| File name: | setup.exe |
| Full analysis: | https://app.any.run/tasks/894ab869-33ab-49e3-bc2c-1715911f7b9f |
| Verdict: | Malicious activity |
| Analysis date: | April 30, 2024, 16:43:51 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | C613F134C322A464A0AA1F2C9A97D269 |
| SHA1: | 7A28EB44A6A0B18E7BD2CB09C8F331247E78BDA3 |
| SHA256: | 110ABC595E5B9BE94F249841CE48197A94144A8295702B25F9046531FC527AA3 |
| SSDEEP: | 24576:eBgpF3k8zA+kGW6sWcvVU0prz1Gpq62DBGnsZ6hf8qzd5WtOW8aW:eBG3k8zA+kGW6sWcvVU0prBGpq62DBGJ |
MALICIOUS
Drops the executable file immediately after the start
- setup.exe (PID: 3968)
- setup.tmp (PID: 928)
- setup.exe (PID: 1200)
Actions looks like stealing of personal data
- setup.tmp (PID: 928)
SUSPICIOUS
Executable content was dropped or overwritten
- setup.exe (PID: 3968)
- setup.exe (PID: 1200)
- setup.tmp (PID: 928)
Process drops legitimate windows executable
- setup.tmp (PID: 928)
Reads the Windows owner or organization settings
- setup.tmp (PID: 928)
INFO
Checks supported languages
- setup.exe (PID: 3968)
- setup.exe (PID: 1200)
- setup.tmp (PID: 3984)
- setup.tmp (PID: 928)
Create files in a temporary directory
- setup.exe (PID: 3968)
- setup.exe (PID: 1200)
- setup.tmp (PID: 928)
Reads the computer name
- setup.tmp (PID: 928)
- setup.tmp (PID: 3984)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Inno Setup installer (71.1) |
|---|---|---|
| .exe | | | Win32 Executable Delphi generic (9.1) |
| .scr | | | Windows screen saver (8.4) |
| .dll | | | Win32 Dynamic Link Library (generic) (4.2) |
| .exe | | | Win32 Executable (generic) (2.9) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 1992:06:19 22:22:17+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi |
| PEType: | PE32 |
| LinkerVersion: | 2.25 |
| CodeSize: | 40448 |
| InitializedDataSize: | 17920 |
| UninitializedDataSize: | - |
| EntryPoint: | 0xa5f8 |
| OSVersion: | 1 |
| ImageVersion: | 6 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 0.0.0.0 |
| ProductVersionNumber: | 0.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| Comments: | This installation was built with Inno Setup. |
| CompanyName: | |
| FileDescription: | Batman Arkham Asylum - Game of the Year Edition |
| FileVersion: | |
| LegalCopyright: | |
| ProductName: | Batman Arkham Asylum - Game of the Year Edition |
| ProductVersion: |
Total processes
38
Monitored processes
4
Malicious processes
4
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 928 | "C:\Users\admin\AppData\Local\Temp\is-TS4IC.tmp\setup.tmp" /SL5="$40130,56832,0,C:\Users\admin\AppData\Local\Temp\setup.exe" /SPAWNWND=$20134 /NOTIFYWND=$20138 | C:\Users\admin\AppData\Local\Temp\is-TS4IC.tmp\setup.tmp | setup.exe | ||||||||||||
User: admin Integrity Level: HIGH Description: Setup/Uninstall Exit code: 1 Version: 51.52.0.0 Modules
| |||||||||||||||
| 1200 | "C:\Users\admin\AppData\Local\Temp\setup.exe" /SPAWNWND=$20134 /NOTIFYWND=$20138 | C:\Users\admin\AppData\Local\Temp\setup.exe | setup.tmp | ||||||||||||
User: admin Company: Integrity Level: HIGH Description: Batman Arkham Asylum - Game of the Year Edition Exit code: 1 Version: Modules
| |||||||||||||||
| 3968 | "C:\Users\admin\AppData\Local\Temp\setup.exe" | C:\Users\admin\AppData\Local\Temp\setup.exe | explorer.exe | ||||||||||||
User: admin Company: Integrity Level: MEDIUM Description: Batman Arkham Asylum - Game of the Year Edition Exit code: 1 Version: Modules
| |||||||||||||||
| 3984 | "C:\Users\admin\AppData\Local\Temp\is-HN2N5.tmp\setup.tmp" /SL5="$20138,56832,0,C:\Users\admin\AppData\Local\Temp\setup.exe" | C:\Users\admin\AppData\Local\Temp\is-HN2N5.tmp\setup.tmp | — | setup.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: Setup/Uninstall Exit code: 1 Version: 51.52.0.0 Modules
| |||||||||||||||
Total events
6 179
Read events
6 161
Write events
14
Delete events
4
Modification events
| (PID) Process: | (928) setup.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | Owner |
Value: A0030000549C359A1D9BDA01 | |||
| (PID) Process: | (928) setup.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | SessionHash |
Value: AE0F2D2F1EFFEDD5F68946BCCB9C40322041A177C3796E08FFC32631D559072B | |||
| (PID) Process: | (928) setup.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | Sequence |
Value: 1 | |||
| (PID) Process: | (928) setup.tmp | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (928) setup.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer |
| Operation: | write | Name: | Browse For Folder Width |
Value: 318 | |||
| (PID) Process: | (928) setup.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer |
| Operation: | write | Name: | Browse For Folder Height |
Value: 288 | |||
| (PID) Process: | (928) setup.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
| Operation: | delete value | Name: | Sequence |
Value: | |||
| (PID) Process: | (928) setup.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
| Operation: | delete value | Name: | SessionHash |
Value: ྮ⼭＞헭觶뱆鳋㉀䄠瞡秃쏿ㄦ姕⬇ | |||
| (PID) Process: | (928) setup.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
| Operation: | delete value | Name: | Owner |
Value: Π | |||
| (PID) Process: | (928) setup.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
| Operation: | delete key | Name: | (default) |
Value: | |||
Executable files
3
Suspicious files
0
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3968 | setup.exe | C:\Users\admin\AppData\Local\Temp\is-HN2N5.tmp\setup.tmp | executable | |
MD5:A2C4D52C66B4B399FACADB8CC8386745 | SHA256:6C0465CE64C07E729C399A338705941D77727C7D089430957DF3E91A416E9D2A | |||
| 1200 | setup.exe | C:\Users\admin\AppData\Local\Temp\is-TS4IC.tmp\setup.tmp | executable | |
MD5:A2C4D52C66B4B399FACADB8CC8386745 | SHA256:6C0465CE64C07E729C399A338705941D77727C7D089430957DF3E91A416E9D2A | |||
| 928 | setup.tmp | C:\Users\admin\AppData\Local\Temp\is-RCOPP.tmp\_isetup\_shfoldr.dll | executable | |
MD5:92DC6EF532FBB4A5C3201469A5B5EB63 | SHA256:9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
3
DNS requests
0
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
1088 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |