Edit tour
Windows
Analysis Report
Setup.exe
Overview
General Information
| Sample name: | Setup.exe |
| Analysis ID: | 1554012 |
| MD5: | 92c35fbe82bf7e416805c9286746ac4d |
| SHA1: | c02243fb0053a5ba2eb71d8ccfe81553c3b4f191 |
| SHA256: | 1ae950affe325dddd05586f66c1a4edd5133ffd13a8017759f8992ac27472e69 |
| Infos: |  |
 | |
Detection
| Score: | 51 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Compliance
| Score: | 34 |
| Range: | 0 - 100 |
Signatures
Multi AV Scanner detection for dropped file
Creates multiple autostart registry keys
Found direct / indirect Syscall (likely to bypass EDR)
Machine Learning detection for sample
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Drops PE files
EXE planting / hijacking vulnerabilities found
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
IP address seen in connection with other malware
Installs a global mouse hook
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
OS version to string mapping found (often used in BOTs)
PE file contains an invalid checksum
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Stores files to the Windows start menu directory
Uses 32bit PE files
Classification
- System is w10x64
Setup.exe (PID: 2940 cmdline: "C:\Users\ user\Deskt op\Setup.e xe" MD5: 92C35FBE82BF7E416805C9286746AC4D) 
chrome.exe (PID: 1720 cmdline: "C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --st art-maximi zed --sing le-argumen t https:// pcapp.stor e/installi ng.php?gui d=2ED92742 -89DC-DD72 -92E8-869F A5A66493&w inver=1904 5&version= fa.1092c&n ocache=202 4111116151 9.190&_fci d=17313542 02975821 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 2780 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --mojo-pla tform-chan nel-handle =1896 --fi eld-trial- handle=202 0,i,991924 5016783265 167,136811 0808741966 562,262144 --disable -features= Optimizati onGuideMod elDownload ing,Optimi zationHint s,Optimiza tionHintsF etching,Op timization TargetPred iction /pr efetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 7348 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= audio.mojo m.AudioSer vice --lan g=en-US -- service-sa ndbox-type =audio --m ojo-platfo rm-channel -handle=49 64 --field -trial-han dle=2020,i ,991924501 6783265167 ,136811080 8741966562 ,262144 -- disable-fe atures=Opt imizationG uideModelD ownloading ,Optimizat ionHints,O ptimizatio nHintsFetc hing,Optim izationTar getPredict ion /prefe tch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 7356 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= video_capt ure.mojom. VideoCaptu reService --lang=en- US --servi ce-sandbox -type=none --mojo-pl atform-cha nnel-handl e=5248 --f ield-trial -handle=20 20,i,99192 4501678326 5167,13681 1080874196 6562,26214 4 --disabl e-features =Optimizat ionGuideMo delDownloa ding,Optim izationHin ts,Optimiz ationHints Fetching,O ptimizatio nTargetPre diction /p refetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - nsi70C.tmp (PID: 7884 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\nsi70C .tmp" /int ernal 1731 3542029758 21 /force MD5: 84EE733F8014D22DAD2DFEF725489980) - PcAppStore.exe (PID: 5736 cmdline:
"C:\Users\ user\PCApp Store\PcAp pStore.exe " /init de fault MD5: 4B88D8ADA8D22622C30D581FC38EAA52) 
explorer.exe (PID: 1028 cmdline: C:\Windows \Explorer. EXE MD5: 662F4F92FDE3557E86D110526BB578D5) - PcAppStore.exe (PID: 7272 cmdline:
"C:\Users\ user\PCApp Store\PCAp pStore.exe " /init de fault MD5: 4B88D8ADA8D22622C30D581FC38EAA52) - RoXOpwnzkOItZgrk.exe (PID: 2140 cmdline:
"C:\Progra m Files (x 86)\STnbPU BnkXHdMrjo XRqZBmgHBC FvxGtaVuMx vyCeqdAoRn LgPh\RoXOp wnzkOItZgr k.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - RoXOpwnzkOItZgrk.exe (PID: 5460 cmdline:
"C:\Progra m Files (x 86)\STnbPU BnkXHdMrjo XRqZBmgHBC FvxGtaVuMx vyCeqdAoRn LgPh\RoXOp wnzkOItZgr k.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - RoXOpwnzkOItZgrk.exe (PID: 5376 cmdline:
"C:\Progra m Files (x 86)\STnbPU BnkXHdMrjo XRqZBmgHBC FvxGtaVuMx vyCeqdAoRn LgPh\RoXOp wnzkOItZgr k.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - RoXOpwnzkOItZgrk.exe (PID: 5608 cmdline:
"C:\Progra m Files (x 86)\STnbPU BnkXHdMrjo XRqZBmgHBC FvxGtaVuMx vyCeqdAoRn LgPh\RoXOp wnzkOItZgr k.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - RoXOpwnzkOItZgrk.exe (PID: 2520 cmdline:
"C:\Progra m Files (x 86)\STnbPU BnkXHdMrjo XRqZBmgHBC FvxGtaVuMx vyCeqdAoRn LgPh\RoXOp wnzkOItZgr k.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - RoXOpwnzkOItZgrk.exe (PID: 3168 cmdline:
"C:\Progra m Files (x 86)\STnbPU BnkXHdMrjo XRqZBmgHBC FvxGtaVuMx vyCeqdAoRn LgPh\RoXOp wnzkOItZgr k.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - RoXOpwnzkOItZgrk.exe (PID: 4444 cmdline:
"C:\Progra m Files (x 86)\STnbPU BnkXHdMrjo XRqZBmgHBC FvxGtaVuMx vyCeqdAoRn LgPh\RoXOp wnzkOItZgr k.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - RoXOpwnzkOItZgrk.exe (PID: 1852 cmdline:
"C:\Progra m Files (x 86)\STnbPU BnkXHdMrjo XRqZBmgHBC FvxGtaVuMx vyCeqdAoRn LgPh\RoXOp wnzkOItZgr k.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - RoXOpwnzkOItZgrk.exe (PID: 6688 cmdline:
"C:\Progra m Files (x 86)\STnbPU BnkXHdMrjo XRqZBmgHBC FvxGtaVuMx vyCeqdAoRn LgPh\RoXOp wnzkOItZgr k.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - RoXOpwnzkOItZgrk.exe (PID: 3060 cmdline:
"C:\Progra m Files (x 86)\STnbPU BnkXHdMrjo XRqZBmgHBC FvxGtaVuMx vyCeqdAoRn LgPh\RoXOp wnzkOItZgr k.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - RoXOpwnzkOItZgrk.exe (PID: 3380 cmdline:
"C:\Progra m Files (x 86)\STnbPU BnkXHdMrjo XRqZBmgHBC FvxGtaVuMx vyCeqdAoRn LgPh\RoXOp wnzkOItZgr k.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - RoXOpwnzkOItZgrk.exe (PID: 728 cmdline:
"C:\Progra m Files (x 86)\STnbPU BnkXHdMrjo XRqZBmgHBC FvxGtaVuMx vyCeqdAoRn LgPh\RoXOp wnzkOItZgr k.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - RoXOpwnzkOItZgrk.exe (PID: 2992 cmdline:
"C:\Progra m Files (x 86)\STnbPU BnkXHdMrjo XRqZBmgHBC FvxGtaVuMx vyCeqdAoRn LgPh\RoXOp wnzkOItZgr k.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - RoXOpwnzkOItZgrk.exe (PID: 3332 cmdline:
"C:\Progra m Files (x 86)\STnbPU BnkXHdMrjo XRqZBmgHBC FvxGtaVuMx vyCeqdAoRn LgPh\RoXOp wnzkOItZgr k.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - RoXOpwnzkOItZgrk.exe (PID: 3680 cmdline:
"C:\Progra m Files (x 86)\STnbPU BnkXHdMrjo XRqZBmgHBC FvxGtaVuMx vyCeqdAoRn LgPh\RoXOp wnzkOItZgr k.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - RoXOpwnzkOItZgrk.exe (PID: 4400 cmdline:
"C:\Progra m Files (x 86)\STnbPU BnkXHdMrjo XRqZBmgHBC FvxGtaVuMx vyCeqdAoRn LgPh\RoXOp wnzkOItZgr k.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - RoXOpwnzkOItZgrk.exe (PID: 6484 cmdline:
"C:\Progra m Files (x 86)\STnbPU BnkXHdMrjo XRqZBmgHBC FvxGtaVuMx vyCeqdAoRn LgPh\RoXOp wnzkOItZgr k.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - RoXOpwnzkOItZgrk.exe (PID: 3040 cmdline:
"C:\Progra m Files (x 86)\STnbPU BnkXHdMrjo XRqZBmgHBC FvxGtaVuMx vyCeqdAoRn LgPh\RoXOp wnzkOItZgr k.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - RoXOpwnzkOItZgrk.exe (PID: 7096 cmdline:
"C:\Progra m Files (x 86)\STnbPU BnkXHdMrjo XRqZBmgHBC FvxGtaVuMx vyCeqdAoRn LgPh\RoXOp wnzkOItZgr k.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - RoXOpwnzkOItZgrk.exe (PID: 5988 cmdline:
"C:\Progra m Files (x 86)\STnbPU BnkXHdMrjo XRqZBmgHBC FvxGtaVuMx vyCeqdAoRn LgPh\RoXOp wnzkOItZgr k.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - RoXOpwnzkOItZgrk.exe (PID: 4012 cmdline:
"C:\Progra m Files (x 86)\STnbPU BnkXHdMrjo XRqZBmgHBC FvxGtaVuMx vyCeqdAoRn LgPh\RoXOp wnzkOItZgr k.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - RoXOpwnzkOItZgrk.exe (PID: 5908 cmdline:
"C:\Progra m Files (x 86)\STnbPU BnkXHdMrjo XRqZBmgHBC FvxGtaVuMx vyCeqdAoRn LgPh\RoXOp wnzkOItZgr k.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - RoXOpwnzkOItZgrk.exe (PID: 5812 cmdline:
"C:\Progra m Files (x 86)\STnbPU BnkXHdMrjo XRqZBmgHBC FvxGtaVuMx vyCeqdAoRn LgPh\RoXOp wnzkOItZgr k.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - RoXOpwnzkOItZgrk.exe (PID: 5980 cmdline:
"C:\Progra m Files (x 86)\STnbPU BnkXHdMrjo XRqZBmgHBC FvxGtaVuMx vyCeqdAoRn LgPh\RoXOp wnzkOItZgr k.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - RoXOpwnzkOItZgrk.exe (PID: 3664 cmdline:
"C:\Progra m Files (x 86)\STnbPU BnkXHdMrjo XRqZBmgHBC FvxGtaVuMx vyCeqdAoRn LgPh\RoXOp wnzkOItZgr k.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - RoXOpwnzkOItZgrk.exe (PID: 6056 cmdline:
"C:\Progra m Files (x 86)\STnbPU BnkXHdMrjo XRqZBmgHBC FvxGtaVuMx vyCeqdAoRn LgPh\RoXOp wnzkOItZgr k.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - RoXOpwnzkOItZgrk.exe (PID: 5896 cmdline:
"C:\Progra m Files (x 86)\STnbPU BnkXHdMrjo XRqZBmgHBC FvxGtaVuMx vyCeqdAoRn LgPh\RoXOp wnzkOItZgr k.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717) - Watchdog.exe (PID: 4708 cmdline:
"C:\Users\ user\PCApp Store\Watc hdog.exe" /guid=2ED9 2742-89DC- DD72-92E8- 869FA5A664 93 /rid=20 2411111616 14.1886019 781 /ver=f a.1092c MD5: 11F3801CB9FF046D6075F681971C4EB8)
- cleanup
⊘No configs have been found
⊘No yara matches
| Source: | Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): | ||
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | ReversingLabs: | ||
| Source: | ReversingLabs: | ||
| Source: | Joe Sandbox ML: | ||
| Source: | EXE: | Jump to behavior | ||
| Source: | EXE: | Jump to behavior | ||
| Source: | EXE: | Jump to behavior | ||
| Source: | EXE: | Jump to behavior | ||
| Source: | EXE: | Jump to behavior | ||
| Source: | EXE: | Jump to behavior | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
| Source: | HTTP Parser: | ||
Compliance | |
|---|
| Source: | EXE: | Jump to behavior | ||
| Source: | EXE: | Jump to behavior | ||
| Source: | EXE: | Jump to behavior | ||
| Source: | EXE: | Jump to behavior | ||
| Source: | EXE: | Jump to behavior | ||
| Source: | EXE: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | Registry value created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||