Edit tour
Windows
Analysis Report
Setup.exe
Overview
General Information
| Sample name: | Setup.exe |
| Analysis ID: | 1546932 |
| MD5: | 9aa62835585485a40e45b2ae935c42b0 |
| SHA1: | 208bad1614fd19318aadce03531713a2ad885cd8 |
| SHA256: | d28331e98edccdfb2709fc1af526c0cec059a6d008e54a537ce1e10a32c876be |
| Infos: |  |
 | |
Detection
| Score: | 51 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Compliance
| Score: | 34 |
| Range: | 0 - 100 |
Signatures
Multi AV Scanner detection for dropped file
Creates multiple autostart registry keys
Found direct / indirect Syscall (likely to bypass EDR)
Machine Learning detection for sample
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality for read data from the clipboard
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
EXE planting / hijacking vulnerabilities found
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evasive API chain (date check)
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Installs a global mouse hook
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
OS version to string mapping found (often used in BOTs)
PE file contains an invalid checksum
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Stores files to the Windows start menu directory
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Classification
- System is w10x64
Setup.exe (PID: 7428 cmdline: "C:\Users\ user\Deskt op\Setup.e xe" MD5: 9AA62835585485A40E45B2AE935C42B0) 
chrome.exe (PID: 7592 cmdline: "C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --st art-maximi zed --sing le-argumen t https:// pcapp.stor e/installi ng.php?gui d=71434D56 -1548-ED3D -AEE6-C75A ECD93BF0&w inver=1904 5&version= fa.1091y&n ocache=202 4110113185 6.344&_fci d=17289417 59157143 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 7840 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --mojo-pla tform-chan nel-handle =2288 --fi eld-trial- handle=222 4,i,844552 0813696663 181,911132 8837801183 949,262144 --disable -features= Optimizati onGuideMod elDownload ing,Optimi zationHint s,Optimiza tionHintsF etching,Op timization TargetPred iction /pr efetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 7344 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= audio.mojo m.AudioSer vice --lan g=en-US -- service-sa ndbox-type =audio --m ojo-platfo rm-channel -handle=49 20 --field -trial-han dle=2224,i ,844552081 3696663181 ,911132883 7801183949 ,262144 -- disable-fe atures=Opt imizationG uideModelD ownloading ,Optimizat ionHints,O ptimizatio nHintsFetc hing,Optim izationTar getPredict ion /prefe tch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 7312 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= video_capt ure.mojom. VideoCaptu reService --lang=en- US --servi ce-sandbox -type=none --mojo-pl atform-cha nnel-handl e=5360 --f ield-trial -handle=22 24,i,84455 2081369666 3181,91113 2883780118 3949,26214 4 --disabl e-features =Optimizat ionGuideMo delDownloa ding,Optim izationHin ts,Optimiz ationHints Fetching,O ptimizatio nTargetPre diction /p refetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - nsa8674.tmp (PID: 8112 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\nsa867 4.tmp" /in ternal 172 8941759157 143 /force MD5: C50F23A6E99F3FAEC7A10CEB1884F73E) - PcAppStore.exe (PID: 7460 cmdline:
"C:\Users\ user\PCApp Store\PcAp pStore.exe " /init de fault MD5: 102313158837DA34ECE7FBE599A0EEC5) 
explorer.exe (PID: 2580 cmdline: C:\Windows \Explorer. EXE MD5: 662F4F92FDE3557E86D110526BB578D5) - PcAppStore.exe (PID: 5672 cmdline:
"C:\Users\ user\PCApp Store\PCAp pStore.exe " /init de fault MD5: 102313158837DA34ECE7FBE599A0EEC5) - pOuGjSvNILhcIwRDOLCmspHmtWP.exe (PID: 4816 cmdline:
"C:\Progra m Files (x 86)\BZKKZk cMMixCTPSg BTAwgXJshy GJOjPIIqin PEZEkDwush kBrzhLmiWj LMyiqTNCTq M\pOuGjSvN ILhcIwRDOL CmspHmtWP. exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - pOuGjSvNILhcIwRDOLCmspHmtWP.exe (PID: 5356 cmdline:
"C:\Progra m Files (x 86)\BZKKZk cMMixCTPSg BTAwgXJshy GJOjPIIqin PEZEkDwush kBrzhLmiWj LMyiqTNCTq M\pOuGjSvN ILhcIwRDOL CmspHmtWP. exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - pOuGjSvNILhcIwRDOLCmspHmtWP.exe (PID: 2300 cmdline:
"C:\Progra m Files (x 86)\BZKKZk cMMixCTPSg BTAwgXJshy GJOjPIIqin PEZEkDwush kBrzhLmiWj LMyiqTNCTq M\pOuGjSvN ILhcIwRDOL CmspHmtWP. exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - pOuGjSvNILhcIwRDOLCmspHmtWP.exe (PID: 3524 cmdline:
"C:\Progra m Files (x 86)\BZKKZk cMMixCTPSg BTAwgXJshy GJOjPIIqin PEZEkDwush kBrzhLmiWj LMyiqTNCTq M\pOuGjSvN ILhcIwRDOL CmspHmtWP. exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - pOuGjSvNILhcIwRDOLCmspHmtWP.exe (PID: 3688 cmdline:
"C:\Progra m Files (x 86)\BZKKZk cMMixCTPSg BTAwgXJshy GJOjPIIqin PEZEkDwush kBrzhLmiWj LMyiqTNCTq M\pOuGjSvN ILhcIwRDOL CmspHmtWP. exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - pOuGjSvNILhcIwRDOLCmspHmtWP.exe (PID: 5688 cmdline:
"C:\Progra m Files (x 86)\BZKKZk cMMixCTPSg BTAwgXJshy GJOjPIIqin PEZEkDwush kBrzhLmiWj LMyiqTNCTq M\pOuGjSvN ILhcIwRDOL CmspHmtWP. exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - pOuGjSvNILhcIwRDOLCmspHmtWP.exe (PID: 2696 cmdline:
"C:\Progra m Files (x 86)\BZKKZk cMMixCTPSg BTAwgXJshy GJOjPIIqin PEZEkDwush kBrzhLmiWj LMyiqTNCTq M\pOuGjSvN ILhcIwRDOL CmspHmtWP. exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - pOuGjSvNILhcIwRDOLCmspHmtWP.exe (PID: 1184 cmdline:
"C:\Progra m Files (x 86)\BZKKZk cMMixCTPSg BTAwgXJshy GJOjPIIqin PEZEkDwush kBrzhLmiWj LMyiqTNCTq M\pOuGjSvN ILhcIwRDOL CmspHmtWP. exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - pOuGjSvNILhcIwRDOLCmspHmtWP.exe (PID: 4324 cmdline:
"C:\Progra m Files (x 86)\BZKKZk cMMixCTPSg BTAwgXJshy GJOjPIIqin PEZEkDwush kBrzhLmiWj LMyiqTNCTq M\pOuGjSvN ILhcIwRDOL CmspHmtWP. exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - pOuGjSvNILhcIwRDOLCmspHmtWP.exe (PID: 3228 cmdline:
"C:\Progra m Files (x 86)\BZKKZk cMMixCTPSg BTAwgXJshy GJOjPIIqin PEZEkDwush kBrzhLmiWj LMyiqTNCTq M\pOuGjSvN ILhcIwRDOL CmspHmtWP. exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - pOuGjSvNILhcIwRDOLCmspHmtWP.exe (PID: 2312 cmdline:
"C:\Progra m Files (x 86)\BZKKZk cMMixCTPSg BTAwgXJshy GJOjPIIqin PEZEkDwush kBrzhLmiWj LMyiqTNCTq M\pOuGjSvN ILhcIwRDOL CmspHmtWP. exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - pOuGjSvNILhcIwRDOLCmspHmtWP.exe (PID: 1364 cmdline:
"C:\Progra m Files (x 86)\BZKKZk cMMixCTPSg BTAwgXJshy GJOjPIIqin PEZEkDwush kBrzhLmiWj LMyiqTNCTq M\pOuGjSvN ILhcIwRDOL CmspHmtWP. exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - pOuGjSvNILhcIwRDOLCmspHmtWP.exe (PID: 1704 cmdline:
"C:\Progra m Files (x 86)\BZKKZk cMMixCTPSg BTAwgXJshy GJOjPIIqin PEZEkDwush kBrzhLmiWj LMyiqTNCTq M\pOuGjSvN ILhcIwRDOL CmspHmtWP. exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - pOuGjSvNILhcIwRDOLCmspHmtWP.exe (PID: 280 cmdline:
"C:\Progra m Files (x 86)\BZKKZk cMMixCTPSg BTAwgXJshy GJOjPIIqin PEZEkDwush kBrzhLmiWj LMyiqTNCTq M\pOuGjSvN ILhcIwRDOL CmspHmtWP. exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - pOuGjSvNILhcIwRDOLCmspHmtWP.exe (PID: 5296 cmdline:
"C:\Progra m Files (x 86)\BZKKZk cMMixCTPSg BTAwgXJshy GJOjPIIqin PEZEkDwush kBrzhLmiWj LMyiqTNCTq M\pOuGjSvN ILhcIwRDOL CmspHmtWP. exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - pOuGjSvNILhcIwRDOLCmspHmtWP.exe (PID: 4144 cmdline:
"C:\Progra m Files (x 86)\BZKKZk cMMixCTPSg BTAwgXJshy GJOjPIIqin PEZEkDwush kBrzhLmiWj LMyiqTNCTq M\pOuGjSvN ILhcIwRDOL CmspHmtWP. exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - pOuGjSvNILhcIwRDOLCmspHmtWP.exe (PID: 1880 cmdline:
"C:\Progra m Files (x 86)\BZKKZk cMMixCTPSg BTAwgXJshy GJOjPIIqin PEZEkDwush kBrzhLmiWj LMyiqTNCTq M\pOuGjSvN ILhcIwRDOL CmspHmtWP. exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - pOuGjSvNILhcIwRDOLCmspHmtWP.exe (PID: 5804 cmdline:
"C:\Progra m Files (x 86)\BZKKZk cMMixCTPSg BTAwgXJshy GJOjPIIqin PEZEkDwush kBrzhLmiWj LMyiqTNCTq M\pOuGjSvN ILhcIwRDOL CmspHmtWP. exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - pOuGjSvNILhcIwRDOLCmspHmtWP.exe (PID: 4916 cmdline:
"C:\Progra m Files (x 86)\BZKKZk cMMixCTPSg BTAwgXJshy GJOjPIIqin PEZEkDwush kBrzhLmiWj LMyiqTNCTq M\pOuGjSvN ILhcIwRDOL CmspHmtWP. exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - pOuGjSvNILhcIwRDOLCmspHmtWP.exe (PID: 6020 cmdline:
"C:\Progra m Files (x 86)\BZKKZk cMMixCTPSg BTAwgXJshy GJOjPIIqin PEZEkDwush kBrzhLmiWj LMyiqTNCTq M\pOuGjSvN ILhcIwRDOL CmspHmtWP. exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - pOuGjSvNILhcIwRDOLCmspHmtWP.exe (PID: 2080 cmdline:
"C:\Progra m Files (x 86)\BZKKZk cMMixCTPSg BTAwgXJshy GJOjPIIqin PEZEkDwush kBrzhLmiWj LMyiqTNCTq M\pOuGjSvN ILhcIwRDOL CmspHmtWP. exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - pOuGjSvNILhcIwRDOLCmspHmtWP.exe (PID: 2916 cmdline:
"C:\Progra m Files (x 86)\BZKKZk cMMixCTPSg BTAwgXJshy GJOjPIIqin PEZEkDwush kBrzhLmiWj LMyiqTNCTq M\pOuGjSvN ILhcIwRDOL CmspHmtWP. exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - pOuGjSvNILhcIwRDOLCmspHmtWP.exe (PID: 1748 cmdline:
"C:\Progra m Files (x 86)\BZKKZk cMMixCTPSg BTAwgXJshy GJOjPIIqin PEZEkDwush kBrzhLmiWj LMyiqTNCTq M\pOuGjSvN ILhcIwRDOL CmspHmtWP. exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - pOuGjSvNILhcIwRDOLCmspHmtWP.exe (PID: 3484 cmdline:
"C:\Progra m Files (x 86)\BZKKZk cMMixCTPSg BTAwgXJshy GJOjPIIqin PEZEkDwush kBrzhLmiWj LMyiqTNCTq M\pOuGjSvN ILhcIwRDOL CmspHmtWP. exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - pOuGjSvNILhcIwRDOLCmspHmtWP.exe (PID: 648 cmdline:
"C:\Progra m Files (x 86)\BZKKZk cMMixCTPSg BTAwgXJshy GJOjPIIqin PEZEkDwush kBrzhLmiWj LMyiqTNCTq M\pOuGjSvN ILhcIwRDOL CmspHmtWP. exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - pOuGjSvNILhcIwRDOLCmspHmtWP.exe (PID: 824 cmdline:
"C:\Progra m Files (x 86)\BZKKZk cMMixCTPSg BTAwgXJshy GJOjPIIqin PEZEkDwush kBrzhLmiWj LMyiqTNCTq M\pOuGjSvN ILhcIwRDOL CmspHmtWP. exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - pOuGjSvNILhcIwRDOLCmspHmtWP.exe (PID: 4080 cmdline:
"C:\Progra m Files (x 86)\BZKKZk cMMixCTPSg BTAwgXJshy GJOjPIIqin PEZEkDwush kBrzhLmiWj LMyiqTNCTq M\pOuGjSvN ILhcIwRDOL CmspHmtWP. exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - pOuGjSvNILhcIwRDOLCmspHmtWP.exe (PID: 4812 cmdline:
"C:\Progra m Files (x 86)\BZKKZk cMMixCTPSg BTAwgXJshy GJOjPIIqin PEZEkDwush kBrzhLmiWj LMyiqTNCTq M\pOuGjSvN ILhcIwRDOL CmspHmtWP. exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - Watchdog.exe (PID: 7464 cmdline:
"C:\Users\ user\PCApp Store\Watc hdog.exe" /guid=7143 4D56-1548- ED3D-AEE6- C75AECD93B F0 /rid=20 2411011320 00.8457044 453 /ver=f a.1091y MD5: 3141E8E75FE71E17B1337CB97B37AB03)
- cleanup
⊘No configs have been found
⊘No yara matches
| Source: | Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): | ||
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | ReversingLabs: | ||
| Source: | ReversingLabs: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | EXE: | Jump to behavior | ||
| Source: | EXE: | Jump to behavior | ||
| Source: | EXE: | Jump to behavior | ||
| Source: | EXE: | Jump to behavior | ||
| Source: | EXE: | Jump to behavior | ||
| Source: | EXE: | Jump to behavior | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
Compliance | |
|---|
| Source: | EXE: | Jump to behavior | ||
| Source: | EXE: | Jump to behavior | ||
| Source: | EXE: | Jump to behavior | ||
| Source: | EXE: | Jump to behavior | ||
| Source: | EXE: | Jump to behavior | ||
| Source: | EXE: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | Registry value created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||