Windows Analysis Report
Prism2Installer_5.16.0.exe

Overview

General Information

Sample name:	Prism2Installer_5.16.0.exe
Analysis ID:	1540391
MD5:	c68a2b8f2d38f0878728cf372b38d61d
SHA1:	7b22b800110e35298db6916fac5baae1c8fbadb8
SHA256:	8dab9b8ba64255c67d2f47c48ee6799f988412dabe61fb5cb32be8b3acbd5c6f
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	20%

Signatures

Checks for available system drives (often done to infect USB drives)

Drops PE files

Found dropped PE file which has not been started or loaded

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Classification

Signatures

Uses 32bit PE files

Source: Prism2Installer_5.16.0.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4FEB6242-809F-4FB9-8944-A78F798F1B1F}_is1

Jump to behavior

Source: Prism2Installer_5.16.0.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Checks for available system drives (often done to infect USB drives)

Source: C:\PrismII\PrismII.exe	File opened: z:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: x:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: v:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: t:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: r:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: p:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: n:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: l:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: j:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: h:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: f:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: b:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: y:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: w:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: u:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: s:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: q:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: o:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: m:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: k:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: i:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: g:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: e:	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	File opened: c:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: a:	Jump to behavior

Source: PrismII.exe, 00000006.00000001.2027335390.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: http://10.0.0.199
Source: PrismII.exe, 00000006.00000001.2027335390.0000000000401000.00000020.00000001.01000000.00000008.sdmp, is-M9UEN.tmp.1.dr	String found in binary or memory: http://127.0.0.1&http://192.168.1.25
Source: PrismII.exe, 00000006.00000001.2027335390.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: http://192.168.1.25
Source: Prism2Installer_5.16.0.tmp, 00000001.00000003.2027888808.0000000005970000.00000004.00001000.00020000.00000000.sdmp, is-KO5KN.tmp.1.dr	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: Prism2Installer_5.16.0.tmp, 00000001.00000003.2027888808.0000000005970000.00000004.00001000.00020000.00000000.sdmp, is-KO5KN.tmp.1.dr	String found in binary or memory: http://www.openssl.org/support/faq.html....................
Source: Prism2Installer_5.16.0.exe	String found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: PrismII.exe, 00000006.00000000.2000811021.0000000000FA4000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: https://www.aaon.com
Source: Prism2Installer_5.16.0.tmp, 00000001.00000003.1801585909.0000000003370000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.aaon.com/
Source: Prism2Installer_5.16.0.tmp, 00000001.00000003.2032390052.0000000000CD3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.aaon.com/Q9
Source: PrismII.exe, 00000006.00000000.2000811021.0000000000FA4000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: https://www.aaon.com/aaon-controls-technical-support
Source: PrismII.exe, 00000006.00000001.2027335390.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: https://www.aaon.com/aaon-controls-technical-support(https://www.aaon.comT
Source: Prism2Installer_5.16.0.exe, 00000000.00000003.1797999514.00000000028A0000.00000004.00001000.00020000.00000000.sdmp, Prism2Installer_5.16.0.exe, 00000000.00000003.1798421873.000000007FB7B000.00000004.00001000.00020000.00000000.sdmp, Prism2Installer_5.16.0.tmp, 00000001.00000000.1800021829.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Prism2Installer_5.16.0.tmp.0.dr, is-JJU1I.tmp.1.dr	String found in binary or memory: https://www.innosetup.com/
Source: Prism2Installer_5.16.0.exe, 00000000.00000003.1797999514.00000000028A0000.00000004.00001000.00020000.00000000.sdmp, Prism2Installer_5.16.0.exe, 00000000.00000003.1798421873.000000007FB7B000.00000004.00001000.00020000.00000000.sdmp, Prism2Installer_5.16.0.tmp, 00000001.00000000.1800021829.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Prism2Installer_5.16.0.tmp.0.dr, is-JJU1I.tmp.1.dr	String found in binary or memory: https://www.remobjects.com/ps

PE file contains executable resources (Code or Archives)

Source: Prism2Installer_5.16.0.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-JJU1I.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows

Sample file is different than original file name gathered from version info

Source: Prism2Installer_5.16.0.exe, 00000000.00000003.1798421873.000000007FE2E000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs Prism2Installer_5.16.0.exe
Source: Prism2Installer_5.16.0.exe, 00000000.00000000.1796545569.00000000004B9000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileName vs Prism2Installer_5.16.0.exe
Source: Prism2Installer_5.16.0.exe, 00000000.00000003.1797999514.0000000002972000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs Prism2Installer_5.16.0.exe
Source: Prism2Installer_5.16.0.exe	Binary or memory string: OriginalFileName vs Prism2Installer_5.16.0.exe

Uses 32bit PE files

Source: Prism2Installer_5.16.0.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: clean2.winEXE@5/18@0/0

Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Prism2.lnk

Jump to behavior

Source: C:\PrismII\PrismII.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\Prism2Installer_5.16.0.exe

File created: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp

Jump to behavior

Source: C:\Users\user\Desktop\Prism2Installer_5.16.0.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\Prism2Installer_5.16.0.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Prism2Installer_5.16.0.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: Prism2Installer_5.16.0.exe

String found in binary or memory: /LOADINF="filename"

Source: C:\Users\user\Desktop\Prism2Installer_5.16.0.exe

File read: C:\Users\user\Desktop\Prism2Installer_5.16.0.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Prism2Installer_5.16.0.exe "C:\Users\user\Desktop\Prism2Installer_5.16.0.exe"
Source: C:\Users\user\Desktop\Prism2Installer_5.16.0.exe	Process created: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp "C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp" /SL5="$2043C,13061428,722432,C:\Users\user\Desktop\Prism2Installer_5.16.0.exe"
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Process created: C:\PrismII\PrismII.exe "C:\PrismII\PrismII.exe"
Source: C:\Users\user\Desktop\Prism2Installer_5.16.0.exe	Process created: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp "C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp" /SL5="$2043C,13061428,722432,C:\Users\user\Desktop\Prism2Installer_5.16.0.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Process created: C:\PrismII\PrismII.exe "C:\PrismII\PrismII.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Prism2Installer_5.16.0.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Prism2Installer_5.16.0.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\PrismII\PrismII.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\PrismII\PrismII.exe	Section loaded: msvbvm60.dll	Jump to behavior
Source: C:\PrismII\PrismII.exe	Section loaded: vb6zz.dll	Jump to behavior
Source: C:\PrismII\PrismII.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\PrismII\PrismII.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\PrismII\PrismII.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\PrismII\PrismII.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\PrismII\PrismII.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\PrismII\PrismII.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\PrismII\PrismII.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\PrismII\PrismII.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\PrismII\PrismII.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\PrismII\PrismII.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\PrismII\PrismII.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\PrismII\PrismII.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\PrismII\PrismII.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: Prism2.lnk.1.dr	LNK file: ..\..\..\..\..\..\..\..\PrismII\PrismII.exe
Source: Prism2.lnk0.1.dr	LNK file: ..\..\..\PrismII\PrismII.exe

Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp

Window found: window name: TMainForm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Automated click: Install
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Automated click: Next

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4FEB6242-809F-4FB9-8944-A78F798F1B1F}_is1

Jump to behavior

Source: Prism2Installer_5.16.0.exe

Static file information: File size 13908305 > 1048576

Source: Prism2Installer_5.16.0.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

PE file contains sections with non-standard names

Source: Prism2Installer_5.16.0.exe	Static PE information: section name: .didata
Source: Prism2Installer_5.16.0.tmp.0.dr	Static PE information: section name: .didata
Source: is-JJU1I.tmp.1.dr	Static PE information: section name: .didata

Drops PE files

Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	File created: C:\Users\user\AppData\Local\Temp\is-43D6P.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\Prism2Installer_5.16.0.exe	File created: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	File created: C:\PrismII\MailSend.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	File created: C:\PrismII\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	File created: C:\PrismII\PrismII.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	File created: C:\PrismII\is-JJU1I.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	File created: C:\PrismII\is-KO5KN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	File created: C:\PrismII\is-M9UEN.tmp	Jump to dropped file

Source: C:\Users\user\Desktop\Prism2Installer_5.16.0.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PrismII\PrismII.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PrismII\PrismII.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PrismII\PrismII.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PrismII\PrismII.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PrismII\PrismII.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PrismII\PrismII.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PrismII\PrismII.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PrismII\PrismII.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PrismII\PrismII.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PrismII\PrismII.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PrismII\PrismII.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Found dropped PE file which has not been started or loaded

Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-43D6P.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Dropped PE file which has not been started: C:\PrismII\MailSend.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Dropped PE file which has not been started: C:\PrismII\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Dropped PE file which has not been started: C:\PrismII\is-JJU1I.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Dropped PE file which has not been started: C:\PrismII\is-KO5KN.tmp	Jump to dropped file

Source: Prism2Installer_5.16.0.tmp, 00000001.00000003.2030717531.00000000008FC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}B
Source: PrismII.exe, 00000006.00000000.2022660255.0000000008EDB000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: wzuuwstwrtwrRSPKJHLKILLIKJHIHFHGFSTQgjgkolimj]`]MLJNMJPOMSROTSQTTQTSQSRPQQOOOMONL:;8886RRPVUSVVTVVTVVTVVTVVTVVTUUSSSQ<=<'('CCBFEDFFEHGFHHGEEDDDCDDCDDCDDDEEDDFD$%$...???776UWS\ffcux^oqaruastbtt_qq^qrcvzbtx]knmy
Source: PrismII.exe, 00000006.00000000.2022660255.0000000007761000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: sytlogbaS^\Lhg[mmdopfbcXspe~{srkVmhPliQkiQmjRnkSnkSolTplTkdM_SAul]siXi^KcWBe[Ii^LdXCcWB`S>^Q<[N:YM9UJ7PF5qeMuhP
Source: Prism2Installer_5.16.0.tmp, 00000001.00000003.2030717531.00000000008FC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\

Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp

Process information queried: ProcessInformation

Jump to behavior

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Queries volume information: C:\ VolumeInformation			Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

Uses 32bit PE files

Source: Prism2Installer_5.16.0.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4FEB6242-809F-4FB9-8944-A78F798F1B1F}_is1

Jump to behavior

Source: Prism2Installer_5.16.0.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Checks for available system drives (often done to infect USB drives)

Source: C:\PrismII\PrismII.exe	File opened: z:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: x:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: v:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: t:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: r:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: p:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: n:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: l:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: j:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: h:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: f:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: b:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: y:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: w:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: u:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: s:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: q:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: o:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: m:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: k:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: i:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: g:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: e:	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	File opened: c:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: a:	Jump to behavior

Source: PrismII.exe, 00000006.00000001.2027335390.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: http://10.0.0.199
Source: PrismII.exe, 00000006.00000001.2027335390.0000000000401000.00000020.00000001.01000000.00000008.sdmp, is-M9UEN.tmp.1.dr	String found in binary or memory: http://127.0.0.1&http://192.168.1.25
Source: PrismII.exe, 00000006.00000001.2027335390.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: http://192.168.1.25
Source: Prism2Installer_5.16.0.tmp, 00000001.00000003.2027888808.0000000005970000.00000004.00001000.00020000.00000000.sdmp, is-KO5KN.tmp.1.dr	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: Prism2Installer_5.16.0.tmp, 00000001.00000003.2027888808.0000000005970000.00000004.00001000.00020000.00000000.sdmp, is-KO5KN.tmp.1.dr	String found in binary or memory: http://www.openssl.org/support/faq.html....................
Source: Prism2Installer_5.16.0.exe	String found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: PrismII.exe, 00000006.00000000.2000811021.0000000000FA4000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: https://www.aaon.com
Source: Prism2Installer_5.16.0.tmp, 00000001.00000003.1801585909.0000000003370000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.aaon.com/
Source: Prism2Installer_5.16.0.tmp, 00000001.00000003.2032390052.0000000000CD3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.aaon.com/Q9
Source: PrismII.exe, 00000006.00000000.2000811021.0000000000FA4000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: https://www.aaon.com/aaon-controls-technical-support
Source: PrismII.exe, 00000006.00000001.2027335390.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: https://www.aaon.com/aaon-controls-technical-support(https://www.aaon.comT
Source: Prism2Installer_5.16.0.exe, 00000000.00000003.1797999514.00000000028A0000.00000004.00001000.00020000.00000000.sdmp, Prism2Installer_5.16.0.exe, 00000000.00000003.1798421873.000000007FB7B000.00000004.00001000.00020000.00000000.sdmp, Prism2Installer_5.16.0.tmp, 00000001.00000000.1800021829.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Prism2Installer_5.16.0.tmp.0.dr, is-JJU1I.tmp.1.dr	String found in binary or memory: https://www.innosetup.com/
Source: Prism2Installer_5.16.0.exe, 00000000.00000003.1797999514.00000000028A0000.00000004.00001000.00020000.00000000.sdmp, Prism2Installer_5.16.0.exe, 00000000.00000003.1798421873.000000007FB7B000.00000004.00001000.00020000.00000000.sdmp, Prism2Installer_5.16.0.tmp, 00000001.00000000.1800021829.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Prism2Installer_5.16.0.tmp.0.dr, is-JJU1I.tmp.1.dr	String found in binary or memory: https://www.remobjects.com/ps

PE file contains executable resources (Code or Archives)

Source: Prism2Installer_5.16.0.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-JJU1I.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows

Sample file is different than original file name gathered from version info

Source: Prism2Installer_5.16.0.exe, 00000000.00000003.1798421873.000000007FE2E000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs Prism2Installer_5.16.0.exe
Source: Prism2Installer_5.16.0.exe, 00000000.00000000.1796545569.00000000004B9000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileName vs Prism2Installer_5.16.0.exe
Source: Prism2Installer_5.16.0.exe, 00000000.00000003.1797999514.0000000002972000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs Prism2Installer_5.16.0.exe
Source: Prism2Installer_5.16.0.exe	Binary or memory string: OriginalFileName vs Prism2Installer_5.16.0.exe

Uses 32bit PE files

Source: Prism2Installer_5.16.0.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: clean2.winEXE@5/18@0/0

Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Prism2.lnk

Jump to behavior

Source: C:\PrismII\PrismII.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\Prism2Installer_5.16.0.exe

File created: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp

Jump to behavior

Source: C:\Users\user\Desktop\Prism2Installer_5.16.0.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\Prism2Installer_5.16.0.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Prism2Installer_5.16.0.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: Prism2Installer_5.16.0.exe

String found in binary or memory: /LOADINF="filename"

Source: C:\Users\user\Desktop\Prism2Installer_5.16.0.exe

File read: C:\Users\user\Desktop\Prism2Installer_5.16.0.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Prism2Installer_5.16.0.exe "C:\Users\user\Desktop\Prism2Installer_5.16.0.exe"
Source: C:\Users\user\Desktop\Prism2Installer_5.16.0.exe	Process created: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp "C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp" /SL5="$2043C,13061428,722432,C:\Users\user\Desktop\Prism2Installer_5.16.0.exe"
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Process created: C:\PrismII\PrismII.exe "C:\PrismII\PrismII.exe"
Source: C:\Users\user\Desktop\Prism2Installer_5.16.0.exe	Process created: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp "C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp" /SL5="$2043C,13061428,722432,C:\Users\user\Desktop\Prism2Installer_5.16.0.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Process created: C:\PrismII\PrismII.exe "C:\PrismII\PrismII.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Prism2Installer_5.16.0.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Prism2Installer_5.16.0.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\PrismII\PrismII.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\PrismII\PrismII.exe	Section loaded: msvbvm60.dll	Jump to behavior
Source: C:\PrismII\PrismII.exe	Section loaded: vb6zz.dll	Jump to behavior
Source: C:\PrismII\PrismII.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\PrismII\PrismII.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\PrismII\PrismII.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\PrismII\PrismII.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\PrismII\PrismII.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\PrismII\PrismII.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\PrismII\PrismII.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\PrismII\PrismII.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\PrismII\PrismII.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\PrismII\PrismII.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\PrismII\PrismII.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\PrismII\PrismII.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\PrismII\PrismII.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: Prism2.lnk.1.dr	LNK file: ..\..\..\..\..\..\..\..\PrismII\PrismII.exe
Source: Prism2.lnk0.1.dr	LNK file: ..\..\..\PrismII\PrismII.exe

Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp

Window found: window name: TMainForm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Automated click: Install
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Automated click: Next

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4FEB6242-809F-4FB9-8944-A78F798F1B1F}_is1

Jump to behavior

Source: Prism2Installer_5.16.0.exe

Static file information: File size 13908305 > 1048576

Source: Prism2Installer_5.16.0.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

PE file contains sections with non-standard names

Source: Prism2Installer_5.16.0.exe	Static PE information: section name: .didata
Source: Prism2Installer_5.16.0.tmp.0.dr	Static PE information: section name: .didata
Source: is-JJU1I.tmp.1.dr	Static PE information: section name: .didata

Drops PE files

Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	File created: C:\Users\user\AppData\Local\Temp\is-43D6P.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\Prism2Installer_5.16.0.exe	File created: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	File created: C:\PrismII\MailSend.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	File created: C:\PrismII\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	File created: C:\PrismII\PrismII.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	File created: C:\PrismII\is-JJU1I.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	File created: C:\PrismII\is-KO5KN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	File created: C:\PrismII\is-M9UEN.tmp	Jump to dropped file

Source: C:\Users\user\Desktop\Prism2Installer_5.16.0.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PrismII\PrismII.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PrismII\PrismII.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PrismII\PrismII.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PrismII\PrismII.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PrismII\PrismII.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PrismII\PrismII.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PrismII\PrismII.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PrismII\PrismII.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PrismII\PrismII.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PrismII\PrismII.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PrismII\PrismII.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Found dropped PE file which has not been started or loaded

Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-43D6P.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Dropped PE file which has not been started: C:\PrismII\MailSend.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Dropped PE file which has not been started: C:\PrismII\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Dropped PE file which has not been started: C:\PrismII\is-JJU1I.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Dropped PE file which has not been started: C:\PrismII\is-KO5KN.tmp	Jump to dropped file

Source: Prism2Installer_5.16.0.tmp, 00000001.00000003.2030717531.00000000008FC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}B
Source: PrismII.exe, 00000006.00000000.2022660255.0000000008EDB000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: wzuuwstwrtwrRSPKJHLKILLIKJHIHFHGFSTQgjgkolimj]`]MLJNMJPOMSROTSQTTQTSQSRPQQOOOMONL:;8886RRPVUSVVTVVTVVTVVTVVTVVTUUSSSQ<=<'('CCBFEDFFEHGFHHGEEDDDCDDCDDCDDDEEDDFD$%$...???776UWS\ffcux^oqaruastbtt_qq^qrcvzbtx]knmy
Source: PrismII.exe, 00000006.00000000.2022660255.0000000007761000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: sytlogbaS^\Lhg[mmdopfbcXspe~{srkVmhPliQkiQmjRnkSnkSolTplTkdM_SAul]siXi^KcWBe[Ii^LdXCcWB`S>^Q<[N:YM9UJ7PF5qeMuhP
Source: Prism2Installer_5.16.0.tmp, 00000001.00000003.2030717531.00000000008FC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\

Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp

Process information queried: ProcessInformation

Jump to behavior

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Queries volume information: C:\ VolumeInformation			Jump to behavior

ID:	1540391
Product:	CloudBasic
Start time:	18:02:47
Start date:	23.10.2024
Sample:	Prism2Installer_5.16.0.exe
Cookbook:	default.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	c68a2b8f2d38f0878728cf372b38d61d
SHA1:	7b22b800110e35298db6916fac5baae1c8fbadb8
SHA256:	8dab9b8ba64255c67d2f47c48ee6799f988412dabe61fb5cb32be8b3acbd5c6f
Filetype:	Win32 Executable (generic) a (10002005/4) 98.45%

Name	Type	MD5	SHA1	SHA256
C:\PrismII\Configuration\DNS001.CFG	ASCII text, with very long lines (65536), with no line terminators	141AC3CA5348DC0F1E91AE8D09A88A91	127CCF0ED298E898DDBF5AE80F0708A33102D18A	E300851A5AA92326883560DED5D61D2A49813F741A171F09F7207CFBD5E44B03
C:\PrismII\Configuration\Node001.CFG	ASCII text, with very long lines (20000), with no line terminators	3B7DDC02568FDCD6B178B67D2CE43441	43427AD63EBE3C4625EA1F6C0A0B43F12E1B3EB1	671D41364BDE515117A82CEF51DF84BD4E5995C4A02F533C2ED26EE263D5214C
C:\PrismII\Configuration\ScreenID.dat (copy)	ASCII text, with very long lines (65536), with no line terminators	328933622B50C917264B13D38079063C	73A72629E22707884CD8A18AF2EE850D9EC4FB31	AF0568A5EB402A0F03CF42C71CE31964C5C86683BA0E5C189B61ADC8B650DE6A
C:\PrismII\Configuration\ULData.cfg	ISO-8859 text, with CRLF line terminators	53F567827BEF0B8B36C3538A923BA13B	0FBD5AD7D1103A8233DA99EDFB080E7DE913BF2B	E66DE109DB354CEBB0B083FBD6AB89634D628CF1A87F18CAB07C8B7517359AC0
C:\PrismII\Configuration\is-FCB81.tmp	ASCII text, with very long lines (65536), with no line terminators	328933622B50C917264B13D38079063C	73A72629E22707884CD8A18AF2EE850D9EC4FB31	AF0568A5EB402A0F03CF42C71CE31964C5C86683BA0E5C189B61ADC8B650DE6A
C:\PrismII\History\HistoryForOctober2024.log	Non-ISO extended-ASCII text, with CRLF line terminators	A5048EEACF05155534D634A7CBCC1F20	EEEA8C94C6042D683D3C0E9DB7F02608333C7BFA	940196391DE9A2B2CF572707F6361C46BFBC5B0D6FCFD5DFA94530C97FE50173
C:\PrismII\MailSend.exe (copy)	PE32 executable (console) Intel 80386, for MS Windows	BCD5976DB70B789102E990086873EB38	D1E4E12D1396D1EF0C5388B857C3601E4E1E9034	EC6160907197B2DD7713EFFF72668F1B540A5761EB3E7553E1029F09800AC6F5
C:\PrismII\PrismII.exe (copy)	PE32 executable (GUI) Intel 80386, for MS Windows	12FAE7511A984DF2C87DE60F746FF524	CECE15423818928AB82C9E129D01750CDC4836DE	C8D34A2ABCAF6931CE705402DF9D5E65EB2FDFDF84D53BEF00230CA94C870ECF
C:\PrismII\is-JJU1I.tmp	PE32 executable (GUI) Intel 80386, for MS Windows	36FDE363AFE35A339601753EECD23872	1B32EEBB3C26591F9B5BE42808BDEE32757944CD	9F1A92C3D43010A4D13B4042FFF39F7883BFDF8061F62B7C8B976533579622F4
C:\PrismII\is-KO5KN.tmp	PE32 executable (console) Intel 80386, for MS Windows	BCD5976DB70B789102E990086873EB38	D1E4E12D1396D1EF0C5388B857C3601E4E1E9034	EC6160907197B2DD7713EFFF72668F1B540A5761EB3E7553E1029F09800AC6F5
C:\PrismII\is-M9UEN.tmp	PE32 executable (GUI) Intel 80386, for MS Windows	12FAE7511A984DF2C87DE60F746FF524	CECE15423818928AB82C9E129D01750CDC4836DE	C8D34A2ABCAF6931CE705402DF9D5E65EB2FDFDF84D53BEF00230CA94C870ECF
C:\PrismII\unins000.dat	InnoSetup Log Prism2 {4FEB6242-809F-4FB9-8944-A78F798F1B1F}, version 0x418, 1749 bytes, 367706\37\user\376, C:\PrismII\376\377\377\007	A2214AF45642CAD2A28AE24634CB6576	E375B5E322F81DB195CB82A5DFA5E82F94452DE1	8CD33239402A5FDFE443414FFA138FE465C1BC0A3815114360F80218B7DBB489
C:\PrismII\unins000.exe (copy)	PE32 executable (GUI) Intel 80386, for MS Windows	36FDE363AFE35A339601753EECD23872	1B32EEBB3C26591F9B5BE42808BDEE32757944CD	9F1A92C3D43010A4D13B4042FFF39F7883BFDF8061F62B7C8B976533579622F4
C:\Users\user\AppData\Local\Temp\is-43D6P.tmp\_isetup\_setup64.tmp	PE32+ executable (console) x86-64, for MS Windows	E4211D6D009757C078A9FAC7FF4F03D4	019CD56BA687D39D12D4B13991C9A42EA6BA03DA	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	PE32 executable (GUI) Intel 80386, for MS Windows	6C38595D6F1B9F7FF6D63EF3E34B5980	AAE6E7BE296BACA2149E9C8D30F2AF681B980F1A	DF865795D2FE4D67ADDE0694FAE8C3C244819A23F7D63EB2CFB83BBB94BFBCE7
C:\Users\user\AppData\Local\Temp\~DFF43006658DD9B6A4.TMP	Composite Document File V2 Document, Cannot read section info	3D872D3F126C3F478F6080204D0585DF	BD2CCB67E0C7A6A39D4659124C7BDCFC9B5D96DD	1071E385DE9E3B8228E512AA4EB6D0D5E8F133F48150D5E3260FC68B0B618748
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Prism2.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Wed Oct 23 15:04:00 2024, mtime=Wed Oct 23 15:04:03 2024, atime=Tue Aug 27 12:06:40 2024, length=157048832, window=hide	0F62AB761F67C315E3B4CCB20A699B0A	AB33CD084CD4F30E9B3398C6ED99AC046AAD3545	480B7F409F4C5B0C59D670236A2D1834ACD7490D744A2E6A31D89661CE7FE8CB
C:\Users\user\Desktop\Prism2.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Wed Oct 23 15:04:00 2024, mtime=Wed Oct 23 15:04:07 2024, atime=Tue Aug 27 12:06:40 2024, length=157048832, window=hide	405D849095EBAA8A3CC9CC07CE29E8BE	A48BFC802B69B444280CF30DAEBBF61F03C3A1AA	6ABB6323A89B2EFD34317ACAAED2CE713A2ACA4B8EE2C55E8E88C01D8203537F

Windows Analysis Report
Prism2Installer_5.16.0.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Screenshots

Behavior Graph

Network Map

Windows Analysis Report Prism2Installer_5.16.0.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Screenshots

Behavior Graph

Network Map

Windows Analysis Report
Prism2Installer_5.16.0.exe