File name: | SETUPREG.EXE |
Full analysis: | https://app.any.run/tasks/bfece831-ded7-4761-98c0-4c1fc2467e7a |
Verdict: | Malicious activity |
Analysis date: | February 21, 2020, 22:15:42 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (console) Intel 80386, for MS Windows |
MD5: | 5138C8BECF9E02D4EEB59F3765DED178 |
SHA1: | DC724770ECE8907FBB7E211B933B649AF73056E7 |
SHA256: | 268FE404496426795E79748C755E481D33161906E1404A3C9BD3A5233688C1C3 |
SSDEEP: | 384:67GRxdGLbl1fwzeV9TtHv5Z8kXILp+hZobru/agrtix:y2uoertHvHtXIYSrAZti |
.exe | | | Win32 Executable MS Visual C++ (generic) (41) |
---|---|---|
.exe | | | Win64 Executable (generic) (36.3) |
.dll | | | Win32 Dynamic Link Library (generic) (8.6) |
.exe | | | Win32 Executable (generic) (5.9) |
.exe | | | Win16/32 Executable Delphi generic (2.7) |
MachineType: | Intel 386 or later, and compatibles |
---|---|
TimeStamp: | 1998:10:01 16:55:15+02:00 |
PEType: | PE32 |
LinkerVersion: | 5 |
CodeSize: | 15872 |
InitializedDataSize: | 19456 |
UninitializedDataSize: | - |
EntryPoint: | 0x17c0 |
OSVersion: | 4 |
ImageVersion: | - |
SubsystemVersion: | 4 |
Subsystem: | Windows command line |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_CUI |
Compilation Date: | 01-Oct-1998 14:55:15 |
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0090 |
Pages in file: | 0x0003 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x0000 |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x0000 |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x00000080 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 4 |
Time date stamp: | 01-Oct-1998 14:55:15 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 0x00001000 | 0x00003C46 | 0x00003E00 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.32792 |
.rdata | 0x00005000 | 0x000003AF | 0x00000400 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.91295 |
.data | 0x00006000 | 0x00004088 | 0x00002E00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 1.21721 |
.idata | 0x0000B000 | 0x00000476 | 0x00000600 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 4.0337 |
ADVAPI32.dll |
KERNEL32.dll |
USER32.dll |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
1688 | "C:\Users\admin\AppData\Local\Temp\SETUPREG.EXE" | C:\Users\admin\AppData\Local\Temp\SETUPREG.EXE | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 3221226540 Modules
| |||||||||||||||
4020 | "C:\Users\admin\AppData\Local\Temp\SETUPREG.EXE" | C:\Users\admin\AppData\Local\Temp\SETUPREG.EXE | explorer.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
3344 | "C:\Windows\explorer.exe" | C:\Windows\explorer.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
3860 | "C:\Users\admin\AppData\Local\Temp\SETUPREG.EXE" | C:\Users\admin\AppData\Local\Temp\SETUPREG.EXE | explorer.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
340 | "C:\Windows\system32\cmd.exe" | C:\Windows\system32\cmd.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
4060 | C:\Users\admin\AppData\Local\Temp\SETUPREG.EXE | C:\Users\admin\AppData\Local\Temp\SETUPREG.EXE | — | cmd.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 3221226540 Modules
| |||||||||||||||
3004 | "C:\Users\admin\AppData\Local\Temp\SETUPREG.EXE" | C:\Users\admin\AppData\Local\Temp\SETUPREG.EXE | — | cmd.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 3221226540 Modules
| |||||||||||||||
944 | "C:\Users\admin\AppData\Local\Temp\SETUPREG.EXE" | C:\Users\admin\AppData\Local\Temp\SETUPREG.EXE | cmd.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
3184 | C:\Users\admin\AppData\Local\Temp\SETUPREG.EXE | C:\Users\admin\AppData\Local\Temp\SETUPREG.EXE | — | cmd.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 3221226540 Modules
| |||||||||||||||
3620 | "C:\Users\admin\AppData\Local\Temp\SETUPREG.EXE" | C:\Users\admin\AppData\Local\Temp\SETUPREG.EXE | — | cmd.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 3221226540 Modules
|
PID | Process | Filename | Type | |
---|---|---|---|---|
2400 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
3828 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\O0RFWST2.txt | — | |
MD5:— | SHA256:— | |||
3828 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\HYPF11M1.txt | — | |
MD5:— | SHA256:— | |||
3828 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\qsml[1].htm | — | |
MD5:— | SHA256:— | |||
3828 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\Cab2787.tmp | — | |
MD5:— | SHA256:— | |||
3828 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\Tar2788.tmp | — | |
MD5:— | SHA256:— | |||
3828 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\7R35OYVG.txt | text | |
MD5:4AAA90B363C3868E07B745F8FECD3F37 | SHA256:588AEC017363C8D1E09F88FF0DC4BD808A7B5CE0E52FDCB872D9E3768FAFF0CD | |||
3828 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\A2C636GD.htm | html | |
MD5:936E153F482FD6BCED435B1E3E6BD635 | SHA256:2CEEF56E63980CD54850A4015B38494C053912F48A7D9766CAF044DDECB0B006 | |||
3828 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\qsml[3].xml | xml | |
MD5:213A562EEB3EB2A8A869421ABA027626 | SHA256:A59B602E1CB0062E55797B6128698961F4C1BA202F0E85574022C819F151765A | |||
3828 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_D9817BD5013875AD517DA73475345203 | binary | |
MD5:8634CA3F5FAA8B3C07C3D6C0FB4D51C3 | SHA256:AA4397107EDE75030B12490F8EAC944DCFD1431937961A70F161C9F2F556688B |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3828 | iexplore.exe | GET | — | 13.107.5.80:80 | http://api.bing.com/qsml.aspx?query=http%3A%2F%2Fwww.zone.com%2Fasp%2Faofe&maxwidth=32765&rowheight=20§ionHeight=160&FORM=IE11SS&market=en-US | US | — | — | whitelisted |
3828 | iexplore.exe | GET | — | 13.107.5.80:80 | http://api.bing.com/qsml.aspx?query=http%3A%2F%2Fwww.zone.com%2Fasp%2Faofere&maxwidth=32765&rowheight=20§ionHeight=160&FORM=IE11SS&market=en-US | US | — | — | whitelisted |
3828 | iexplore.exe | GET | — | 13.107.5.80:80 | http://api.bing.com/qsml.aspx?query=http%3A%2F%2Fwww.zone.com%2Fas&maxwidth=32765&rowheight=20§ionHeight=160&FORM=IE11SS&market=en-US | US | — | — | whitelisted |
3828 | iexplore.exe | GET | — | 13.107.5.80:80 | http://api.bing.com/qsml.aspx?query=http%3A%2F%2Fwww.zone.com%2Fasp%2Faofer&maxwidth=32765&rowheight=20§ionHeight=160&FORM=IE11SS&market=en-US | US | — | — | whitelisted |
3828 | iexplore.exe | GET | — | 13.107.5.80:80 | http://api.bing.com/qsml.aspx?query=http%3A%2F%2Fwww.zone.com%2Fasp%2F&maxwidth=32765&rowheight=20§ionHeight=160&FORM=IE11SS&market=en-US | US | — | — | whitelisted |
3828 | iexplore.exe | GET | — | 13.107.5.80:80 | http://api.bing.com/qsml.aspx?query=http%3A%2F%2Fwww.zone.com%2Fasp%2Fao&maxwidth=32765&rowheight=20§ionHeight=160&FORM=IE11SS&market=en-US | US | — | — | whitelisted |
3828 | iexplore.exe | GET | 200 | 13.107.5.80:80 | http://api.bing.com/qsml.aspx?query=http%3A%2F%2Fwww.zone.com%2Fasp%2Faoferedir.a&maxwidth=32765&rowheight=20§ionHeight=160&FORM=IE11SS&market=en-US | US | xml | 180 b | whitelisted |
— | — | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2Fz5hY5qj0aEmX0H4s05bY%3D | US | der | 1.47 Kb | whitelisted |
3828 | iexplore.exe | GET | 200 | 13.107.5.80:80 | http://api.bing.com/qsml.aspx?query=http%3A%2F%2Fwww.zone.com%2F&maxwidth=32765&rowheight=20§ionHeight=160&FORM=IE11SS&market=en-US | US | xml | 230 b | whitelisted |
3828 | iexplore.exe | GET | 301 | 104.215.95.187:80 | http://www.zone.com/ | US | html | 113 b | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
— | — | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
2400 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
3828 | iexplore.exe | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
3828 | iexplore.exe | 104.215.95.187:80 | www.zone.com | Microsoft Corporation | US | whitelisted |
3828 | iexplore.exe | 168.61.170.191:443 | zone.msn.com | Microsoft Corporation | US | whitelisted |
3828 | iexplore.exe | 13.107.5.80:80 | api.bing.com | Microsoft Corporation | US | whitelisted |
3828 | iexplore.exe | 168.61.170.191:80 | zone.msn.com | Microsoft Corporation | US | whitelisted |
3504 | gup.exe | 104.31.88.28:443 | notepad-plus-plus.org | Cloudflare Inc | US | shared |
3828 | iexplore.exe | 172.217.18.106:443 | ajax.googleapis.com | Google Inc. | US | whitelisted |
3828 | iexplore.exe | 209.197.3.15:443 | maxcdn.bootstrapcdn.com | Highwinds Network Group, Inc. | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
notepad-plus-plus.org |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
www.zone.com |
| malicious |
api.bing.com |
| whitelisted |
www.bing.com |
| whitelisted |
zone.msn.com |
| whitelisted |
ajax.googleapis.com |
| whitelisted |
maxcdn.bootstrapcdn.com |
| whitelisted |
s.aolcdn.com |
| whitelisted |
az725175.vo.msecnd.net |
| whitelisted |
Process | Message |
---|---|
notepad++.exe | VerifyLibrary: C:\Program Files\Notepad++\SciLexer.dll
|
notepad++.exe | VerifyLibrary: certificate revocation checking is disabled
|
notepad++.exe | 42C4C5846BB675C74E2B2C90C69AB44366401093
|