

page read and write

B20000

unkown

page readonly

2E8F000

stack

page read and write

30F2000

heap

page read and write

8F4000

heap

page read and write

B22000

unkown

page readonly

2FEB000

heap

page read and write

C6E000

unkown

page readonly

B20000

unkown

page readonly

2FE3000

heap

page read and write

8D7000

heap

page read and write

B22000

unkown

page readonly

4D8000

stack

page read and write

D6D000

stack

page read and write

1200000

heap

page read and write

124D000

stack

page read and write

36BE000

stack

page read and write

F60000

unkown

page readonly

AB0000

heap

page read and write

2C63000

heap

page read and write

A6C000

stack

page read and write

2B5C000

heap

page read and write

2C62000

heap

page read and write

2C6A000

heap

page read and write

108B000

stack

page read and write

2C67000

heap

page read and write

2737000

heap

page read and write

2C69000

heap

page read and write

E50000

heap

page read and write

30F6000

heap

page read and write

D80000

heap

page read and write

D10000

heap

page read and write

2FE0000

heap

page read and write

B0D000

stack

page read and write

B30000

heap

page read and write

1850000

heap

page read and write

920000

heap

page read and write

11C0000

heap

page read and write

4DC000

stack

page read and write

30F1000

heap

page read and write

D79000

heap

page read and write

ACE000

stack

page read and write

CDC000

unkown

page read and write

D15000

heap

page read and write

30F9000

heap

page read and write

510000

heap

page read and write

AD0000

heap

page read and write

D10000

heap

page read and write

A70000

heap

page read and write

F10000

heap

page read and write

30F3000

heap

page read and write

AF0000

heap

page read and write

D34000

heap

page read and write

AE8000

heap

page read and write

30CF000

stack

page read and write

26E0000

heap

page read and write

D4B000

heap

page read and write

2E90000

heap

page read and write

30FA000

heap

page read and write

1860000

heap

page read and write

11F0000

heap

page read and write

2B5D000

heap

page read and write

30F2000

heap

page read and write

A7C000

stack

page read and write

B21000

unkown

page execute read

30F0000

heap

page read and write

2FCE000

stack

page read and write

2A9E000

stack

page read and write

32FF000

stack

page read and write

A3B000

stack

page read and write

2C67000

heap

page read and write

E93000

heap

page read and write

2D4E000

stack

page read and write

2C60000

heap

page read and write

515000

heap

page read and write

CF0000

heap

page read and write

B24000

unkown

page readonly

D90000

heap

page read and write

493000

stack

page read and write

152F000

stack

page read and write

2A80000

heap

page read and write

CEE000

unkown

page read and write

2C6B000

heap

page read and write

333E000

stack

page read and write

F8E000

unkown

page readonly

30F8000

heap

page read and write

B23000

heap

page read and write

2B5E000

heap

page read and write

30F9000

heap

page read and write

B24000

unkown

page readonly

2C61000

heap

page read and write

2B5E000

heap

page read and write

B24000

unkown

page readonly

31BF000

stack

page read and write

B22000

unkown

page readonly

B22000

unkown

page readonly

30FB000

heap

page read and write

B31000

unkown

page execute read

B22000

unkown

page readonly

1210000

heap

page read and write

337F000

stack

page read and write

CFB000

stack

page read and write

B24000

unkown

page readonly

2ACF000

stack

page read and write

30F9000

heap

page read and write

2A2D000

stack

page read and write

B24000

unkown

page readonly

2C63000

heap

page read and write

EE7000

heap

page read and write

2A90000

heap

page read and write

2C6C000

heap

page read and write

A2C000

stack

page read and write

B21000

unkown

page execute read

10DE000

stack

page read and write

2FEC000

heap

page read and write

AE0000

heap

page read and write

30FC000

heap

page read and write

30F2000

heap

page read and write

There are 295 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
essetup.exe

Files

Processes

URLs

Registry

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reportessetup.exe

Files

Processes

URLs

Registry

Memdumps

IOC Report
essetup.exe