File name:

setup.exe

Full analysis: https://app.any.run/tasks/a5df2c37-98fb-4008-b719-7d6253741ec1
Verdict: Malicious activity
Analysis date: February 18, 2024, 12:29:19
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

4B01913A2D88BB0FEAAADE32926D3296

SHA1:

CA2BA31B126EEB73DE19C486ACDD1CCF97F8CF16

SHA256:

183C0AAFB525F53788A74638321BD43616A47A8B3CFC940FBA45DD3DC8767B6B

SSDEEP:

12288:ymkOy/GpBkg8PjFWuZp3TW6CeV8lvsOqH2gOlh:yfOyaBbKjAuK+I/gOL

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • setup.exe (PID: 2036)
      • is-D15K3.tmp (PID: 2844)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • setup.exe (PID: 2036)
      • is-D15K3.tmp (PID: 2844)

    • Process drops legitimate windows executable

      • is-D15K3.tmp (PID: 2844)

    • Reads the Windows owner or organization settings

      • is-D15K3.tmp (PID: 2844)

    • Start notepad (likely ransomware note)

      • is-D15K3.tmp (PID: 2844)

  • INFO

    • Checks supported languages

      • setup.exe (PID: 2036)
      • is-D15K3.tmp (PID: 2844)
      • HashCalc.exe (PID: 1876)
      • HashCalc.exe (PID: 3212)

    • Create files in a temporary directory

      • is-D15K3.tmp (PID: 2844)
      • setup.exe (PID: 2036)

    • Creates files in the program directory

      • is-D15K3.tmp (PID: 2844)

    • Creates a software uninstall entry

      • is-D15K3.tmp (PID: 2844)

    • Reads the computer name

      • is-D15K3.tmp (PID: 2844)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable PowerBASIC/Win 9.x (51.2)
.exe | Inno Setup installer (37.9)
.exe | Win32 Executable Delphi generic (4.9)
.dll | Win32 Dynamic Link Library (generic) (2.2)
.exe | Win32 Executable (generic) (1.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 36864
InitializedDataSize: 16896
UninitializedDataSize: -
EntryPoint: 0x98d8
OSVersion: 1
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 2.0.2.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
Comments: This installation was built with Inno Setup: http://www.innosetup.com
CompanyName: SlavaSoft Inc.
FileDescription: HashCalc Setup
FileVersion: 2.0.2.0
LegalCopyright: Copyright (C) 1999-2007 SlavaSoft Inc.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
46
Monitored processes
6
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start setup.exe is-d15k3.tmp hashcalc.exe no specs notepad.exe no specs hashcalc.exe no specs setup.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
864"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\HashCalc\README.TXTC:\Windows\System32\notepad.exe—is-D15K3.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1876"C:\Program Files\HashCalc\HashCalc.exe" /installC:\Program Files\HashCalc\HashCalc.exe—is-D15K3.tmp
User:
admin
Company:
SlavaSoft Inc.
Integrity Level:
HIGH
Description:
Hash Calculator
Exit code:
0
Version:
2, 0, 2, 0
Modules
Images
c:\program files\hashcalc\hashcalc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2036"C:\Users\admin\AppData\Local\Temp\setup.exe" C:\Users\admin\AppData\Local\Temp\setup.exe
explorer.exe
User:
admin
Company:
SlavaSoft Inc.
Integrity Level:
HIGH
Description:
HashCalc Setup
Exit code:
0
Version:
2.0.2.0
Modules
Images
c:\users\admin\appdata\local\temp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
2844"C:\Users\admin\AppData\Local\Temp\is-QD12R.tmp\is-D15K3.tmp" /SL4 $100130 "C:\Users\admin\AppData\Local\Temp\setup.exe" 256685 52224 C:\Users\admin\AppData\Local\Temp\is-QD12R.tmp\is-D15K3.tmp
setup.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.44.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-qd12r.tmp\is-d15k3.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
3212"C:\Program Files\HashCalc\HashCalc.exe"C:\Program Files\HashCalc\HashCalc.exe—is-D15K3.tmp
User:
admin
Company:
SlavaSoft Inc.
Integrity Level:
HIGH
Description:
Hash Calculator
Exit code:
2
Version:
2, 0, 2, 0
Modules
Images
c:\program files\hashcalc\hashcalc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
3672"C:\Users\admin\AppData\Local\Temp\setup.exe" C:\Users\admin\AppData\Local\Temp\setup.exe—explorer.exe
User:
admin
Company:
SlavaSoft Inc.
Integrity Level:
MEDIUM
Description:
HashCalc Setup
Exit code:
3221226540
Version:
2.0.2.0
Modules
Images
c:\users\admin\appdata\local\temp\setup.exe
c:\windows\system32\ntdll.dll
Total events
2 859
Read events
2 839
Write events
20
Delete events
0

Modification events

(PID) Process:(2844) is-D15K3.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HashCalc_is1
Operation:writeName:Inno Setup: Setup Version
Value:
5.1.9
(PID) Process:(2844) is-D15K3.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HashCalc_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Program Files\HashCalc
(PID) Process:(2844) is-D15K3.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HashCalc_is1
Operation:writeName:InstallLocation
Value:
C:\Program Files\HashCalc\
(PID) Process:(2844) is-D15K3.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HashCalc_is1
Operation:writeName:Inno Setup: Icon Group
Value:
HashCalc
(PID) Process:(2844) is-D15K3.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HashCalc_is1
Operation:writeName:Inno Setup: User
Value:
admin
(PID) Process:(2844) is-D15K3.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HashCalc_is1
Operation:writeName:Inno Setup: Selected Tasks
Value:
desktopicon
(PID) Process:(2844) is-D15K3.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HashCalc_is1
Operation:writeName:Inno Setup: Deselected Tasks
Value:
quicklaunchicon
(PID) Process:(2844) is-D15K3.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HashCalc_is1
Operation:writeName:DisplayName
Value:
HashCalc 2.02
(PID) Process:(2844) is-D15K3.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HashCalc_is1
Operation:writeName:UninstallString
Value:
"C:\Program Files\HashCalc\unins000.exe"
(PID) Process:(2844) is-D15K3.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HashCalc_is1
Operation:writeName:QuietUninstallString
Value:
"C:\Program Files\HashCalc\unins000.exe" /SILENT
Executable files
8
Suspicious files
8
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
2844is-D15K3.tmpC:\Users\admin\AppData\Local\Temp\is-NTLA8.tmp\_isetup\_shfoldr.dllexecutable
MD5:92DC6EF532FBB4A5C3201469A5B5EB63
SHA256:9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
2036setup.exeC:\Users\admin\AppData\Local\Temp\is-QD12R.tmp\is-D15K3.tmpexecutable
MD5:4FA180886FF7C0FD86A65F760EDE6318
SHA256:1D9026C60374B056720CDFCFA598A641CC8FBC9932590D69B4CFBC32CD09871C
2844is-D15K3.tmpC:\Users\admin\AppData\Local\Temp\is-NTLA8.tmp\_isetup\_isdecmp.dllexecutable
MD5:A813D18268AFFD4763DDE940246DC7E5
SHA256:E19781AABE466DD8779CB9C8FA41BBB73375447066BB34E876CF388A6ED63C64
2844is-D15K3.tmpC:\Users\admin\AppData\Local\Temp\is-NTLA8.tmp\_isetup\_RegDLL.tmpexecutable
MD5:C594B792B9C556EA62A30DE541D2FB03
SHA256:5DCC1E0A197922907BCA2C4369F778BD07EE4B1BBBDF633E987A028A314D548E
2844is-D15K3.tmpC:\Program Files\HashCalc\HashCalc.chmbinary
MD5:2AE58CE465094805E474D7F29AFCC5A2
SHA256:A00BC7F604C8810068ECE4FA743FD6AB747246DA7F2E7FC19A9BAE27A597CCD7
2844is-D15K3.tmpC:\Program Files\HashCalc\is-3MNTC.tmpexecutable
MD5:E50F59C2CD3CC50D1677C14B7E3B8B2E
SHA256:09DB70857484AC207313AA481FC808CC532539FBCE2A0D88545EACC7A283064B
2844is-D15K3.tmpC:\Program Files\HashCalc\unins000.exeexecutable
MD5:E50F59C2CD3CC50D1677C14B7E3B8B2E
SHA256:09DB70857484AC207313AA481FC808CC532539FBCE2A0D88545EACC7A283064B
2844is-D15K3.tmpC:\Program Files\HashCalc\HashCalc.exeexecutable
MD5:E922301DA3512247AB71407096AB7810
SHA256:72B08EBEE27F2E57670300ACAAA274D1F127F8AB0383D90D7498E2A6257761FE
2844is-D15K3.tmpC:\Program Files\HashCalc\is-BG6E9.tmpexecutable
MD5:E922301DA3512247AB71407096AB7810
SHA256:72B08EBEE27F2E57670300ACAAA274D1F127F8AB0383D90D7498E2A6257761FE
2844is-D15K3.tmpC:\Program Files\HashCalc\ReadMe.txttext
MD5:59EC31C0A428A10F7792EC3EB3DB9059
SHA256:22B995CB7C58A3C4D0629C185EFB7BB2F37B074A66CD21C66FAC74999740B1DE
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
3
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
setup.exe