Edit tour
Windows
Analysis Report
Setup.exe
Overview
General Information
| Sample name: | Setup.exe |
| Analysis ID: | 1546037 |
| MD5: | c306c6af9bd1955956f52acc1c9327ea |
| SHA1: | 3b3ed814ac41a710212cc83d92fde56a38b42b17 |
| SHA256: | 9c7c1345990163c48c6f4801e26b12390c498395bf280a79ecf6aee816eefb49 |
| Infos: |  |
 | |
Detection
| Score: | 51 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Compliance
| Score: | 34 |
| Range: | 0 - 100 |
Signatures
Multi AV Scanner detection for dropped file
Creates multiple autostart registry keys
Found direct / indirect Syscall (likely to bypass EDR)
Machine Learning detection for sample
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality for read data from the clipboard
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
EXE planting / hijacking vulnerabilities found
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evasive API chain (date check)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Installs a global mouse hook
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
OS version to string mapping found (often used in BOTs)
PE file contains an invalid checksum
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Stores files to the Windows start menu directory
Uses 32bit PE files
Classification
- System is w10x64
Setup.exe (PID: 3752 cmdline: "C:\Users\ user\Deskt op\Setup.e xe" MD5: C306C6AF9BD1955956F52ACC1C9327EA) 
chrome.exe (PID: 2500 cmdline: "C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --st art-maximi zed --sing le-argumen t https:// pcapp.stor e/installi ng.php?gui d=71434D56 -1548-ED3D -AEE6-C75A ECD93BF0&w inver=1904 5&version= fa.1092c&n ocache=202 4103107142 2.152&_fci d=17302712 48380473 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 6708 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --mojo-pla tform-chan nel-handle =2184 --fi eld-trial- handle=200 0,i,153639 2652693120 8174,16248 3814149473 33763,2621 44 --disab le-feature s=Optimiza tionGuideM odelDownlo ading,Opti mizationHi nts,Optimi zationHint sFetching, Optimizati onTargetPr ediction / prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 7968 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= audio.mojo m.AudioSer vice --lan g=en-US -- service-sa ndbox-type =audio --m ojo-platfo rm-channel -handle=50 80 --field -trial-han dle=2000,i ,153639265 2693120817 4,16248381 4149473337 63,262144 --disable- features=O ptimizatio nGuideMode lDownloadi ng,Optimiz ationHints ,Optimizat ionHintsFe tching,Opt imizationT argetPredi ction /pre fetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 7980 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= video_capt ure.mojom. VideoCaptu reService --lang=en- US --servi ce-sandbox -type=none --mojo-pl atform-cha nnel-handl e=5240 --f ield-trial -handle=20 00,i,15363 9265269312 08174,1624 8381414947 333763,262 144 --disa ble-featur es=Optimiz ationGuide ModelDownl oading,Opt imizationH ints,Optim izationHin tsFetching ,Optimizat ionTargetP rediction /prefetch: 8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - nsw677C.tmp (PID: 5260 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\nsw677 C.tmp" /in ternal 173 0271248380 473 /force MD5: 84EE733F8014D22DAD2DFEF725489980) - PcAppStore.exe (PID: 7524 cmdline:
"C:\Users\ user\PCApp Store\PcAp pStore.exe " /init de fault MD5: 4B88D8ADA8D22622C30D581FC38EAA52) 
explorer.exe (PID: 2580 cmdline: C:\Windows \Explorer. EXE MD5: 662F4F92FDE3557E86D110526BB578D5) - PcAppStore.exe (PID: 4812 cmdline:
"C:\Users\ user\PCApp Store\PCAp pStore.exe " /init de fault MD5: 4B88D8ADA8D22622C30D581FC38EAA52) - eNrBbJNZNDIrmnEujkRRjzpbKbBnY.exe (PID: 1420 cmdline:
"C:\Progra m Files (x 86)\bBfwFu aCcwAdaAvf GFVfpYDGim eCowudURhS WOvntCyhZO hvev\eNrBb JNZNDIrmnE ujkRRjzpbK bBnY.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - eNrBbJNZNDIrmnEujkRRjzpbKbBnY.exe (PID: 4564 cmdline:
"C:\Progra m Files (x 86)\bBfwFu aCcwAdaAvf GFVfpYDGim eCowudURhS WOvntCyhZO hvev\eNrBb JNZNDIrmnE ujkRRjzpbK bBnY.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - eNrBbJNZNDIrmnEujkRRjzpbKbBnY.exe (PID: 1312 cmdline:
"C:\Progra m Files (x 86)\bBfwFu aCcwAdaAvf GFVfpYDGim eCowudURhS WOvntCyhZO hvev\eNrBb JNZNDIrmnE ujkRRjzpbK bBnY.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - eNrBbJNZNDIrmnEujkRRjzpbKbBnY.exe (PID: 4592 cmdline:
"C:\Progra m Files (x 86)\bBfwFu aCcwAdaAvf GFVfpYDGim eCowudURhS WOvntCyhZO hvev\eNrBb JNZNDIrmnE ujkRRjzpbK bBnY.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - eNrBbJNZNDIrmnEujkRRjzpbKbBnY.exe (PID: 2312 cmdline:
"C:\Progra m Files (x 86)\bBfwFu aCcwAdaAvf GFVfpYDGim eCowudURhS WOvntCyhZO hvev\eNrBb JNZNDIrmnE ujkRRjzpbK bBnY.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - eNrBbJNZNDIrmnEujkRRjzpbKbBnY.exe (PID: 4888 cmdline:
"C:\Progra m Files (x 86)\bBfwFu aCcwAdaAvf GFVfpYDGim eCowudURhS WOvntCyhZO hvev\eNrBb JNZNDIrmnE ujkRRjzpbK bBnY.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - eNrBbJNZNDIrmnEujkRRjzpbKbBnY.exe (PID: 5936 cmdline:
"C:\Progra m Files (x 86)\bBfwFu aCcwAdaAvf GFVfpYDGim eCowudURhS WOvntCyhZO hvev\eNrBb JNZNDIrmnE ujkRRjzpbK bBnY.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - eNrBbJNZNDIrmnEujkRRjzpbKbBnY.exe (PID: 2540 cmdline:
"C:\Progra m Files (x 86)\bBfwFu aCcwAdaAvf GFVfpYDGim eCowudURhS WOvntCyhZO hvev\eNrBb JNZNDIrmnE ujkRRjzpbK bBnY.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - eNrBbJNZNDIrmnEujkRRjzpbKbBnY.exe (PID: 2872 cmdline:
"C:\Progra m Files (x 86)\bBfwFu aCcwAdaAvf GFVfpYDGim eCowudURhS WOvntCyhZO hvev\eNrBb JNZNDIrmnE ujkRRjzpbK bBnY.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - eNrBbJNZNDIrmnEujkRRjzpbKbBnY.exe (PID: 2032 cmdline:
"C:\Progra m Files (x 86)\bBfwFu aCcwAdaAvf GFVfpYDGim eCowudURhS WOvntCyhZO hvev\eNrBb JNZNDIrmnE ujkRRjzpbK bBnY.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - eNrBbJNZNDIrmnEujkRRjzpbKbBnY.exe (PID: 2300 cmdline:
"C:\Progra m Files (x 86)\bBfwFu aCcwAdaAvf GFVfpYDGim eCowudURhS WOvntCyhZO hvev\eNrBb JNZNDIrmnE ujkRRjzpbK bBnY.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - eNrBbJNZNDIrmnEujkRRjzpbKbBnY.exe (PID: 1904 cmdline:
"C:\Progra m Files (x 86)\bBfwFu aCcwAdaAvf GFVfpYDGim eCowudURhS WOvntCyhZO hvev\eNrBb JNZNDIrmnE ujkRRjzpbK bBnY.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - eNrBbJNZNDIrmnEujkRRjzpbKbBnY.exe (PID: 4828 cmdline:
"C:\Progra m Files (x 86)\bBfwFu aCcwAdaAvf GFVfpYDGim eCowudURhS WOvntCyhZO hvev\eNrBb JNZNDIrmnE ujkRRjzpbK bBnY.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - eNrBbJNZNDIrmnEujkRRjzpbKbBnY.exe (PID: 5568 cmdline:
"C:\Progra m Files (x 86)\bBfwFu aCcwAdaAvf GFVfpYDGim eCowudURhS WOvntCyhZO hvev\eNrBb JNZNDIrmnE ujkRRjzpbK bBnY.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - eNrBbJNZNDIrmnEujkRRjzpbKbBnY.exe (PID: 5500 cmdline:
"C:\Progra m Files (x 86)\bBfwFu aCcwAdaAvf GFVfpYDGim eCowudURhS WOvntCyhZO hvev\eNrBb JNZNDIrmnE ujkRRjzpbK bBnY.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - eNrBbJNZNDIrmnEujkRRjzpbKbBnY.exe (PID: 2484 cmdline:
"C:\Progra m Files (x 86)\bBfwFu aCcwAdaAvf GFVfpYDGim eCowudURhS WOvntCyhZO hvev\eNrBb JNZNDIrmnE ujkRRjzpbK bBnY.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - eNrBbJNZNDIrmnEujkRRjzpbKbBnY.exe (PID: 5928 cmdline:
"C:\Progra m Files (x 86)\bBfwFu aCcwAdaAvf GFVfpYDGim eCowudURhS WOvntCyhZO hvev\eNrBb JNZNDIrmnE ujkRRjzpbK bBnY.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - eNrBbJNZNDIrmnEujkRRjzpbKbBnY.exe (PID: 2344 cmdline:
"C:\Progra m Files (x 86)\bBfwFu aCcwAdaAvf GFVfpYDGim eCowudURhS WOvntCyhZO hvev\eNrBb JNZNDIrmnE ujkRRjzpbK bBnY.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - eNrBbJNZNDIrmnEujkRRjzpbKbBnY.exe (PID: 5088 cmdline:
"C:\Progra m Files (x 86)\bBfwFu aCcwAdaAvf GFVfpYDGim eCowudURhS WOvntCyhZO hvev\eNrBb JNZNDIrmnE ujkRRjzpbK bBnY.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - eNrBbJNZNDIrmnEujkRRjzpbKbBnY.exe (PID: 2896 cmdline:
"C:\Progra m Files (x 86)\bBfwFu aCcwAdaAvf GFVfpYDGim eCowudURhS WOvntCyhZO hvev\eNrBb JNZNDIrmnE ujkRRjzpbK bBnY.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - eNrBbJNZNDIrmnEujkRRjzpbKbBnY.exe (PID: 6096 cmdline:
"C:\Progra m Files (x 86)\bBfwFu aCcwAdaAvf GFVfpYDGim eCowudURhS WOvntCyhZO hvev\eNrBb JNZNDIrmnE ujkRRjzpbK bBnY.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - eNrBbJNZNDIrmnEujkRRjzpbKbBnY.exe (PID: 5552 cmdline:
"C:\Progra m Files (x 86)\bBfwFu aCcwAdaAvf GFVfpYDGim eCowudURhS WOvntCyhZO hvev\eNrBb JNZNDIrmnE ujkRRjzpbK bBnY.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - eNrBbJNZNDIrmnEujkRRjzpbKbBnY.exe (PID: 5180 cmdline:
"C:\Progra m Files (x 86)\bBfwFu aCcwAdaAvf GFVfpYDGim eCowudURhS WOvntCyhZO hvev\eNrBb JNZNDIrmnE ujkRRjzpbK bBnY.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - eNrBbJNZNDIrmnEujkRRjzpbKbBnY.exe (PID: 5004 cmdline:
"C:\Progra m Files (x 86)\bBfwFu aCcwAdaAvf GFVfpYDGim eCowudURhS WOvntCyhZO hvev\eNrBb JNZNDIrmnE ujkRRjzpbK bBnY.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - eNrBbJNZNDIrmnEujkRRjzpbKbBnY.exe (PID: 3872 cmdline:
"C:\Progra m Files (x 86)\bBfwFu aCcwAdaAvf GFVfpYDGim eCowudURhS WOvntCyhZO hvev\eNrBb JNZNDIrmnE ujkRRjzpbK bBnY.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - eNrBbJNZNDIrmnEujkRRjzpbKbBnY.exe (PID: 3548 cmdline:
"C:\Progra m Files (x 86)\bBfwFu aCcwAdaAvf GFVfpYDGim eCowudURhS WOvntCyhZO hvev\eNrBb JNZNDIrmnE ujkRRjzpbK bBnY.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - eNrBbJNZNDIrmnEujkRRjzpbKbBnY.exe (PID: 5472 cmdline:
"C:\Progra m Files (x 86)\bBfwFu aCcwAdaAvf GFVfpYDGim eCowudURhS WOvntCyhZO hvev\eNrBb JNZNDIrmnE ujkRRjzpbK bBnY.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - eNrBbJNZNDIrmnEujkRRjzpbKbBnY.exe (PID: 6164 cmdline:
"C:\Progra m Files (x 86)\bBfwFu aCcwAdaAvf GFVfpYDGim eCowudURhS WOvntCyhZO hvev\eNrBb JNZNDIrmnE ujkRRjzpbK bBnY.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - Watchdog.exe (PID: 7664 cmdline:
"C:\Users\ user\PCApp Store\Watc hdog.exe" /guid=7143 4D56-1548- ED3D-AEE6- C75AECD93B F0 /rid=20 2410310715 18.5356897 281 /ver=f a.1092c MD5: 11F3801CB9FF046D6075F681971C4EB8)
- cleanup
⊘No configs have been found
⊘No yara matches
| Source: | Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): | ||
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | ReversingLabs: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | EXE: | Jump to behavior | ||
| Source: | EXE: | Jump to behavior | ||
| Source: | EXE: | Jump to behavior | ||
| Source: | EXE: | Jump to behavior | ||
| Source: | EXE: | Jump to behavior | ||
| Source: | EXE: | Jump to behavior | ||
| Source: | EXE: | Jump to behavior | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
Compliance | |
|---|
| Source: | EXE: | Jump to behavior | ||
| Source: | EXE: | Jump to behavior | ||
| Source: | EXE: | Jump to behavior | ||
| Source: | EXE: | Jump to behavior | ||
| Source: | EXE: | Jump to behavior | ||
| Source: | EXE: | Jump to behavior | ||
| Source: | EXE: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | Registry value created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||