Edit tour

Windows Analysis Report
RecMin_Free_Install_v_2023_r1.zip

Overview

General Information

Sample name:	RecMin_Free_Install_v_2023_r1.zip
Analysis ID:	1546135
MD5:	ad47ddb1e8b4d4b30ce4a2dae1bd377a
SHA1:	905f92636bfc645f9745ebc1f431cbd1efd3c93e
SHA256:	46d6594dc87a5a143c86d699f38122ce96a0b8591b6b923ea5c05d01963de63e
Infos:

Detection

Score:	25
Range:	0 - 100
Whitelisted:	false
Confidence:	40%

Signatures

Drops executables to the windows directory (C:\Windows) and starts them

Creates files inside the system directory

Deletes files inside the Windows folder

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

May sleep (evasive loops) to hinder dynamic analysis

Modifies existing windows services

Queries the volume information (name, serial number etc) of a device

Sigma detected: Startup Folder File Write

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

rundll32.exe (PID: 6336 cmdline: C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)

setup.exe (PID: 6084 cmdline: "C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe" MD5: 60ED9A018050055B9652A46A28A72021)

setup.exe (PID: 1224 cmdline: "C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe" MD5: 60ED9A018050055B9652A46A28A72021)

Setup1.exe (PID: 5952 cmdline: C:\WINDOWS\Setup1.exe "C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\" "C:\WINDOWS\ST6UNST.000" "C:\WINDOWS\st6unst.exe" MD5: DBFDB6BD6492C5FE165943091223228E)

ST6UNST.EXE (PID: 3024 cmdline: C:\WINDOWS\st6unst.exe -n "C:\Windows\ST6UNST.000" -e 3 -f -w 5952 MD5: 2867D8CFF604A9FE2128D9D04B68C281)

setup.exe (PID: 724 cmdline: "C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe" MD5: 60ED9A018050055B9652A46A28A72021)

setup.exe (PID: 2188 cmdline: "C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe" MD5: 60ED9A018050055B9652A46A28A72021)

Setup1.exe (PID: 3044 cmdline: C:\WINDOWS\Setup1.exe "C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\" "C:\WINDOWS\ST6UNST.000" "C:\WINDOWS\st6unst.exe" MD5: DBFDB6BD6492C5FE165943091223228E)

ST6UNST.EXE (PID: 4404 cmdline: C:\WINDOWS\st6unst.exe -n "C:\Windows\ST6UNST.000" -e 3 -f -w 3044 MD5: 2867D8CFF604A9FE2128D9D04B68C281)

cleanup

Sigma Signatures

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe, ProcessId: 1224, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\ST6UNST Uninstaller.LNK

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	File opened: C:\Users\user
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	File opened: C:\Users\user\AppData\Roaming
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	File opened: C:\Users\user\AppData

Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	File created: C:\WINDOWS\ST6UNST.000
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	File created: C:\WINDOWS\SETUP.LST
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	File created: C:\WINDOWS\RMedit.CAB
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	File created: C:\WINDOWS\temp.000
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	File created: C:\Windows\SysWOW64\temp.000
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	File created: C:\Windows\SysWOW64\temp.000
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	File created: C:\WINDOWS\Setup1.exe
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	File created: C:\WINDOWS\ST6UNST.000
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	File created: C:\WINDOWS\SETUP.LST
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	File created: C:\WINDOWS\RMedit.CAB
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	File created: C:\WINDOWS\temp.000
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	File created: C:\WINDOWS\Setup1.exe

Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe

File deleted: C:\Windows\SETUP.LST

Source: classification engine

Classification label: sus25.evad.winZIP@13/10@0/0

Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\ST6UNST Uninstaller.LNK

Source: C:\Windows\Setup1.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe

File created: C:\Users\user\AppData\Local\Temp\msftqws.pdw

Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe

File read: C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini

Source: C:\Windows\System32\rundll32.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknown	Process created: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe "C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe"
Source: unknown	Process created: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe "C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe"
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process created: C:\Windows\Setup1.exe C:\WINDOWS\Setup1.exe "C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\" "C:\WINDOWS\ST6UNST.000" "C:\WINDOWS\st6unst.exe"
Source: C:\Windows\Setup1.exe	Process created: C:\Windows\ST6UNST.EXE C:\WINDOWS\st6unst.exe -n "C:\Windows\ST6UNST.000" -e 3 -f -w 5952
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process created: C:\Windows\Setup1.exe C:\WINDOWS\Setup1.exe "C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\" "C:\WINDOWS\ST6UNST.000" "C:\WINDOWS\st6unst.exe"
Source: C:\Windows\Setup1.exe	Process created: C:\Windows\ST6UNST.EXE C:\WINDOWS\st6unst.exe -n "C:\Windows\ST6UNST.000" -e 3 -f -w 5952
Source: unknown	Process created: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe "C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe"
Source: unknown	Process created: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe "C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe"
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process created: C:\Windows\Setup1.exe C:\WINDOWS\Setup1.exe "C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\" "C:\WINDOWS\ST6UNST.000" "C:\WINDOWS\st6unst.exe"
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process created: C:\Windows\Setup1.exe C:\WINDOWS\Setup1.exe "C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\" "C:\WINDOWS\ST6UNST.000" "C:\WINDOWS\st6unst.exe"
Source: C:\Windows\Setup1.exe	Process created: C:\Windows\ST6UNST.EXE C:\WINDOWS\st6unst.exe -n "C:\Windows\ST6UNST.000" -e 3 -f -w 3044
Source: C:\Windows\Setup1.exe	Process created: C:\Windows\ST6UNST.EXE C:\WINDOWS\st6unst.exe -n "C:\Windows\ST6UNST.000" -e 3 -f -w 3044

Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: acgenral.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: winmm.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: samcli.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: msacm32.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: version.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: userenv.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: mpr.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: netutils.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: aclayers.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: sfc.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: textshaping.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: cabinet.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: wldp.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: propsys.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: profapi.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: linkinfo.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: ntshrui.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: cscapi.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: vb6stkit.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: comcat.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: olepro32.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: msvbvm60.dll
Source: C:\Windows\Setup1.exe	Section loaded: apphelp.dll
Source: C:\Windows\Setup1.exe	Section loaded: acgenral.dll
Source: C:\Windows\Setup1.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Setup1.exe	Section loaded: winmm.dll
Source: C:\Windows\Setup1.exe	Section loaded: samcli.dll
Source: C:\Windows\Setup1.exe	Section loaded: msacm32.dll
Source: C:\Windows\Setup1.exe	Section loaded: version.dll
Source: C:\Windows\Setup1.exe	Section loaded: userenv.dll
Source: C:\Windows\Setup1.exe	Section loaded: dwmapi.dll
Source: C:\Windows\Setup1.exe	Section loaded: urlmon.dll
Source: C:\Windows\Setup1.exe	Section loaded: mpr.dll
Source: C:\Windows\Setup1.exe	Section loaded: sspicli.dll
Source: C:\Windows\Setup1.exe	Section loaded: winmmbase.dll
Source: C:\Windows\Setup1.exe	Section loaded: winmmbase.dll
Source: C:\Windows\Setup1.exe	Section loaded: iertutil.dll
Source: C:\Windows\Setup1.exe	Section loaded: srvcli.dll
Source: C:\Windows\Setup1.exe	Section loaded: netutils.dll
Source: C:\Windows\Setup1.exe	Section loaded: aclayers.dll
Source: C:\Windows\Setup1.exe	Section loaded: sfc.dll
Source: C:\Windows\Setup1.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Setup1.exe	Section loaded: msvbvm60.dll
Source: C:\Windows\Setup1.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Setup1.exe	Section loaded: wldp.dll
Source: C:\Windows\Setup1.exe	Section loaded: profapi.dll
Source: C:\Windows\Setup1.exe	Section loaded: vb6zz.dll
Source: C:\Windows\Setup1.exe	Section loaded: vb6es.dll
Source: C:\Windows\Setup1.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Setup1.exe	Section loaded: sxs.dll
Source: C:\Windows\Setup1.exe	Section loaded: propsys.dll
Source: C:\Windows\Setup1.exe	Section loaded: textinputframework.dll
Source: C:\Windows\Setup1.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\Setup1.exe	Section loaded: coremessaging.dll
Source: C:\Windows\Setup1.exe	Section loaded: ntmarta.dll
Source: C:\Windows\Setup1.exe	Section loaded: wintypes.dll
Source: C:\Windows\Setup1.exe	Section loaded: wintypes.dll
Source: C:\Windows\Setup1.exe	Section loaded: wintypes.dll
Source: C:\Windows\Setup1.exe	Section loaded: textshaping.dll
Source: C:\Windows\Setup1.exe	Section loaded: vb6stkit.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: apphelp.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: acgenral.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: uxtheme.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: winmm.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: samcli.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: msacm32.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: version.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: userenv.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: dwmapi.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: urlmon.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: mpr.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: sspicli.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: winmmbase.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: winmmbase.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: iertutil.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: srvcli.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: netutils.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: aclayers.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: sfc.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: sfc_os.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: kernel.appcore.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: textinputframework.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: coreuicomponents.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: coremessaging.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: ntmarta.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: coremessaging.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: wintypes.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: wintypes.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: wintypes.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: textshaping.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: windows.storage.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: wldp.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: propsys.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: profapi.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: acgenral.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: winmm.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: samcli.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: msacm32.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: version.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: userenv.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: mpr.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: netutils.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: aclayers.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: sfc.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: textshaping.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: cabinet.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: wldp.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: propsys.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: profapi.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: linkinfo.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: ntshrui.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: cscapi.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: vb6stkit.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: comcat.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: olepro32.dll
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Section loaded: msvbvm60.dll
Source: C:\Windows\Setup1.exe	Section loaded: apphelp.dll
Source: C:\Windows\Setup1.exe	Section loaded: acgenral.dll
Source: C:\Windows\Setup1.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Setup1.exe	Section loaded: winmm.dll
Source: C:\Windows\Setup1.exe	Section loaded: samcli.dll
Source: C:\Windows\Setup1.exe	Section loaded: msacm32.dll
Source: C:\Windows\Setup1.exe	Section loaded: version.dll
Source: C:\Windows\Setup1.exe	Section loaded: userenv.dll
Source: C:\Windows\Setup1.exe	Section loaded: dwmapi.dll
Source: C:\Windows\Setup1.exe	Section loaded: urlmon.dll
Source: C:\Windows\Setup1.exe	Section loaded: mpr.dll
Source: C:\Windows\Setup1.exe	Section loaded: sspicli.dll
Source: C:\Windows\Setup1.exe	Section loaded: winmmbase.dll
Source: C:\Windows\Setup1.exe	Section loaded: winmmbase.dll
Source: C:\Windows\Setup1.exe	Section loaded: iertutil.dll
Source: C:\Windows\Setup1.exe	Section loaded: srvcli.dll
Source: C:\Windows\Setup1.exe	Section loaded: netutils.dll
Source: C:\Windows\Setup1.exe	Section loaded: aclayers.dll
Source: C:\Windows\Setup1.exe	Section loaded: sfc.dll
Source: C:\Windows\Setup1.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Setup1.exe	Section loaded: msvbvm60.dll
Source: C:\Windows\Setup1.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Setup1.exe	Section loaded: wldp.dll
Source: C:\Windows\Setup1.exe	Section loaded: profapi.dll
Source: C:\Windows\Setup1.exe	Section loaded: vb6zz.dll
Source: C:\Windows\Setup1.exe	Section loaded: vb6es.dll
Source: C:\Windows\Setup1.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Setup1.exe	Section loaded: sxs.dll
Source: C:\Windows\Setup1.exe	Section loaded: propsys.dll
Source: C:\Windows\Setup1.exe	Section loaded: textinputframework.dll
Source: C:\Windows\Setup1.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\Setup1.exe	Section loaded: coremessaging.dll
Source: C:\Windows\Setup1.exe	Section loaded: ntmarta.dll
Source: C:\Windows\Setup1.exe	Section loaded: wintypes.dll
Source: C:\Windows\Setup1.exe	Section loaded: wintypes.dll
Source: C:\Windows\Setup1.exe	Section loaded: wintypes.dll
Source: C:\Windows\Setup1.exe	Section loaded: textshaping.dll
Source: C:\Windows\Setup1.exe	Section loaded: vb6stkit.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: apphelp.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: acgenral.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: uxtheme.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: winmm.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: samcli.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: msacm32.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: version.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: userenv.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: dwmapi.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: urlmon.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: mpr.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: sspicli.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: winmmbase.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: winmmbase.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: iertutil.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: srvcli.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: netutils.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: aclayers.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: sfc.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: sfc_os.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: kernel.appcore.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: textinputframework.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: coreuicomponents.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: coremessaging.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: ntmarta.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: wintypes.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: wintypes.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: wintypes.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: textshaping.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: windows.storage.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: wldp.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: propsys.dll
Source: C:\Windows\ST6UNST.EXE	Section loaded: profapi.dll

Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Source: RecMin_Free_Install_v_2023_r1.zip

Static file information: File size 15274040 > 1048576

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\Setup1.exe	Executable created and started: C:\WINDOWS\ST6UNST.EXE
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Executable created and started: C:\WINDOWS\Setup1.exe

Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	File created: C:\Users\user\AppData\Local\Temp\msftqws.pdw\VB6STKIT.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	File created: C:\Windows\Setup1.exe	Jump to dropped file
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	File created: C:\Windows\temp.000	Jump to dropped file
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	File created: C:\Users\user\AppData\Local\Temp\msftqws.pdw\VB6ES.DLL	Jump to dropped file

Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	File created: C:\Windows\Setup1.exe			Jump to dropped file
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	File created: C:\Windows\temp.000			Jump to dropped file

Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe

File created: C:\Windows\temp.000

Jump to dropped file

Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application\VBRuntime

Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\ST6UNST Uninstaller.LNK
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\ST6UNST Uninstaller.LNK

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Windows\Setup1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Setup1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Setup1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Setup1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Setup1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Setup1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Setup1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Setup1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Setup1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Windows\Setup1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Setup1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Setup1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Setup1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Setup1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Setup1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Setup1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Setup1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Setup1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Setup1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ST6UNST.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ST6UNST.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Windows\Setup1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Setup1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Setup1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Setup1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Setup1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Setup1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Setup1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Setup1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Setup1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Setup1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Setup1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Setup1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Setup1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Setup1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Setup1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Windows\Setup1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Setup1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Setup1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Setup1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Setup1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ST6UNST.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\ST6UNST.EXE	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Window / User API: threadDelayed 9592
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Window / User API: threadDelayed 9838

Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe TID: 932	Thread sleep count: 63 > 30
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe TID: 932	Thread sleep count: 324 > 30
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe TID: 932	Thread sleep count: 9592 > 30
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe TID: 2204	Thread sleep count: 64 > 30
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe TID: 2204	Thread sleep count: 9838 > 30
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe TID: 2204	Thread sleep count: 86 > 30

Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	File opened: C:\Users\user
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	File opened: C:\Users\user\AppData\Roaming
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	File opened: C:\Users\user\AppData

Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Setup1.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Setup1.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Setup1.exe	Queries volume information: C:\ VolumeInformation

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Windows Service	1 Windows Service	131 Masquerading	OS Credential Dumping	1 Virtualization/Sandbox Evasion	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Process Injection	1 Virtualization/Sandbox Evasion	LSASS Memory	1 Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	1 Rundll32	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	1 Process Injection	NTDS	11 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Source	Detection	Scanner	Label	Link
RecMin_Free_Install_v_2023_r1.zip	6%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\msftqws.pdw\VB6ES.DLL	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\msftqws.pdw\VB6STKIT.DLL	0%	ReversingLabs
C:\WINDOWS\ST6UNST.EXE (copy)	0%	ReversingLabs
C:\Windows\Setup1.exe	0%	ReversingLabs

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1546135
Start date and time:	2024-10-31 14:49:55 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	27
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample name:	RecMin_Free_Install_v_2023_r1.zip
Detection:	SUS
Classification:	sus25.evad.winZIP@13/10@0/0
Cookbook Comments:	Found application associated with file extension: .zip

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ctldl.windowsupdate.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: RecMin_Free_Install_v_2023_r1.zip

Created / dropped Files

C:\Users\user\AppData\Local\Temp\msftqws.pdw\VB6ES.DLL

Download File

Process:	C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	119568
Entropy (8bit):	3.4327374407766076
Encrypted:	false
SSDEEP:
MD5:	5920F5A17A7BB807EF3F1F7CB5558728
SHA1:	F1F19864BFCF4FBF317B1F8A234864F8CD0B3800
SHA-256:	B9C2FA6DECF3C7027C6AC7D363A1714B732E0B75AD17327F3E31C6B88FA9E92A
SHA-512:	31740ED25990CA269EF79DC1E191BABD9EC53142FBAC05BF2438A484195AB44AA2996B2B80D1ADD591E7439EB307AC2502FBE4F43A428FB32723E7FFEE181A43
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......9...........#..............................cf.................................^............................................... ...............................................................................................................rdata..p...........................@..@.rsrc........ ......................@..@.reloc..............................@..B.......................9...........................9................\..........9................`.......................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\msftqws.pdw\VB6STKIT.DLL

Download File

Process:	C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	101888
Entropy (8bit):	6.147352787680699
Encrypted:	false
SSDEEP:
MD5:	87AA9155ACC202711F5720718E1DFFCB
SHA1:	F39DAFDA494CA142539E477B41EBB829C30B77B7
SHA-256:	564747CFF8ABB9367F4D435BFADDB578AAB7E4CB4BF174F361D33846207540FE
SHA-512:	D90D54B68951C4FDBA69D620A4A8828DC13AC163BFD80F866DF68CF415A27B323538889AD2E0A54E7507873F8116EDF052650E517680088EF7650D109F8A6C2E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$................................E......Rich...........PE..L......6...........!.........z............... .......................................<...............................<.......2..................................H.................................................... ...............................text............................... ..`.rdata....... ... ..................@..@.data...x....@...<...4..............@....rsrc................p..............@..@.reloc...............x..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF0A381E4EDE7F967C.TMP

Download File

Process:	C:\Windows\Setup1.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	2.671538360102582
Encrypted:	false
SSDEEP:
MD5:	BF83DF439316E1AF22667C6331CDE6BC
SHA1:	D24798AB2BD13B9FFC2AB28B1E1D8CC722A2E63F
SHA-256:	A7F7E2C4CE9A8DF248976D43B687E8FF0DE9D6BBF594619F214000AA5AF3C774
SHA-512:	4C5127A2B10E80FE65BD0A68A16B6FE2F000491D86878636BCAA9CCDBE8C9C0B461A59782B96BD1BD25B7D31B5A32FCED49E99ECE071A3424E752CBE96EAABEF
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF1028A87FB36BFAC7.TMP

Download File

Process:	C:\Windows\Setup1.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	2.9100608461273785
Encrypted:	false
SSDEEP:
MD5:	1ADCCD9924CA2BAF4FBEF12435303922
SHA1:	4E0413AC975B610ED70C95F12CD21B0DE2F1A8D1
SHA-256:	ABA9121C2E0A4714DB144620840BDB0D715D40372C889B3993938B446BE8D33E
SHA-512:	B1E73304F24C6ABDD5F7DC9D4C50077C915EBF675657533747A1AF90F25999659831E79041053360885FE7089131BC89991C6A0E6F8A5CE7AFE33576609FD236
Malicious:	false
Reputation:	unknown
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ST6UNST Uninstaller.LNK

Download File

Process:	C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Archive, ctime=Thu Oct 31 12:50:41 2024, mtime=Thu Oct 31 12:50:42 2024, atime=Thu Oct 31 12:50:42 2024, length=74240, window=hide
Category:	dropped
Size (bytes):	958
Entropy (8bit):	4.574850572188734
Encrypted:	false
SSDEEP:
MD5:	7EC4E5C24F749E318C1F7B07F4E01856
SHA1:	3C0138D006C78D270A055A9D58F0DF023ED47E2A
SHA-256:	D62C66D281FE8B72667EFDABB64B21252148D1FFA7D5DC461192375513265987
SHA-512:	5449FC2006A4EA042788769F55D8DD1BD3DB3BD721CE62E3032BB6DD0CCC801C9416929D08D133BB7AB99C15BFA188FA81A72529FE8764CDC7B858BE7A8224AE
Malicious:	false
Reputation:	unknown
Preview:	L..................F.... ...H.4..+...;Q..+....O..+..."...........................P.O. .:i.....+00.../C:\...................V.1....._YVn..Windows.@......OwH_YVn....3...................... .W.i.n.d.o.w.s.....b.2..".._YVn .ST6UNST.EXE.H......_YUn_YVn..........................y%.S.T.6.U.N.S.T...E.X.E.......E...............-.......D............8......C:\Windows\ST6UNST.EXE....S.T.6.U.N.S.T. .U.n.i.n.s.t.a.l.l.e.r.......\.....\.....\.....\.....\.....\.....\.....\.....\.W.i.n.d.o.w.s.\.S.T.6.U.N.S.T...E.X.E...C.:.\.W.I.N.D.O.W.S.". .-.n. .C.:.\.W.I.N.D.O.W.S.\.S.T.6.U.N.S.T...0.0.0. .-.e. .1. .-.f.........$..................C..B..g..(.#....`.......X.......065367...........hT..CrF.f4... .$.............%..hT..CrF.f4... .$.............%.............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3.6.9.3.4.0.5.1.1.7.-.2.4.7.6.7.5.6.6.3.4.-.1.0.0.3.........9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\WINDOWS\ST6UNST.EXE (copy)

Download File

Process:	C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	2867D8CFF604A9FE2128D9D04B68C281
SHA1:	0DCAF9552202697BADC6324B67F3DB73A16FA408
SHA-256:	547D02BBED9F98A7E7EF23F07D48B6907AED594A31DF8E004E021BE813B0BA4F
SHA-512:	9D4D0D59638088324D5FD01D8FAAC7BCC0A4760079578C57D1F8FA79ADD7CE944A7CCF57433FA3B71A31ACDF394E6CB66FE04CC01F4B258CEC31798CE5F94C13
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ 5.A[..A[..A[.hG]..A[..A[.ZA[.Rich.A[.................PE..L.....:@.....................t......P.............@..........................`..............................................8........0...)..............................................................................x............................text............................... ..`.rdata..R...........................@..@.data...xF..........................@....rsrc....0...0...*..................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\RMedit.CAB

Download File

Process:	C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe
File Type:	Microsoft Cabinet archive data, many, 15372801 bytes, 68 files, at 0x1830 +A "RMedit.exe" +A "msvbvm60.dll", flags 0x4, ID 64812, number 1, extra bytes 6144 in head, 1473 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	15372801
Entropy (8bit):	7.998965446133331
Encrypted:	true
SSDEEP:
MD5:	2A6E2815E00A25B0B519C4EA4D717050
SHA1:	AA27219B38121F3F5C34DE3F38739914039145BE
SHA-256:	DF14881E7FB013B739C10A61B1AC2E6F56CE044E771CCAF51184EB83E526D7B3
SHA-512:	70CAD2406133E55976490664712A5532739D73238A32488264F5B6757E387C71F2C0068ED83BCC582544B7165EB3EB80AA275AD76A67003C6A1FC10E067C0348
Malicious:	false
Reputation:	unknown
Preview:	MSCF............0...........D...,.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SETUP.LST

Download File

Process:	C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe
File Type:	Generic INItialization configuration [Bootstrap Files]
Category:	dropped
Size (bytes):	8817
Entropy (8bit):	5.023831526706521
Encrypted:	false
SSDEEP:
MD5:	D951BC0B388358D6B43936318EBF9805
SHA1:	51FC70D54C130FE74FC689A36211A63C58852988
SHA-256:	6000E6C389A3F35A22174A3E2D3D44CEC9FBC6EC97643C8F64E8DA9C4411DC3D
SHA-512:	C0A0E899F2A2AA79AA2DFF5C2FEB7BBCF6FA3E062E8EE20D643AA451E7AC5F1082588AD869521E8F24BA5D5036E6E4B362ABB76AB3C59BF05CB2AC4F17379232
Malicious:	false
Reputation:	unknown
Preview:	[Bootstrap]..SetupTitle=Instalar..SetupText=Copiando archivos, espere...CabFile=RMedit.CAB..Spawn=Setup1.exe..Uninstal=st6unst.exe..TmpDir=msftqws.pdw..Cabs=1....[Bootstrap Files]..File1=@VB6STKIT.DLL,$(WinSysPathSysFile),,,7/15/00 12:00:00 AM,101888,6.0.84.50..File2=@COMCAT.DLL,$(WinSysPathSysFile),$(DLLSelfRegister),,6/1/99 12:00:00 AM,22288,4.71.1460.1..File3=@ASYCFILT.DLL,$(WinSysPathSysFile),,,3/8/99 12:00:00 AM,147728,2.40.4275.1..File4=@OLEPRO32.DLL,$(WinSysPathSysFile),$(DLLSelfRegister),,3/8/99 12:00:00 AM,164112,5.0.4275.1..File5=@OLEAUT32.DLL,$(WinSysPathSysFile),$(DLLSelfRegister),,4/12/00 12:00:00 AM,598288,2.40.4275.1..File6=@STDOLE2.TLB,$(WinSysPathSysFile),$(TLBRegister),,6/3/99 12:00:00 AM,17920,2.40.4275.1..File7=@msvbvm60.dll,$(WinSysPathSysFile),$(DLLSelfRegister),,5/7/22 6:20:00 AM,1436032,6.0.98.48..File8=@VB6ES.DLL,$(WinSysPath),,$(Shared),10/2/00 12:00:00 AM,119568,6.0.89.88....[IconGroups]..Group0=RecMin..PrivateGroup0=0..Parent0=$(Programs)....[RecMin]..Icon1=

C:\Windows\ST6UNST.000

Download File

Process:	C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	1772
Entropy (8bit):	5.388518443031204
Encrypted:	false
SSDEEP:
MD5:	DC8A8BE35F083DF8E75184CE8AA901CA
SHA1:	4236F9BEEB94CA3374D97EC3A92157F59987CCD0
SHA-256:	0B0CC4EBDF0110E9C91AC16C0C65060FF0614151080E17738B0115D5AFF77B62
SHA-512:	71B397E8EA45186DD899B366E8E01166E78BCE60FEE92D8A09D5FC4546E89B62C5EC5B6435C36FD427A887F428B140D4695461A28FA9E931361C2F0D7EC95BA9
Malicious:	false
Reputation:	unknown
Preview:	%% NO MODIFIQUE NI ELIMINE ESTE ARCHIVO. %% .. %% Este archivo contiene informaci.n acerca de la instalaci.n de una aplicaci.n. %% .. %% Se utilizar. para quitar autom.ticamente de su PC todos los componentes de la aplicaci.n, si elige hacerlo. %% ......NOTE: Inicio de la secci.n bootstrapper....CONFIG: Title: "RecMin2023"....ACTION: RegKey: "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion", "SharedDLLs"....ACTION: SystemFile: "C:\Windows\System32\VB6STKIT.DLL"..(No se puede encontrar el archivo o es de una versi.n antigua; se ha copiado el archivo nuevo)....ACTION: SystemFile: "C:\WINDOWS\SYSTEM32\COMCAT.DLL"..(El archivo en disco ya estaba actualizado)....ACTION: SystemFile: "C:\WINDOWS\SYSTEM32\ASYCFILT.DLL"..(El archivo en disco ya estaba actualizado)....ACTION: SystemFile: "C:\WINDOWS\SYSTEM32\OLEPRO32.DLL"..(El archivo en disco ya estaba actualizado)....ACTION: SystemFile: "C:\WINDOWS\SYSTEM32\OLEAUT32.DLL"..(El archivo en disco ya estaba actualizado)....ACTION: Sys

C:\Windows\Setup1.exe

Download File

Process:	C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	261928
Entropy (8bit):	5.905815568654951
Encrypted:	false
SSDEEP:
MD5:	DBFDB6BD6492C5FE165943091223228E
SHA1:	746ADE31DDA2C7470D0198F568A1972D591E4B1B
SHA-256:	126927B16FF92B8A3285EC43ECAC6EF85184137AE7F7EF74455F4E39F064591A
SHA-512:	3AF5BE76618BC2AC880950D4D8436AC320BA1D2563CB146A4A1EB27B39B05407F11B3EDDD846BEFA6A83A95422B564EAC682F4DACD41A27121BD1DE0D035A15C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X.J.9...9...9...%...9.......9.......9..Rich.9..................PE..L...^.:@.................`...p.......7.......p....@..........................0.......o.......................................V..(.......dX..............(...................................................0... ....................................text....R.......`.................. ..`.data....S...p.......p..............@....rsrc....`.......`..................@..@..:@............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\temp.000

Download File

Process:	C:\Users\user\Desktop\RecMin_Free_Install_v_2023_r1\setup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	74240
Entropy (8bit):	5.572668541697997
Encrypted:	false
SSDEEP:
MD5:	2867D8CFF604A9FE2128D9D04B68C281
SHA1:	0DCAF9552202697BADC6324B67F3DB73A16FA408
SHA-256:	547D02BBED9F98A7E7EF23F07D48B6907AED594A31DF8E004E021BE813B0BA4F
SHA-512:	9D4D0D59638088324D5FD01D8FAAC7BCC0A4760079578C57D1F8FA79ADD7CE944A7CCF57433FA3B71A31ACDF394E6CB66FE04CC01F4B258CEC31798CE5F94C13
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ 5.A[..A[..A[.hG]..A[..A[.ZA[.Rich.A[.................PE..L.....:@.....................t......P.............@..........................`..............................................8........0...)..............................................................................x............................text............................... ..`.rdata..R...........................@..@.data...xF..........................@....rsrc....0...0...*..................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Entropy (8bit):	7.999157979102075
TrID:	ZIP compressed archive (8000/1) 100.00%
File name:	RecMin_Free_Install_v_2023_r1.zip
File size:	15'274'040 bytes
MD5:	ad47ddb1e8b4d4b30ce4a2dae1bd377a
SHA1:	905f92636bfc645f9745ebc1f431cbd1efd3c93e
SHA256:	46d6594dc87a5a143c86d699f38122ce96a0b8591b6b923ea5c05d01963de63e
SHA512:	90031093f4837055872fe4e83ac05b1af2fdb4b9d3f67a8ce740021dfa9a539439da5b7a946dcd02e56ca1b7de236c9d81f9dd0eb2efe49ce19144972a428e73
SSDEEP:	393216:s+e8djieo6wGg88y2rOE/rQRaF8KjsmTyVRqafJUO8VlB2erug:s+e8RBsR878lTn6KjDOq1lB+g
TLSH:	AFF6338CA41A3F7E0BF5DA5676BEA52C4088B4BD8203C984371D23D159A66D72DFF4C8
File Content Preview:	PK........1.fV................RMedit.CAB...?.m....GIB.D*a...Dc.L..&.f.XbL...lE.Y+.$..ME.5...G.,Y....$..1<..\|=...5..f^..~}..8..<..n.....<._....2..V.......t.a..SL1..SL1..SL1..SL1..SL1..SL1..K/E.....Hj.o..X....fp...,....w~.n.4.]E1.O..x...e.nn...]@..$....1..H

File Icon


Icon Hash:	1c1c1e4e4ececedc

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used.For example, information about application windows could be used identify potential data to collect as well as identifying security tooling ( Security Software Discovery ) to evade.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report RecMin_Free_Install_v_2023_r1.zip

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Spreading

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Created / dropped Files

C:\Users\user\AppData\Local\Temp\msftqws.pdw\VB6ES.DLL

C:\Users\user\AppData\Local\Temp\msftqws.pdw\VB6STKIT.DLL

C:\Users\user\AppData\Local\Temp\~DF0A381E4EDE7F967C.TMP

C:\Users\user\AppData\Local\Temp\~DF1028A87FB36BFAC7.TMP

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ST6UNST Uninstaller.LNK

C:\WINDOWS\ST6UNST.EXE (copy)

C:\Windows\RMedit.CAB

C:\Windows\SETUP.LST

C:\Windows\ST6UNST.000

C:\Windows\Setup1.exe

C:\Windows\temp.000

Static File Info

General

File Icon

Windows Analysis Report
RecMin_Free_Install_v_2023_r1.zip