Edit tour

Windows Analysis Report
Prism2Installer_5.16.0.exe

Overview

General Information

Sample name:	Prism2Installer_5.16.0.exe
Analysis ID:	1540391
MD5:	c68a2b8f2d38f0878728cf372b38d61d
SHA1:	7b22b800110e35298db6916fac5baae1c8fbadb8
SHA256:	8dab9b8ba64255c67d2f47c48ee6799f988412dabe61fb5cb32be8b3acbd5c6f
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	20%

Signatures

Checks for available system drives (often done to infect USB drives)

Drops PE files

Found dropped PE file which has not been started or loaded

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Classification

Process Tree

System is w10x64

Prism2Installer_5.16.0.exe (PID: 4504 cmdline: "C:\Users\user\Desktop\Prism2Installer_5.16.0.exe" MD5: C68A2B8F2D38F0878728CF372B38D61D)

Prism2Installer_5.16.0.tmp (PID: 1800 cmdline: "C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp" /SL5="$2043C,13061428,722432,C:\Users\user\Desktop\Prism2Installer_5.16.0.exe" MD5: 6C38595D6F1B9F7FF6D63EF3E34B5980)

PrismII.exe (PID: 3052 cmdline: "C:\PrismII\PrismII.exe" MD5: 12FAE7511A984DF2C87DE60F746FF524)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: Prism2Installer_5.16.0.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4FEB6242-809F-4FB9-8944-A78F798F1B1F}_is1

Jump to behavior

Source: Prism2Installer_5.16.0.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\PrismII\PrismII.exe	File opened: z:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: x:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: v:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: t:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: r:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: p:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: n:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: l:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: j:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: h:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: f:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: b:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: y:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: w:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: u:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: s:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: q:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: o:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: m:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: k:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: i:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: g:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: e:	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	File opened: c:	Jump to behavior
Source: C:\PrismII\PrismII.exe	File opened: a:	Jump to behavior

Source: PrismII.exe, 00000006.00000001.2027335390.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: http://10.0.0.199
Source: PrismII.exe, 00000006.00000001.2027335390.0000000000401000.00000020.00000001.01000000.00000008.sdmp, is-M9UEN.tmp.1.dr	String found in binary or memory: http://127.0.0.1&http://192.168.1.25
Source: PrismII.exe, 00000006.00000001.2027335390.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: http://192.168.1.25
Source: Prism2Installer_5.16.0.tmp, 00000001.00000003.2027888808.0000000005970000.00000004.00001000.00020000.00000000.sdmp, is-KO5KN.tmp.1.dr	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: Prism2Installer_5.16.0.tmp, 00000001.00000003.2027888808.0000000005970000.00000004.00001000.00020000.00000000.sdmp, is-KO5KN.tmp.1.dr	String found in binary or memory: http://www.openssl.org/support/faq.html....................
Source: Prism2Installer_5.16.0.exe	String found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: PrismII.exe, 00000006.00000000.2000811021.0000000000FA4000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: https://www.aaon.com
Source: Prism2Installer_5.16.0.tmp, 00000001.00000003.1801585909.0000000003370000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.aaon.com/
Source: Prism2Installer_5.16.0.tmp, 00000001.00000003.2032390052.0000000000CD3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.aaon.com/Q9
Source: PrismII.exe, 00000006.00000000.2000811021.0000000000FA4000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: https://www.aaon.com/aaon-controls-technical-support
Source: PrismII.exe, 00000006.00000001.2027335390.0000000000401000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: https://www.aaon.com/aaon-controls-technical-support(https://www.aaon.comT
Source: Prism2Installer_5.16.0.exe, 00000000.00000003.1797999514.00000000028A0000.00000004.00001000.00020000.00000000.sdmp, Prism2Installer_5.16.0.exe, 00000000.00000003.1798421873.000000007FB7B000.00000004.00001000.00020000.00000000.sdmp, Prism2Installer_5.16.0.tmp, 00000001.00000000.1800021829.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Prism2Installer_5.16.0.tmp.0.dr, is-JJU1I.tmp.1.dr	String found in binary or memory: https://www.innosetup.com/
Source: Prism2Installer_5.16.0.exe, 00000000.00000003.1797999514.00000000028A0000.00000004.00001000.00020000.00000000.sdmp, Prism2Installer_5.16.0.exe, 00000000.00000003.1798421873.000000007FB7B000.00000004.00001000.00020000.00000000.sdmp, Prism2Installer_5.16.0.tmp, 00000001.00000000.1800021829.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Prism2Installer_5.16.0.tmp.0.dr, is-JJU1I.tmp.1.dr	String found in binary or memory: https://www.remobjects.com/ps

Source: Prism2Installer_5.16.0.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-JJU1I.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows

Source: Prism2Installer_5.16.0.exe, 00000000.00000003.1798421873.000000007FE2E000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs Prism2Installer_5.16.0.exe
Source: Prism2Installer_5.16.0.exe, 00000000.00000000.1796545569.00000000004B9000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileName vs Prism2Installer_5.16.0.exe
Source: Prism2Installer_5.16.0.exe, 00000000.00000003.1797999514.0000000002972000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs Prism2Installer_5.16.0.exe
Source: Prism2Installer_5.16.0.exe	Binary or memory string: OriginalFileName vs Prism2Installer_5.16.0.exe

Source: Prism2Installer_5.16.0.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: clean2.winEXE@5/18@0/0

Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Prism2.lnk

Jump to behavior

Source: C:\PrismII\PrismII.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\Prism2Installer_5.16.0.exe

File created: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp

Jump to behavior

Source: C:\Users\user\Desktop\Prism2Installer_5.16.0.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\Prism2Installer_5.16.0.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Prism2Installer_5.16.0.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: Prism2Installer_5.16.0.exe

String found in binary or memory: /LOADINF="filename"

Source: C:\Users\user\Desktop\Prism2Installer_5.16.0.exe

File read: C:\Users\user\Desktop\Prism2Installer_5.16.0.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Prism2Installer_5.16.0.exe "C:\Users\user\Desktop\Prism2Installer_5.16.0.exe"
Source: C:\Users\user\Desktop\Prism2Installer_5.16.0.exe	Process created: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp "C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp" /SL5="$2043C,13061428,722432,C:\Users\user\Desktop\Prism2Installer_5.16.0.exe"
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Process created: C:\PrismII\PrismII.exe "C:\PrismII\PrismII.exe"
Source: C:\Users\user\Desktop\Prism2Installer_5.16.0.exe	Process created: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp "C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp" /SL5="$2043C,13061428,722432,C:\Users\user\Desktop\Prism2Installer_5.16.0.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Process created: C:\PrismII\PrismII.exe "C:\PrismII\PrismII.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Prism2Installer_5.16.0.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Prism2Installer_5.16.0.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\PrismII\PrismII.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\PrismII\PrismII.exe	Section loaded: msvbvm60.dll	Jump to behavior
Source: C:\PrismII\PrismII.exe	Section loaded: vb6zz.dll	Jump to behavior
Source: C:\PrismII\PrismII.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\PrismII\PrismII.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\PrismII\PrismII.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\PrismII\PrismII.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\PrismII\PrismII.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\PrismII\PrismII.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\PrismII\PrismII.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\PrismII\PrismII.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\PrismII\PrismII.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\PrismII\PrismII.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\PrismII\PrismII.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\PrismII\PrismII.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\PrismII\PrismII.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: Prism2.lnk.1.dr	LNK file: ..\..\..\..\..\..\..\..\PrismII\PrismII.exe
Source: Prism2.lnk0.1.dr	LNK file: ..\..\..\PrismII\PrismII.exe

Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp

Window found: window name: TMainForm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Automated click: Install
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Automated click: Next

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4FEB6242-809F-4FB9-8944-A78F798F1B1F}_is1

Jump to behavior

Source: Prism2Installer_5.16.0.exe

Static file information: File size 13908305 > 1048576

Source: Prism2Installer_5.16.0.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: Prism2Installer_5.16.0.exe	Static PE information: section name: .didata
Source: Prism2Installer_5.16.0.tmp.0.dr	Static PE information: section name: .didata
Source: is-JJU1I.tmp.1.dr	Static PE information: section name: .didata

Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	File created: C:\Users\user\AppData\Local\Temp\is-43D6P.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\Prism2Installer_5.16.0.exe	File created: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	File created: C:\PrismII\MailSend.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	File created: C:\PrismII\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	File created: C:\PrismII\PrismII.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	File created: C:\PrismII\is-JJU1I.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	File created: C:\PrismII\is-KO5KN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	File created: C:\PrismII\is-M9UEN.tmp	Jump to dropped file

Source: C:\Users\user\Desktop\Prism2Installer_5.16.0.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PrismII\PrismII.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PrismII\PrismII.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PrismII\PrismII.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PrismII\PrismII.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PrismII\PrismII.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PrismII\PrismII.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PrismII\PrismII.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PrismII\PrismII.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PrismII\PrismII.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PrismII\PrismII.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\PrismII\PrismII.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-43D6P.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Dropped PE file which has not been started: C:\PrismII\MailSend.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Dropped PE file which has not been started: C:\PrismII\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Dropped PE file which has not been started: C:\PrismII\is-JJU1I.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Dropped PE file which has not been started: C:\PrismII\is-KO5KN.tmp	Jump to dropped file

Source: Prism2Installer_5.16.0.tmp, 00000001.00000003.2030717531.00000000008FC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}B
Source: PrismII.exe, 00000006.00000000.2022660255.0000000008EDB000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: wzuuwstwrtwrRSPKJHLKILLIKJHIHFHGFSTQgjgkolimj]`]MLJNMJPOMSROTSQTTQTSQSRPQQOOOMONL:;8886RRPVUSVVTVVTVVTVVTVVTVVTUUSSSQ<=<'('CCBFEDFFEHGFHHGEEDDDCDDCDDCDDDEEDDFD$%$...???776UWS\ffcux^oqaruastbtt_qq^qrcvzbtx]knmy
Source: PrismII.exe, 00000006.00000000.2022660255.0000000007761000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: sytlogbaS^\Lhg[mmdopfbcXspe~{srkVmhPliQkiQmjRnkSnkSolTplTkdM_SAul]siXi^KcWBe[Ii^LdXCcWB`S>^Q<[N:YM9UJ7PF5qeMuhP
Source: Prism2Installer_5.16.0.tmp, 00000001.00000003.2030717531.00000000008FC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\

Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	Queries volume information: C:\ VolumeInformation			Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	2 Command and Scripting Interpreter	1 Windows Service	1 Windows Service	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Process Injection	1 Process Injection	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 DLL Side-Loading	Security Account Manager	11 Peripheral Device Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	2 System Owner/User Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	11 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Prism2Installer_5.16.0.exe	5%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\PrismII\MailSend.exe (copy)	3%	ReversingLabs
C:\PrismII\PrismII.exe (copy)	3%	ReversingLabs
C:\PrismII\is-JJU1I.tmp	0%	ReversingLabs
C:\PrismII\is-KO5KN.tmp	3%	ReversingLabs
C:\PrismII\is-M9UEN.tmp	3%	ReversingLabs
C:\PrismII\unins000.exe (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-43D6P.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp	0%	ReversingLabs

Source	Detection	Scanner	Label
https://www.remobjects.com/ps	0%	URL Reputation	safe
https://www.innosetup.com/	0%	URL Reputation	safe
http://www.openssl.org/support/faq.html	0%	URL Reputation	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU	Prism2Installer_5.16.0.exe	false		unknown
https://www.aaon.com/Q9	Prism2Installer_5.16.0.tmp, 00000001.00000003.2032390052.0000000000CD3000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.openssl.org/support/faq.html....................	Prism2Installer_5.16.0.tmp, 00000001.00000003.2027888808.0000000005970000.00000004.00001000.00020000.00000000.sdmp, is-KO5KN.tmp.1.dr	false		unknown
https://www.aaon.com	PrismII.exe, 00000006.00000000.2000811021.0000000000FA4000.00000020.00000001.01000000.00000008.sdmp	false		unknown
https://www.remobjects.com/ps	Prism2Installer_5.16.0.exe, 00000000.00000003.1797999514.00000000028A0000.00000004.00001000.00020000.00000000.sdmp, Prism2Installer_5.16.0.exe, 00000000.00000003.1798421873.000000007FB7B000.00000004.00001000.00020000.00000000.sdmp, Prism2Installer_5.16.0.tmp, 00000001.00000000.1800021829.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Prism2Installer_5.16.0.tmp.0.dr, is-JJU1I.tmp.1.dr	false	URL Reputation: safe	unknown
https://www.innosetup.com/	Prism2Installer_5.16.0.exe, 00000000.00000003.1797999514.00000000028A0000.00000004.00001000.00020000.00000000.sdmp, Prism2Installer_5.16.0.exe, 00000000.00000003.1798421873.000000007FB7B000.00000004.00001000.00020000.00000000.sdmp, Prism2Installer_5.16.0.tmp, 00000001.00000000.1800021829.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Prism2Installer_5.16.0.tmp.0.dr, is-JJU1I.tmp.1.dr	false	URL Reputation: safe	unknown
http://10.0.0.199	PrismII.exe, 00000006.00000001.2027335390.0000000000401000.00000020.00000001.01000000.00000008.sdmp	false		unknown
https://www.aaon.com/aaon-controls-technical-support	PrismII.exe, 00000006.00000000.2000811021.0000000000FA4000.00000020.00000001.01000000.00000008.sdmp	false		unknown
http://127.0.0.1&http://192.168.1.25	PrismII.exe, 00000006.00000001.2027335390.0000000000401000.00000020.00000001.01000000.00000008.sdmp, is-M9UEN.tmp.1.dr	false		unknown
https://www.aaon.com/	Prism2Installer_5.16.0.tmp, 00000001.00000003.1801585909.0000000003370000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://192.168.1.25	PrismII.exe, 00000006.00000001.2027335390.0000000000401000.00000020.00000001.01000000.00000008.sdmp	false		unknown
https://www.aaon.com/aaon-controls-technical-support(https://www.aaon.comT	PrismII.exe, 00000006.00000001.2027335390.0000000000401000.00000020.00000001.01000000.00000008.sdmp	false		unknown
http://www.openssl.org/support/faq.html	Prism2Installer_5.16.0.tmp, 00000001.00000003.2027888808.0000000005970000.00000004.00001000.00020000.00000000.sdmp, is-KO5KN.tmp.1.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1540391
Start date and time:	2024-10-23 18:02:47 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Prism2Installer_5.16.0.exe
Detection:	CLEAN
Classification:	clean2.winEXE@5/18@0/0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: Prism2Installer_5.16.0.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\is-43D6P.tmp\_isetup\_setup64.tmp	Reminder.exe	Get hash	malicious	Amadey	Browse
	yM3BrI8G1E	Get hash	malicious	Unknown	Browse
	MDE_File_Sample_7046d0b264f80a016ec10158377c7e76c395cffb.zip	Get hash	malicious	Xmrig	Browse
	Reminder.exe	Get hash	malicious	Amadey	Browse
	Reminder.exe	Get hash	malicious	Amadey	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	https://s3.us-east-2.amazonaws.com/revealedgceconomies/vdiq197yvi/ImgBurn_822881.exe?	Get hash	malicious	Unknown	Browse
	http://www.5movierulz.mom	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.FileRepMalware.4445.21502.exe	Get hash	malicious	Unknown	Browse
	NETGATE Spy Emergency.exe	Get hash	malicious	Amadey	Browse

Created / dropped Files

C:\PrismII\Configuration\DNS001.CFG

Download File

Process:	C:\PrismII\PrismII.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	127500
Entropy (8bit):	0.2084884467486285
Encrypted:	false
SSDEEP:	3:xJdJdJdJdJdJdJdJdJdJdJdJdJdJdJdJdJdJdJdJdJdJdJdJdJdJdJdJdJdJdJdl:3
MD5:	141AC3CA5348DC0F1E91AE8D09A88A91
SHA1:	127CCF0ED298E898DDBF5AE80F0708A33102D18A
SHA-256:	E300851A5AA92326883560DED5D61D2A49813F741A171F09F7207CFBD5E44B03
SHA-512:	932B19D31710BC888235AD27FC953F7AB870EAE81C5C6F0F087DADD443B6C06D9D81B0E0F8F4FBA0655C9A517BB91D0A65663D75507E550A465A0141C18D14E0
Malicious:	false
Reputation:	low
Preview:	0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0

C:\PrismII\Configuration\Node001.CFG

Download File

Process:	C:\PrismII\PrismII.exe
File Type:	ASCII text, with very long lines (20000), with no line terminators
Category:	dropped
Size (bytes):	20000
Entropy (8bit):	0.8475117683201995
Encrypted:	false
SSDEEP:	3:ZML0FLdLdLdLdLdLdLdLdLdLdLdLdLdLdLdLdLdLdLdLdLdLdLdLdLdLdLdLdLd7:5V
MD5:	3B7DDC02568FDCD6B178B67D2CE43441
SHA1:	43427AD63EBE3C4625EA1F6C0A0B43F12E1B3EB1
SHA-256:	671D41364BDE515117A82CEF51DF84BD4E5995C4A02F533C2ED26EE263D5214C
SHA-512:	706ED1B4CA3DBA16B75444E797E02E4D8D919FE9A2A80BC71FF89764B767F2EFB3EEB9B7F89DFA85C6D67FDD547E6C33A25C28ADA485BA5C420037FDDD965E70
Malicious:	false
Reputation:	low
Preview:	Main Site 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0

C:\PrismII\Configuration\ScreenID.dat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	550275
Entropy (8bit):	0.7020187553487591
Encrypted:	false
SSDEEP:	192:J6NZdZGHwHEfg0sFXVOOU4BKZX9c3mWC4D:J6NZd6+0sF6ZzWCo
MD5:	328933622B50C917264B13D38079063C
SHA1:	73A72629E22707884CD8A18AF2EE850D9EC4FB31
SHA-256:	AF0568A5EB402A0F03CF42C71CE31964C5C86683BA0E5C189B61ADC8B650DE6A
SHA-512:	D323AB54806E49329128AC0842139FB2EE73DEBA8DB7DAB2D5C9EA98AC7BA3002D8E3C735C6CF3CA3F9C5E269A02C9F17476666C98BB3D0D943108B6B27AF914
Malicious:	false
Reputation:	low
Preview:	No Unit Exists Unknown Type of Unit No Unit Exists Unknown Type of Unit No Unit Exists Unknown Type of Unit SZ Zone Controller Simple Zone Box Controller

C:\PrismII\Configuration\ULData.cfg

Download File

Process:	C:\PrismII\PrismII.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	1130
Entropy (8bit):	1.509057373761245
Encrypted:	false
SSDEEP:	24:xDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDf:xDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDf
MD5:	53F567827BEF0B8B36C3538A923BA13B
SHA1:	0FBD5AD7D1103A8233DA99EDFB080E7DE913BF2B
SHA-256:	E66DE109DB354CEBB0B083FBD6AB89634D628CF1A87F18CAB07C8B7517359AC0
SHA-512:	49F649C70BC06DA2D52E024BDAA2215E2F53E3DABEDCD61F97A7644DF08B5D7EE80AE614D210B6327676FC62C3E91355A29DA5C1A4ADEC3E8E5FC9371579A8FB
Malicious:	false
Reputation:	low
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\PrismII\Configuration\is-FCB81.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	550275
Entropy (8bit):	0.7020187553487591
Encrypted:	false
SSDEEP:	192:J6NZdZGHwHEfg0sFXVOOU4BKZX9c3mWC4D:J6NZd6+0sF6ZzWCo
MD5:	328933622B50C917264B13D38079063C
SHA1:	73A72629E22707884CD8A18AF2EE850D9EC4FB31
SHA-256:	AF0568A5EB402A0F03CF42C71CE31964C5C86683BA0E5C189B61ADC8B650DE6A
SHA-512:	D323AB54806E49329128AC0842139FB2EE73DEBA8DB7DAB2D5C9EA98AC7BA3002D8E3C735C6CF3CA3F9C5E269A02C9F17476666C98BB3D0D943108B6B27AF914
Malicious:	false
Reputation:	low
Preview:	No Unit Exists Unknown Type of Unit No Unit Exists Unknown Type of Unit No Unit Exists Unknown Type of Unit SZ Zone Controller Simple Zone Box Controller

C:\PrismII\History\HistoryForOctober2024.log

Download File

Process:	C:\PrismII\PrismII.exe
File Type:	Non-ISO extended-ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	74
Entropy (8bit):	4.620403908991135
Encrypted:	false
SSDEEP:	3:v46KxaN66VUcNYo60RFaJX2n:fqG66+jlJX2
MD5:	A5048EEACF05155534D634A7CBCC1F20
SHA1:	EEEA8C94C6042D683D3C0E9DB7F02608333C7BFA
SHA-256:	940196391DE9A2B2CF572707F6361C46BFBC5B0D6FCFD5DFA94530C97FE50173
SHA-512:	05E68EAC03D761D2E43DE4643A30B0683BBCFA193E701481AF9CB173193F1D34687C1149E619B51CB717AF140D1F5F0BFECEA432DF686D82B66EC8A33A09E03B
Malicious:	false
Reputation:	low
Preview:	................................................................

C:\PrismII\MailSend.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	540672
Entropy (8bit):	6.589943901912389
Encrypted:	false
SSDEEP:	6144:79fc73w/dP4/I4gtm5HIpB+hppFsbFBAIzKCJ66vnRNdh3Xqk+Vyua+L94U3Xiyq:hfhw/BC+hpspM6v33XX+VlZLqpPvx
MD5:	BCD5976DB70B789102E990086873EB38
SHA1:	D1E4E12D1396D1EF0C5388B857C3601E4E1E9034
SHA-256:	EC6160907197B2DD7713EFFF72668F1B540A5761EB3E7553E1029F09800AC6F5
SHA-512:	6065071290F9BFE7745490A88436FA7A7A581FB15967A689886B1F7E78F841B55F59CE4F37D895E81CB3298281C993548497FC161CDCF60B65CA7B0A6C45473B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[......H...H...Hd..H...H...H...H...H...H}..H...H...H...H...H#..HRich...H................PE..L...[..H..........................................@..........................p..............................................`+..d....................................................................................................................text...`........................... ..`.rdata...b.......p..................@..@.data...4!...@.......@..............@...................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\PrismII\PrismII.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	157048832
Entropy (8bit):	5.432892718392887
Encrypted:	false
SSDEEP:	3145728:ux4/dOauM1ChXamq0OaexFgHt3gPNBYSH7HKGFreSWd/VlrPtjZ1yHrAzirQywGx:I4/OM1ChXavkQlW/VlrPtjZ1yHrAzir+
MD5:	12FAE7511A984DF2C87DE60F746FF524
SHA1:	CECE15423818928AB82C9E129D01750CDC4836DE
SHA-256:	C8D34A2ABCAF6931CE705402DF9D5E65EB2FDFDF84D53BEF00230CA94C870ECF
SHA-512:	3CD47936CBB03DC8C81CD5F0CADB348119691AC05EF230844FB037031D102D7A6783E85A22449B53FDB249123283E61F96868D74076A891C9BA899CE61EA35FB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i......................*..............Rich....................PE..L...o..f.................0...@a.....LN.......@....@...........................g......Y].........................................(....p..z.V.................................................................0... ....................................text...l .......0.................. ..`.data....'...@.......@..............@....rsrc...z.V..p....V..P..............@..@..^............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................................................................

C:\PrismII\is-JJU1I.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3057725
Entropy (8bit):	6.399602928454567
Encrypted:	false
SSDEEP:	49152:4dJYVM+9JtzZWnoS2VC23aun8+f5KuGUOY9IGTiOynqT333vR:qJYVM+LtVt3P/KuGUONGTi3M3335
MD5:	36FDE363AFE35A339601753EECD23872
SHA1:	1B32EEBB3C26591F9B5BE42808BDEE32757944CD
SHA-256:	9F1A92C3D43010A4D13B4042FFF39F7883BFDF8061F62B7C8B976533579622F4
SHA-512:	00E00708F389A89A6C2C29E0F385D62518EC1C65F16FBFA9BED1C57BFB2CDD1406A92FE0AF6C06C0F5D57AFB156D952624F4B9DDB1382404CEB418B817CCFFAD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...et~f.......................................@.......................... /...........@......@...................P,.n.....,.j:....,.d....................................................p,.......................,......@,.(....................text............................. ..`.itext..$.......0................. ..`.data................*.............@....bss.....\|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.rsrc...d.....,.......+.............@..@.............`0......./.............@..@........................................................

C:\PrismII\is-KO5KN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	540672
Entropy (8bit):	6.589943901912389
Encrypted:	false
SSDEEP:	6144:79fc73w/dP4/I4gtm5HIpB+hppFsbFBAIzKCJ66vnRNdh3Xqk+Vyua+L94U3Xiyq:hfhw/BC+hpspM6v33XX+VlZLqpPvx
MD5:	BCD5976DB70B789102E990086873EB38
SHA1:	D1E4E12D1396D1EF0C5388B857C3601E4E1E9034
SHA-256:	EC6160907197B2DD7713EFFF72668F1B540A5761EB3E7553E1029F09800AC6F5
SHA-512:	6065071290F9BFE7745490A88436FA7A7A581FB15967A689886B1F7E78F841B55F59CE4F37D895E81CB3298281C993548497FC161CDCF60B65CA7B0A6C45473B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[......H...H...Hd..H...H...H...H...H...H}..H...H...H...H...H#..HRich...H................PE..L...[..H..........................................@..........................p..............................................`+..d....................................................................................................................text...`........................... ..`.rdata...b.......p..................@..@.data...4!...@.......@..............@...................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\PrismII\is-M9UEN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	157048832
Entropy (8bit):	5.432892718392887
Encrypted:	false
SSDEEP:	3145728:ux4/dOauM1ChXamq0OaexFgHt3gPNBYSH7HKGFreSWd/VlrPtjZ1yHrAzirQywGx:I4/OM1ChXavkQlW/VlrPtjZ1yHrAzir+
MD5:	12FAE7511A984DF2C87DE60F746FF524
SHA1:	CECE15423818928AB82C9E129D01750CDC4836DE
SHA-256:	C8D34A2ABCAF6931CE705402DF9D5E65EB2FDFDF84D53BEF00230CA94C870ECF
SHA-512:	3CD47936CBB03DC8C81CD5F0CADB348119691AC05EF230844FB037031D102D7A6783E85A22449B53FDB249123283E61F96868D74076A891C9BA899CE61EA35FB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i......................*..............Rich....................PE..L...o..f.................0...@a.....LN.......@....@...........................g......Y].........................................(....p..z.V.................................................................0... ....................................text...l .......0.................. ..`.data....'...@.......@..............@....rsrc...z.V..p....V..P..............@..@..^............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................................................................

C:\PrismII\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp
File Type:	InnoSetup Log Prism2 {4FEB6242-809F-4FB9-8944-A78F798F1B1F}, version 0x418, 1749 bytes, 367706\37\user\376, C:\PrismII\376\377\377\007
Category:	dropped
Size (bytes):	1749
Entropy (8bit):	3.4075468737866204
Encrypted:	false
SSDEEP:	48:3GswYUM9iCy1CiCyfiCysw9e7xeUhdR4O:xMC0HCZCJJ7Hhbt
MD5:	A2214AF45642CAD2A28AE24634CB6576
SHA1:	E375B5E322F81DB195CB82A5DFA5E82F94452DE1
SHA-256:	8CD33239402A5FDFE443414FFA138FE465C1BC0A3815114360F80218B7DBB489
SHA-512:	C12128851DD7526D8208B2911028318F54D0A88A18929B2FA0F3FF36909819BB231F3F3783B9BE2035D33AD63AEB0A108036AC9D9B4435FD0C2FDB1FE2880B85
Malicious:	false
Preview:	Inno Setup Uninstall Log (b)....................................{4FEB6242-809F-4FB9-8944-A78F798F1B1F}..........................................................................................Prism2......................................................................................................................................%.................................................................................................................9...........J.......O........3.6.7.7.0.6......j.o.n.e.s......C.:.\.P.r.i.s.m.I.I...................._.. ........................C.:.\.P.r.i.s.m.I.I..d...C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.R.o.a.m.i.n.g.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.S.t.a.r.t. .M.e.n.u.\.P.r.o.g.r.a.m.s.\.(.D.e.f.a.u.l.t.)......(.D.e.f.a.u.l.t.)......e.n.g.l.i.s.h......................C.:.\.P.r.i.s.m.I.I........F........C.:.\.P.r.i.s.m.I.I.\.P.r.i.s.m.I.I...e.x.e............................H........C.:.\.P.r.i.s.m.I.I.\.M.a.i.l.S.e.n.d...e.x.e.....................

C:\PrismII\unins000.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3057725
Entropy (8bit):	6.399602928454567
Encrypted:	false
SSDEEP:	49152:4dJYVM+9JtzZWnoS2VC23aun8+f5KuGUOY9IGTiOynqT333vR:qJYVM+LtVt3P/KuGUONGTi3M3335
MD5:	36FDE363AFE35A339601753EECD23872
SHA1:	1B32EEBB3C26591F9B5BE42808BDEE32757944CD
SHA-256:	9F1A92C3D43010A4D13B4042FFF39F7883BFDF8061F62B7C8B976533579622F4
SHA-512:	00E00708F389A89A6C2C29E0F385D62518EC1C65F16FBFA9BED1C57BFB2CDD1406A92FE0AF6C06C0F5D57AFB156D952624F4B9DDB1382404CEB418B817CCFFAD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...et~f.......................................@.......................... /...........@......@...................P,.n.....,.j:....,.d....................................................p,.......................,......@,.(....................text............................. ..`.itext..$.......0................. ..`.data................*.............@....bss.....\|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.rsrc...d.....,.......+.............@..@.............`0......./.............@..@........................................................

C:\Users\user\AppData\Local\Temp\is-43D6P.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Reminder.exe, Detection: malicious, Browse Filename: yM3BrI8G1E, Detection: malicious, Browse Filename: MDE_File_Sample_7046d0b264f80a016ec10158377c7e76c395cffb.zip, Detection: malicious, Browse Filename: Reminder.exe, Detection: malicious, Browse Filename: Reminder.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: SecuriteInfo.com.FileRepMalware.4445.21502.exe, Detection: malicious, Browse Filename: NETGATE Spy Emergency.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp

Download File

Process:	C:\Users\user\Desktop\Prism2Installer_5.16.0.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3033600
Entropy (8bit):	6.413371256177009
Encrypted:	false
SSDEEP:	49152:gdJYVM+9JtzZWnoS2VC23aun8+f5KuGUOY9IGTiOynqT333v1:SJYVM+LtVt3P/KuGUONGTi3M333N
MD5:	6C38595D6F1B9F7FF6D63EF3E34B5980
SHA1:	AAE6E7BE296BACA2149E9C8D30F2AF681B980F1A
SHA-256:	DF865795D2FE4D67ADDE0694FAE8C3C244819A23F7D63EB2CFB83BBB94BFBCE7
SHA-512:	CFD0186116F4EDCA42DD3AD3C70995CEC36FC173EFE9E343E7503CD629698D94E2971D09DB3ED1191E2995E2F4983F9A3138D1ED7E7F90F5DF4D0BFB8E37D6DB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...et~f.......................................@.......................... /...........@......@...................P,.n.....,.j:....,.d....................................................p,.......................,......@,.(....................text............................. ..`.itext..$.......0................. ..`.data................*.............@....bss.....\|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.rsrc...d.....,.......+.............@..@.............`0......./.............@..@........................................................

C:\Users\user\AppData\Local\Temp\~DFF43006658DD9B6A4.TMP

Download File

Process:	C:\PrismII\PrismII.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	2.2178718217522224
Encrypted:	false
SSDEEP:	48:rBkB5ItciePVwcg6I6K/UaR4xjU2vldpLXGIp11V/Sq:2UC3zjIF4xvPBW
MD5:	3D872D3F126C3F478F6080204D0585DF
SHA1:	BD2CCB67E0C7A6A39D4659124C7BDCFC9B5D96DD
SHA-256:	1071E385DE9E3B8228E512AA4EB6D0D5E8F133F48150D5E3260FC68B0B618748
SHA-512:	0D9C272D959101476A2DCC9D488ECFEC36F4EDD7D423F0FF9F9F582727B4185C33175D2A2C4023CFFAF060EC0F2DA409C76D83CEA0A6A1C7F60E2F8F6DC8C3DD
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Prism2.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Wed Oct 23 15:04:00 2024, mtime=Wed Oct 23 15:04:03 2024, atime=Tue Aug 27 12:06:40 2024, length=157048832, window=hide
Category:	dropped
Size (bytes):	657
Entropy (8bit):	4.471494448627936
Encrypted:	false
SSDEEP:	12:8mbOYpzB8m/y1c1xjAomIRTmkBpiHdHIBmV:8mb561yFAomIRTbiHdHIBm
MD5:	0F62AB761F67C315E3B4CCB20A699B0A
SHA1:	AB33CD084CD4F30E9B3398C6ED99AC046AAD3545
SHA-256:	480B7F409F4C5B0C59D670236A2D1834ACD7490D744A2E6A31D89661CE7FE8CB
SHA-512:	313518838367837609A4C540ED1FAD98358F4740A1BE9A77ED710D2805BE8D99E3A918C9F2A5BB8C93F741257F3B81C95E09504875217E099FB59F03A393AA8F
Malicious:	false
Preview:	L..................F.... .....E,e%...0,.e%...p......`\..........................P.O. .:i.....+00.../C:\...................V.1.....WY....PrismII.@......WY..WY......v......................ZR.P.r.i.s.m.I.I.....b.2..`\..Y.h .PrismII.exe.H......WY..WY......O.........................P.r.i.s.m.I.I...e.x.e.......E...............-.......D...................C:\PrismII\PrismII.exe..+.....\.....\.....\.....\.....\.....\.....\.....\.P.r.i.s.m.I.I.\.P.r.i.s.m.I.I...e.x.e...C.:.\.P.r.i.s.m.I.I.`.......X.......367706...........hT..CrF.f4... .d.T..b...,.......hT..CrF.f4... .d.T..b...,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Users\user\Desktop\Prism2.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Wed Oct 23 15:04:00 2024, mtime=Wed Oct 23 15:04:07 2024, atime=Tue Aug 27 12:06:40 2024, length=157048832, window=hide
Category:	dropped
Size (bytes):	627
Entropy (8bit):	4.54811657368663
Encrypted:	false
SSDEEP:	12:8mbOGpzB8m/y1c1xjAomBmkBpiHdHIBmV:8mbv61yFAomBbiHdHIBm
MD5:	405D849095EBAA8A3CC9CC07CE29E8BE
SHA1:	A48BFC802B69B444280CF30DAEBBF61F03C3A1AA
SHA-256:	6ABB6323A89B2EFD34317ACAAED2CE713A2ACA4B8EE2C55E8E88C01D8203537F
SHA-512:	6A55D1149932C338FADD989253A6E42DDF92821F510FB6946B025DB698742F63CFA0837CA6C2DC7B08C70D25A4E2BADE09908748C4C6CFC821319E99CC4CD392
Malicious:	false
Preview:	L..................F.... .....E,e%..&.0e%...p......`\..........................P.O. .:i.....+00.../C:\...................V.1.....WY....PrismII.@......WY..WY......v......................ZR.P.r.i.s.m.I.I.....b.2..`\..Y.h .PrismII.exe.H......WY..WY......O.........................P.r.i.s.m.I.I...e.x.e.......E...............-.......D...................C:\PrismII\PrismII.exe........\.....\.....\.P.r.i.s.m.I.I.\.P.r.i.s.m.I.I...e.x.e...C.:.\.P.r.i.s.m.I.I.`.......X.......367706...........hT..CrF.f4... .d.T..b...,.......hT..CrF.f4... .d.T..b...,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.98617535105383
TrID:	Win32 Executable (generic) a (10002005/4) 98.45% Inno Setup installer (109748/4) 1.08% Win32 EXE PECompact compressed (generic) (41571/9) 0.41% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02%
File name:	Prism2Installer_5.16.0.exe
File size:	13'908'305 bytes
MD5:	c68a2b8f2d38f0878728cf372b38d61d
SHA1:	7b22b800110e35298db6916fac5baae1c8fbadb8
SHA256:	8dab9b8ba64255c67d2f47c48ee6799f988412dabe61fb5cb32be8b3acbd5c6f
SHA512:	aafcf32ff567faaac39cf175e705e36bcbff8350dc0e8ef861c2531d9f5e9b726bed2b52331fcf638b7ba12cc2045eed59f014d62dc5b6b768600eaa8d176838
SSDEEP:	196608:11br2DhBQ5w94phkkKVnH6IVRlvHKkMdB2KVoMoz3nW6ix3ttn1x1cFmwEUZSm5X:1Nrmhq84pNunHVRdL967n1IQsSOiZ8D
TLSH:	BDE63317B3CBA43DF05E5B370AB2909858F76632A813AE16DBE8447CCF190601E7E756
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	499b3174cecd2b41

Static PE Info

General

Entrypoint:	0x4a83bc
Entrypoint Section:	.itext
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x667E7465 [Fri Jun 28 08:29:25 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	40ab50289f7ef5fae60801f88d4541fc

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFA4h
push ebx
push esi
push edi
xor eax, eax
mov dword ptr [ebp-3Ch], eax
mov dword ptr [ebp-40h], eax
mov dword ptr [ebp-5Ch], eax
mov dword ptr [ebp-30h], eax
mov dword ptr [ebp-38h], eax
mov dword ptr [ebp-34h], eax
mov dword ptr [ebp-2Ch], eax
mov dword ptr [ebp-28h], eax
mov dword ptr [ebp-14h], eax
mov eax, 004A2EBCh
call 00007FC93C7B9D35h
xor eax, eax
push ebp
push 004A8AC1h
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
xor edx, edx
push ebp
push 004A8A7Bh
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
mov eax, dword ptr [004B0634h]
call 00007FC93C84B6BBh
call 00007FC93C84B20Eh
lea edx, dword ptr [ebp-14h]
xor eax, eax
call 00007FC93C845EE8h
mov edx, dword ptr [ebp-14h]
mov eax, 004B41F4h
call 00007FC93C7B3DE3h
push 00000002h
push 00000000h
push 00000001h
mov ecx, dword ptr [004B41F4h]
mov dl, 01h
mov eax, dword ptr [0049CD14h]
call 00007FC93C847213h
mov dword ptr [004B41F8h], eax
xor edx, edx
push ebp
push 004A8A27h
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
call 00007FC93C84B743h
mov dword ptr [004B4200h], eax
mov eax, dword ptr [004B4200h]
cmp dword ptr [eax+0Ch], 01h
jne 00007FC93C85242Ah
mov eax, dword ptr [004B4200h]
mov edx, 00000028h
call 00007FC93C847B08h
mov edx, dword ptr [004B4200h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0xb7000	0x71	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb5000	0xfec	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xba000	0x3dfc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xb9000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xb52d4	0x25c	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0xb6000	0x1a4	.didata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xa568c	0xa5800	b889d302f6fc48a904de33d8d947ae80	False	0.3620185045317221	data	6.377190161826806	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0xa7000	0x1b64	0x1c00	588dd0a8ab499300d3701cbd11b017d9	False	0.548828125	data	6.109264411030635	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xa9000	0x3838	0x3a00	5c0c76e77aef52ebc6702430837ccb6e	False	0.35338092672413796	data	4.95916338709992	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0xad000	0x7258	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xb5000	0xfec	0x1000	627340dff539ef99048969aa4824fb2d	False	0.380615234375	data	5.020404933181373	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didata	0xb6000	0x1a4	0x200	fd11c1109737963cc6cb7258063abfd6	False	0.34765625	data	2.729290535217263	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0xb7000	0x71	0x200	7de8ca0c7a61668a728fd3a88dc0942d	False	0.1796875	data	1.305578535725827	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0xb8000	0x18	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xb9000	0x5d	0x200	d84006640084dc9f74a07c2ff9c7d656	False	0.189453125	data	1.3892750148744617	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xba000	0x3dfc	0x3e00	5decb615500b16f43d9d8a62a0cf972f	False	0.32913306451612906	data	4.41640931219863	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xba438	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152	English	United States	0.384927797833935
RT_STRING	0xbace0	0x3f8	data			0.3198818897637795
RT_STRING	0xbb0d8	0x2dc	data			0.36475409836065575
RT_STRING	0xbb3b4	0x430	data			0.40578358208955223
RT_STRING	0xbb7e4	0x44c	data			0.38636363636363635
RT_STRING	0xbbc30	0x2d4	data			0.39226519337016574
RT_STRING	0xbbf04	0xb8	data			0.6467391304347826
RT_STRING	0xbbfbc	0x9c	data			0.6410256410256411
RT_STRING	0xbc058	0x374	data			0.4230769230769231
RT_STRING	0xbc3cc	0x398	data			0.3358695652173913
RT_STRING	0xbc764	0x368	data			0.3795871559633027
RT_STRING	0xbcacc	0x2a4	data			0.4275147928994083
RT_RCDATA	0xbcd70	0x10	data			1.5
RT_RCDATA	0xbcd80	0x310	data			0.6173469387755102
RT_RCDATA	0xbd090	0x2c	data			1.1818181818181819
RT_GROUP_ICON	0xbd0bc	0x14	data	English	United States	1.15
RT_VERSION	0xbd0d0	0x584	data	English	United States	0.25708215297450426
RT_MANIFEST	0xbd654	0x7a8	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.3377551020408163

Imports

DLL	Import
kernel32.dll	GetACP, GetExitCodeProcess, CloseHandle, LocalFree, SizeofResource, VirtualProtect, QueryPerformanceFrequency, VirtualFree, GetFullPathNameW, GetProcessHeap, ExitProcess, HeapAlloc, GetCPInfoExW, RtlUnwind, GetCPInfo, GetStdHandle, GetModuleHandleW, FreeLibrary, HeapDestroy, ReadFile, CreateProcessW, GetLastError, GetModuleFileNameW, SetLastError, FindResourceW, CreateThread, CompareStringW, LoadLibraryA, ResetEvent, GetVolumeInformationW, GetVersion, GetDriveTypeW, RaiseException, FormatMessageW, SwitchToThread, GetExitCodeThread, GetCurrentThread, LoadLibraryExW, LockResource, GetCurrentThreadId, UnhandledExceptionFilter, VirtualQuery, VirtualQueryEx, Sleep, EnterCriticalSection, SetFilePointer, LoadResource, SuspendThread, GetTickCount, GetFileSize, GetStartupInfoW, GetFileAttributesW, InitializeCriticalSection, GetSystemWindowsDirectoryW, GetThreadPriority, SetThreadPriority, GetCurrentProcess, VirtualAlloc, GetCommandLineW, GetSystemInfo, LeaveCriticalSection, GetProcAddress, ResumeThread, GetVersionExW, VerifyVersionInfoW, HeapCreate, GetWindowsDirectoryW, LCMapStringW, VerSetConditionMask, GetDiskFreeSpaceW, FindFirstFileW, GetUserDefaultUILanguage, lstrlenW, QueryPerformanceCounter, SetEndOfFile, HeapFree, WideCharToMultiByte, FindClose, MultiByteToWideChar, LoadLibraryW, SetEvent, CreateFileW, GetLocaleInfoW, GetSystemDirectoryW, DeleteFileW, GetLocalTime, GetEnvironmentVariableW, WaitForSingleObject, WriteFile, ExitThread, DeleteCriticalSection, TlsGetValue, GetDateFormatW, SetErrorMode, IsValidLocale, TlsSetValue, CreateDirectoryW, GetSystemDefaultUILanguage, EnumCalendarInfoW, LocalAlloc, GetUserDefaultLangID, RemoveDirectoryW, CreateEventW, SetThreadLocale, GetThreadLocale
comctl32.dll	InitCommonControls
user32.dll	CreateWindowExW, TranslateMessage, CharLowerBuffW, CallWindowProcW, CharUpperW, PeekMessageW, GetSystemMetrics, SetWindowLongW, MessageBoxW, DestroyWindow, CharUpperBuffW, CharNextW, MsgWaitForMultipleObjects, LoadStringW, ExitWindowsEx, DispatchMessageW
oleaut32.dll	SysAllocStringLen, SafeArrayPtrOfIndex, VariantCopy, SafeArrayGetLBound, SafeArrayGetUBound, VariantInit, VariantClear, SysFreeString, SysReAllocStringLen, VariantChangeType, SafeArrayCreate
advapi32.dll	ConvertStringSecurityDescriptorToSecurityDescriptorW, OpenThreadToken, AdjustTokenPrivileges, LookupPrivilegeValueW, RegOpenKeyExW, OpenProcessToken, FreeSid, AllocateAndInitializeSid, EqualSid, RegQueryValueExW, GetTokenInformation, ConvertSidToStringSidW, RegCloseKey

Exports

Name	Ordinal	Address
__dbk_fcall_wrapper	2	0x40fc10
dbkFCallWrapperAddr	1	0x4b063c

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	12:03:50
Start date:	23/10/2024
Path:	C:\Users\user\Desktop\Prism2Installer_5.16.0.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Prism2Installer_5.16.0.exe"
Imagebase:	0x400000
File size:	13'908'305 bytes
MD5 hash:	C68A2B8F2D38F0878728CF372B38D61D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	12:03:51
Start date:	23/10/2024
Path:	C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp" /SL5="$2043C,13061428,722432,C:\Users\user\Desktop\Prism2Installer_5.16.0.exe"
Imagebase:	0x400000
File size:	3'033'600 bytes
MD5 hash:	6C38595D6F1B9F7FF6D63EF3E34B5980
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	12:04:11
Start date:	23/10/2024
Path:	C:\PrismII\PrismII.exe
Wow64 process (32bit):	true
Commandline:	"C:\PrismII\PrismII.exe"
Imagebase:	0x400000
File size:	157'048'832 bytes
MD5 hash:	12FAE7511A984DF2C87DE60F746FF524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Prism2Installer_5.16.0.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\PrismII\Configuration\DNS001.CFG

C:\PrismII\Configuration\Node001.CFG

C:\PrismII\Configuration\ScreenID.dat (copy)

C:\PrismII\Configuration\ULData.cfg

C:\PrismII\Configuration\is-FCB81.tmp

C:\PrismII\History\HistoryForOctober2024.log

C:\PrismII\MailSend.exe (copy)

C:\PrismII\PrismII.exe (copy)

C:\PrismII\is-JJU1I.tmp

C:\PrismII\is-KO5KN.tmp

C:\PrismII\is-M9UEN.tmp

C:\PrismII\unins000.dat

C:\PrismII\unins000.exe (copy)

C:\Users\user\AppData\Local\Temp\is-43D6P.tmp\_isetup\_setup64.tmp

C:\Users\user\AppData\Local\Temp\is-VU0SV.tmp\Prism2Installer_5.16.0.tmp

C:\Users\user\AppData\Local\Temp\~DFF43006658DD9B6A4.TMP

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Prism2.lnk

C:\Users\user\Desktop\Prism2.lnk

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Windows Analysis Report
Prism2Installer_5.16.0.exe