| File name: | PeaceSetup.exe |
| Full analysis: | https://app.any.run/tasks/cde9238f-7067-4e62-b634-31361670f2d6 |
| Verdict: | Malicious activity |
| Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
| Analysis date: | December 24, 2024, 18:56:24 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections |
| MD5: | 0F2D324ABD3930F1D62371402C2CD2AD |
| SHA1: | F33AC5A0247B2D862EB57FF471525829C10882A1 |
| SHA256: | 3D6FDED2A75161AD4DDC088BBD22EAE15E1F69BCB62151BA05F96F2AF94AADB4 |
| SSDEEP: | 196608:OYE+nBXHAMylXa3YL/wpB8WdaDnT6Pb8yetHsAQ9ezEhJAq3JN3RuQSC7xrL:0+nFAZL/wQGsnT8Yye9dW5heq73xSYv |
MALICIOUS
No malicious indicators.SUSPICIOUS
Executable content was dropped or overwritten
- PeaceSetup.exe (PID: 3840)
Drops 7-zip archiver for unpacking
- PeaceSetup.exe (PID: 3840)
Reads security settings of Internet Explorer
- PeaceSetup.exe (PID: 3840)
Checks Windows Trust Settings
- PeaceSetup.exe (PID: 3840)
INFO
Reads mouse settings
- PeaceSetup.exe (PID: 3840)
The sample compiled with english language support
- PeaceSetup.exe (PID: 3840)
Checks supported languages
- PeaceSetup.exe (PID: 3840)
- identity_helper.exe (PID: 6716)
Create files in a temporary directory
- PeaceSetup.exe (PID: 3840)
Reads the computer name
- PeaceSetup.exe (PID: 3840)
- identity_helper.exe (PID: 6716)
Reads the machine GUID from the registry
- PeaceSetup.exe (PID: 3840)
Checks proxy server information
- PeaceSetup.exe (PID: 3840)
Reads the software policy settings
- PeaceSetup.exe (PID: 3840)
Creates files or folders in the user directory
- PeaceSetup.exe (PID: 3840)
Application launched itself
- msedge.exe (PID: 3172)
- msedge.exe (PID: 5696)
Manual execution by a user
- msedge.exe (PID: 5696)
The process uses AutoIt
- PeaceSetup.exe (PID: 3840)
Reads Environment values
- identity_helper.exe (PID: 6716)
Executable content was dropped or overwritten
- msedge.exe (PID: 5696)
Sends debugging messages
- msedge.exe (PID: 5388)
The process uses the downloaded file
- msedge.exe (PID: 7812)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable (generic) (3.6) |
|---|---|---|
| .exe | | | Generic Win/DOS Executable (1.6) |
| .exe | | | DOS Executable Generic (1.5) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2024:12:22 13:16:50+00:00 |
| ImageFileCharacteristics: | Executable, Large address aware, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 12 |
| CodeSize: | 581632 |
| InitializedDataSize: | 30640640 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x2800a |
| OSVersion: | 5.1 |
| ImageVersion: | - |
| SubsystemVersion: | 5.1 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.6.8.10 |
| ProductVersionNumber: | 1.6.8.10 |
| FileFlagsMask: | 0x0000 |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Unknown |
| FileSubtype: | - |
| LanguageCode: | English (British) |
| CharacterSet: | Unicode |
| FileVersion: | 1.6.8.10 |
| Comments: | Install & Uninstall Peace, Back up & Restore configurations (presets), Configure Peace and Get help |
| FileDescription: | Setup Tool for Peace (Peter's Equalizer APO Configuration Extension) |
| ProductName: | Peace |
| ProductVersion: | 1.6.8.10 |
| LegalCopyright: | P.E. Verbeek |
Total processes
182
Monitored processes
59
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 628 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2812 --field-trial-handle=2356,i,5193030349880399863,2036565674259431485,262144 --variations-seed-version /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Version: 122.0.2365.59 Modules
| |||||||||||||||
| 716 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3700 --field-trial-handle=2356,i,5193030349880399863,2036565674259431485,262144 --variations-seed-version /prefetch:1 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Version: 122.0.2365.59 Modules
| |||||||||||||||
| 1228 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2552 --field-trial-handle=2356,i,5193030349880399863,2036565674259431485,262144 --variations-seed-version /prefetch:3 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | msedge.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Version: 122.0.2365.59 Modules
| |||||||||||||||
| 1512 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=8448 --field-trial-handle=2356,i,5193030349880399863,2036565674259431485,262144 --variations-seed-version /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 122.0.2365.59 Modules
| |||||||||||||||
| 1544 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --no-appcompat-clear --mojo-platform-channel-handle=8496 --field-trial-handle=2356,i,5193030349880399863,2036565674259431485,262144 --variations-seed-version /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 122.0.2365.59 Modules
| |||||||||||||||
| 2132 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=8100 --field-trial-handle=2356,i,5193030349880399863,2036565674259431485,262144 --variations-seed-version /prefetch:1 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Version: 122.0.2365.59 Modules
| |||||||||||||||
| 2292 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=8232 --field-trial-handle=2356,i,5193030349880399863,2036565674259431485,262144 --variations-seed-version /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 122.0.2365.59 Modules
| |||||||||||||||
| 2292 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=35 --mojo-platform-channel-handle=6292 --field-trial-handle=2356,i,5193030349880399863,2036565674259431485,262144 --variations-seed-version /prefetch:1 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Version: 122.0.2365.59 Modules
| |||||||||||||||
| 2456 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3504 --field-trial-handle=2356,i,5193030349880399863,2036565674259431485,262144 --variations-seed-version /prefetch:1 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Version: 122.0.2365.59 Modules
| |||||||||||||||
| 2728 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=8292 --field-trial-handle=2356,i,5193030349880399863,2036565674259431485,262144 --variations-seed-version /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Exit code: 0 Version: 122.0.2365.59 Modules
| |||||||||||||||
Total events
13 157
Read events
13 114
Write events
43
Delete events
0
Modification events
| (PID) Process: | (3840) PeaceSetup.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (3840) PeaceSetup.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (3840) PeaceSetup.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (3840) PeaceSetup.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer |
| Operation: | write | Name: | SlowContextMenuEntries |
Value: 6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000 | |||
| (PID) Process: | (5696) msedge.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon |
| Operation: | write | Name: | failed_count |
Value: 0 | |||
| (PID) Process: | (5696) msedge.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon |
| Operation: | write | Name: | state |
Value: 2 | |||
| (PID) Process: | (5696) msedge.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon |
| Operation: | write | Name: | state |
Value: 1 | |||
| (PID) Process: | (3172) msedge.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\StabilityMetrics |
| Operation: | write | Name: | user_experience_metrics.stability.exited_cleanly |
Value: 1 | |||
| (PID) Process: | (3172) msedge.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon |
| Operation: | write | Name: | failed_count |
Value: 0 | |||
| (PID) Process: | (3172) msedge.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon |
| Operation: | write | Name: | state |
Value: 2 | |||
Executable files
24
Suspicious files
501
Text files
134
Unknown types
2
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3840 | PeaceSetup.exe | C:\Users\admin\AppData\Local\Temp\aut70CE.tmp | — | |
MD5:— | SHA256:— | |||
| 3840 | PeaceSetup.exe | C:\Users\admin\AppData\Local\Temp\7z.exe | executable | |
MD5:E7957B74BEFE1B2451C460B111C8E86F | SHA256:27A05F5C210DA07E1EDB7C0E6EB995B26B0164E8BFF38478ED12036D463B2B19 | |||
| 3840 | PeaceSetup.exe | C:\Users\admin\AppData\Local\Temp\aut7611.tmp | binary | |
MD5:FD823FEF5E307E130B1FB33DCBBAE775 | SHA256:AC745D9CD6938FBA7BDF843C51C777CC8EC0C11A25C458B77CB471DBB40E1DE3 | |||
| 3840 | PeaceSetup.exe | C:\Users\admin\AppData\Local\Temp\aut75A1.tmp | chm | |
MD5:753D8652136F511A347D33AFA97410CC | SHA256:54847ABAB6C7BEA34B22EDD6A9A511107B5CEC4AA85C57C4A2227DCB23E74F79 | |||
| 3840 | PeaceSetup.exe | C:\Users\admin\AppData\Local\Temp\Peace.chm | chm | |
MD5:753D8652136F511A347D33AFA97410CC | SHA256:54847ABAB6C7BEA34B22EDD6A9A511107B5CEC4AA85C57C4A2227DCB23E74F79 | |||
| 3840 | PeaceSetup.exe | C:\Users\admin\AppData\Local\Temp\CurrentPeace.exe | executable | |
MD5:D8FDD20280F5B80B68725A2F39F819C7 | SHA256:C0888E3B1C0D00E87A5C5F7DECE2D8D1CADEE58F3C8DF6A1D0DE924AAC71740D | |||
| 3840 | PeaceSetup.exe | C:\Users\admin\AppData\Local\Temp\aut7691.tmp | image | |
MD5:E475ABB25AFD7B4B9FFF2B0A40A7DAB1 | SHA256:A93A425B641C1DFBF83ADDFEAF1E7438D571CB49CE617BA863C1C9B1B8B36C27 | |||
| 3840 | PeaceSetup.exe | C:\Users\admin\AppData\Local\Temp\icontiny.png | image | |
MD5:F1FD349B745A1C957430D12DACDAC561 | SHA256:E68391F5FA3CA80194E4927C1E6CAE96770B57483073298DC84DFE3078657773 | |||
| 3840 | PeaceSetup.exe | C:\Users\admin\AppData\Local\Temp\questionmark.png | image | |
MD5:7BE8946E99ECE93018A7CFA891A77E1C | SHA256:ECD3AAF4960E067F0CC07B4783EB9257218E5F780EEA59FA08951F14DDA00B34 | |||
| 3840 | PeaceSetup.exe | C:\Users\admin\AppData\Local\Temp\download.png | image | |
MD5:F355635B69FD5227FF80925AC6C6BD60 | SHA256:B1940B89F14666A26330F483B8AF2A549B3D5D313C6EDC2BD38E8F3F1BF47481 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
274
TCP/UDP connections
267
DNS requests
264
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1688 | RUXIMICS.exe | GET | 200 | 23.48.23.167:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
4712 | MoUsoCoreWorker.exe | GET | 200 | 23.48.23.167:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
5160 | svchost.exe | GET | 200 | 23.48.23.167:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
5160 | svchost.exe | GET | 200 | 2.23.9.218:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
4712 | MoUsoCoreWorker.exe | GET | 200 | 2.23.9.218:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
1688 | RUXIMICS.exe | GET | 200 | 2.23.9.218:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
— | — | GET | 401 | 13.107.6.158:443 | https://business.bing.com/api/v1/user/token/microsoftgraph?&clienttype=edge-omnibox | unknown | — | — | — |
— | — | OPTIONS | 200 | 2.19.198.56:443 | https://bzib.nelreports.net/api/report?cat=bingbusiness | unknown | — | — | — |
— | — | GET | 200 | 104.18.5.227:443 | https://c.sf-syn.com/conversion_outbound_tracker/sf | unknown | — | — | — |
— | — | GET | 200 | 13.107.42.16:443 | https://config.edge.skype.com/config/v1/Edge/122.0.2365.59?clientId=4489578223053569932&agents=EdgeFirstRun%2CEdgeFirstRunConfig&osname=win&client=edge&channel=stable&scpfre=0&osarch=x86_64&osver=10.0.19045&wu=1&devicefamily=desktop&uma=0&sessionid=45&mngd=0&installdate=1661339457&edu=0&bphint=2&soobedate=1504771245&fg=1 | unknown | binary | 768 b | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
1688 | RUXIMICS.exe | 40.127.240.158:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
— | — | 192.168.100.255:137 | — | — | — | whitelisted |
4712 | MoUsoCoreWorker.exe | 40.127.240.158:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
5160 | svchost.exe | 40.127.240.158:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
— | — | 192.168.100.255:138 | — | — | — | whitelisted |
5160 | svchost.exe | 23.48.23.167:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
1688 | RUXIMICS.exe | 23.48.23.167:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
4712 | MoUsoCoreWorker.exe | 23.48.23.167:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
5160 | svchost.exe | 2.23.9.218:80 | www.microsoft.com | AKAMAI-AS | CZ | whitelisted |
1688 | RUXIMICS.exe | 2.23.9.218:80 | www.microsoft.com | AKAMAI-AS | CZ | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
sourceforge.net |
| whitelisted |
downloads.sourceforge.net |
| whitelisted |
yer.dl.sourceforge.net |
| whitelisted |
config.edge.skype.com |
| whitelisted |
edge.microsoft.com |
| whitelisted |
business.bing.com |
| whitelisted |
Threats
Process | Message |
|---|---|
msedge.exe | [1224/185803.575:WARNING:device_ticket.cc(151)] Timed out waiting for device ticket. Canceling async operation.
|
msedge.exe | [1224/185803.575:ERROR:device_ticket.cc(187)] The identity is null.
|
msedge.exe | [1224/185806.595:ERROR:filesystem_win.cc(128)] GetFileAttributes C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\attachments\2f9aba5a-b4bd-4314-8be1-4ea2952c5b74: The system cannot find the file specified. (0x2)
|
msedge.exe | [1224/185806.604:ERROR:filesystem_win.cc(128)] GetFileAttributes C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\attachments\2f9aba5a-b4bd-4314-8be1-4ea2952c5b74: The system cannot find the file specified. (0x2)
|
msedge.exe | [1224/185806.640:ERROR:filesystem_win.cc(128)] GetFileAttributes C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\attachments\2f9aba5a-b4bd-4314-8be1-4ea2952c5b74: The system cannot find the file specified. (0x2)
|
msedge.exe | [1224/185806.640:ERROR:filesystem_win.cc(128)] GetFileAttributes C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\attachments\2f9aba5a-b4bd-4314-8be1-4ea2952c5b74: The system cannot find the file specified. (0x2)
|