| File name: | PeaceSetup.exe |
| Full analysis: | https://app.any.run/tasks/cde9238f-7067-4e62-b634-31361670f2d6 |
| Verdict: | Malicious activity |
| Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
| Analysis date: | December 24, 2024, 18:56:24 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections |
| MD5: | 0F2D324ABD3930F1D62371402C2CD2AD |
| SHA1: | F33AC5A0247B2D862EB57FF471525829C10882A1 |
| SHA256: | 3D6FDED2A75161AD4DDC088BBD22EAE15E1F69BCB62151BA05F96F2AF94AADB4 |
| SSDEEP: | 196608:OYE+nBXHAMylXa3YL/wpB8WdaDnT6Pb8yetHsAQ9ezEhJAq3JN3RuQSC7xrL:0+nFAZL/wQGsnT8Yye9dW5heq73xSYv |
MALICIOUS
No malicious indicators.SUSPICIOUS
Drops 7-zip archiver for unpacking
- PeaceSetup.exe (PID: 3840)
Executable content was dropped or overwritten
- PeaceSetup.exe (PID: 3840)
Checks Windows Trust Settings
- PeaceSetup.exe (PID: 3840)
Reads security settings of Internet Explorer
- PeaceSetup.exe (PID: 3840)
INFO
The sample compiled with english language support
- PeaceSetup.exe (PID: 3840)
Reads mouse settings
- PeaceSetup.exe (PID: 3840)
Checks supported languages
- PeaceSetup.exe (PID: 3840)
- identity_helper.exe (PID: 6716)
Creates files or folders in the user directory
- PeaceSetup.exe (PID: 3840)
Reads the software policy settings
- PeaceSetup.exe (PID: 3840)
Manual execution by a user
- msedge.exe (PID: 5696)
Application launched itself
- msedge.exe (PID: 5696)
- msedge.exe (PID: 3172)
Reads the computer name
- identity_helper.exe (PID: 6716)
- PeaceSetup.exe (PID: 3840)
The process uses AutoIt
- PeaceSetup.exe (PID: 3840)
Executable content was dropped or overwritten
- msedge.exe (PID: 5696)
Reads Environment values
- identity_helper.exe (PID: 6716)
Reads the machine GUID from the registry
- PeaceSetup.exe (PID: 3840)
Sends debugging messages
- msedge.exe (PID: 5388)
The process uses the downloaded file
- msedge.exe (PID: 7812)
Checks proxy server information
- PeaceSetup.exe (PID: 3840)
Create files in a temporary directory
- PeaceSetup.exe (PID: 3840)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable (generic) (3.6) |
|---|---|---|
| .exe | | | Generic Win/DOS Executable (1.6) |
| .exe | | | DOS Executable Generic (1.5) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2024:12:22 13:16:50+00:00 |
| ImageFileCharacteristics: | Executable, Large address aware, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 12 |
| CodeSize: | 581632 |
| InitializedDataSize: | 30640640 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x2800a |
| OSVersion: | 5.1 |
| ImageVersion: | - |
| SubsystemVersion: | 5.1 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.6.8.10 |
| ProductVersionNumber: | 1.6.8.10 |
| FileFlagsMask: | 0x0000 |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Unknown |
| FileSubtype: | - |
| LanguageCode: | English (British) |
| CharacterSet: | Unicode |
| FileVersion: | 1.6.8.10 |
| Comments: | Install & Uninstall Peace, Back up & Restore configurations (presets), Configure Peace and Get help |
| FileDescription: | Setup Tool for Peace (Peter's Equalizer APO Configuration Extension) |
| ProductName: | Peace |
| ProductVersion: | 1.6.8.10 |
| LegalCopyright: | P.E. Verbeek |
Total processes
182
Monitored processes
59
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 628 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2812 --field-trial-handle=2356,i,5193030349880399863,2036565674259431485,262144 --variations-seed-version /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Version: 122.0.2365.59 Modules
| |||||||||||||||
| 716 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3700 --field-trial-handle=2356,i,5193030349880399863,2036565674259431485,262144 --variations-seed-version /prefetch:1 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Version: 122.0.2365.59 Modules
| |||||||||||||||
| 1228 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2552 --field-trial-handle=2356,i,5193030349880399863,2036565674259431485,262144 --variations-seed-version /prefetch:3 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | msedge.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Version: 122.0.2365.59 Modules
| |||||||||||||||
| 1512 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=8448 --field-trial-handle=2356,i,5193030349880399863,2036565674259431485,262144 --variations-seed-version /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 122.0.2365.59 Modules
| |||||||||||||||
| 1544 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --no-appcompat-clear --mojo-platform-channel-handle=8496 --field-trial-handle=2356,i,5193030349880399863,2036565674259431485,262144 --variations-seed-version /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 122.0.2365.59 Modules
| |||||||||||||||
| 2132 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=8100 --field-trial-handle=2356,i,5193030349880399863,2036565674259431485,262144 --variations-seed-version /prefetch:1 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Version: 122.0.2365.59 Modules
| |||||||||||||||
| 2292 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=8232 --field-trial-handle=2356,i,5193030349880399863,2036565674259431485,262144 --variations-seed-version /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 122.0.2365.59 Modules
| |||||||||||||||
| 2292 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=35 --mojo-platform-channel-handle=6292 --field-trial-handle=2356,i,5193030349880399863,2036565674259431485,262144 --variations-seed-version /prefetch:1 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Version: 122.0.2365.59 Modules
| |||||||||||||||
| 2456 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3504 --field-trial-handle=2356,i,5193030349880399863,2036565674259431485,262144 --variations-seed-version /prefetch:1 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Version: 122.0.2365.59 Modules
| |||||||||||||||
| 2728 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=8292 --field-trial-handle=2356,i,5193030349880399863,2036565674259431485,262144 --variations-seed-version /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Exit code: 0 Version: 122.0.2365.59 Modules
| |||||||||||||||
Total events
13 157
Read events
13 114
Write events
43
Delete events
0
Modification events
| (PID) Process: | (3840) PeaceSetup.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (3840) PeaceSetup.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (3840) PeaceSetup.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (3840) PeaceSetup.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer |
| Operation: | write | Name: | SlowContextMenuEntries |
Value: 6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000 | |||
| (PID) Process: | (5696) msedge.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon |
| Operation: | write | Name: | failed_count |
Value: 0 | |||
| (PID) Process: | (5696) msedge.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon |
| Operation: | write | Name: | state |
Value: 2 | |||
| (PID) Process: | (5696) msedge.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon |
| Operation: | write | Name: | state |
Value: 1 | |||
| (PID) Process: | (3172) msedge.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\StabilityMetrics |
| Operation: | write | Name: | user_experience_metrics.stability.exited_cleanly |
Value: 1 | |||
| (PID) Process: | (3172) msedge.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon |
| Operation: | write | Name: | failed_count |
Value: 0 | |||
| (PID) Process: | (3172) msedge.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon |
| Operation: | write | Name: | state |
Value: 2 | |||
Executable files
24
Suspicious files
501
Text files
134
Unknown types
2
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3840 | PeaceSetup.exe | C:\Users\admin\AppData\Local\Temp\aut70CE.tmp | — | |
MD5:— | SHA256:— | |||
| 3840 | PeaceSetup.exe | C:\Users\admin\AppData\Local\Temp\CurrentPeace.exe | executable | |
MD5:D8FDD20280F5B80B68725A2F39F819C7 | SHA256:C0888E3B1C0D00E87A5C5F7DECE2D8D1CADEE58F3C8DF6A1D0DE924AAC71740D | |||
| 3840 | PeaceSetup.exe | C:\Users\admin\AppData\Local\Temp\aut767F.tmp | binary | |
MD5:222FB818E5A2AD457274BD50F577E3AD | SHA256:4558437C8B7CACE853409E535227E029CFAAC6A243E039578A1F538AF1B9A537 | |||
| 3840 | PeaceSetup.exe | C:\Users\admin\AppData\Local\Temp\7z.exe | executable | |
MD5:E7957B74BEFE1B2451C460B111C8E86F | SHA256:27A05F5C210DA07E1EDB7C0E6EB995B26B0164E8BFF38478ED12036D463B2B19 | |||
| 3840 | PeaceSetup.exe | C:\Users\admin\AppData\Local\Temp\Peace.chm | chm | |
MD5:753D8652136F511A347D33AFA97410CC | SHA256:54847ABAB6C7BEA34B22EDD6A9A511107B5CEC4AA85C57C4A2227DCB23E74F79 | |||
| 3840 | PeaceSetup.exe | C:\Users\admin\AppData\Local\Temp\aut7611.tmp | binary | |
MD5:FD823FEF5E307E130B1FB33DCBBAE775 | SHA256:AC745D9CD6938FBA7BDF843C51C777CC8EC0C11A25C458B77CB471DBB40E1DE3 | |||
| 3840 | PeaceSetup.exe | C:\Users\admin\AppData\Local\Temp\aut76B4.tmp | binary | |
MD5:2AA41771B666FA93E22047B150E291D3 | SHA256:E7702A4694BD460ED9CE19C0614C8494C62B68B7DC39494B24A6FAFA03A060AD | |||
| 3840 | PeaceSetup.exe | C:\Users\admin\AppData\Local\Temp\aut76A1.tmp | image | |
MD5:7BE8946E99ECE93018A7CFA891A77E1C | SHA256:ECD3AAF4960E067F0CC07B4783EB9257218E5F780EEA59FA08951F14DDA00B34 | |||
| 3840 | PeaceSetup.exe | C:\Users\admin\AppData\Local\Temp\aut76A2.tmp | image | |
MD5:735F5E92B74C67EDA5184BBC44879CC3 | SHA256:3E4A7DAB25F24D23F3CBBFA55D2D033D4F92CFB8FF911FB9BB1AA6E12C16E69C | |||
| 3840 | PeaceSetup.exe | C:\Users\admin\AppData\Local\Temp\icon.png | image | |
MD5:CDAD8A6C45E0288F0C3982ACA99D7D69 | SHA256:DD1C8ED88D87FDDDCBC01E17F5319F6E13A07394D646BFF33CB21497EAFB62C1 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
274
TCP/UDP connections
267
DNS requests
264
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1688 | RUXIMICS.exe | GET | 200 | 23.48.23.167:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
5160 | svchost.exe | GET | 200 | 23.48.23.167:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
4712 | MoUsoCoreWorker.exe | GET | 200 | 23.48.23.167:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
5160 | svchost.exe | GET | 200 | 2.23.9.218:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
1688 | RUXIMICS.exe | GET | 200 | 2.23.9.218:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
4712 | MoUsoCoreWorker.exe | GET | 200 | 2.23.9.218:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
— | — | GET | 401 | 13.107.6.158:443 | https://business.bing.com/api/v1/user/token/microsoftgraph?&clienttype=edge-omnibox | unknown | — | — | unknown |
— | — | OPTIONS | 200 | 2.19.198.56:443 | https://bzib.nelreports.net/api/report?cat=bingbusiness | unknown | — | — | unknown |
— | — | GET | 200 | 104.18.5.227:443 | https://c.sf-syn.com/conversion_outbound_tracker/sf | unknown | — | — | unknown |
— | — | GET | 200 | 13.107.42.16:443 | https://config.edge.skype.com/config/v1/Edge/122.0.2365.59?clientId=4489578223053569932&agents=EdgeFirstRun%2CEdgeFirstRunConfig&osname=win&client=edge&channel=stable&scpfre=0&osarch=x86_64&osver=10.0.19045&wu=1&devicefamily=desktop&uma=0&sessionid=45&mngd=0&installdate=1661339457&edu=0&bphint=2&soobedate=1504771245&fg=1 | unknown | binary | 768 b | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
1688 | RUXIMICS.exe | 40.127.240.158:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
— | — | 192.168.100.255:137 | — | — | — | whitelisted |
4712 | MoUsoCoreWorker.exe | 40.127.240.158:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
5160 | svchost.exe | 40.127.240.158:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
— | — | 192.168.100.255:138 | — | — | — | whitelisted |
5160 | svchost.exe | 23.48.23.167:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
1688 | RUXIMICS.exe | 23.48.23.167:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
4712 | MoUsoCoreWorker.exe | 23.48.23.167:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
5160 | svchost.exe | 2.23.9.218:80 | www.microsoft.com | AKAMAI-AS | CZ | whitelisted |
1688 | RUXIMICS.exe | 2.23.9.218:80 | www.microsoft.com | AKAMAI-AS | CZ | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
sourceforge.net |
| whitelisted |
downloads.sourceforge.net |
| whitelisted |
yer.dl.sourceforge.net |
| whitelisted |
config.edge.skype.com |
| whitelisted |
edge.microsoft.com |
| whitelisted |
business.bing.com |
| whitelisted |
Threats
Process | Message |
|---|---|
msedge.exe | [1224/185803.575:WARNING:device_ticket.cc(151)] Timed out waiting for device ticket. Canceling async operation.
|
msedge.exe | [1224/185803.575:ERROR:device_ticket.cc(187)] The identity is null.
|
msedge.exe | [1224/185806.595:ERROR:filesystem_win.cc(128)] GetFileAttributes C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\attachments\2f9aba5a-b4bd-4314-8be1-4ea2952c5b74: The system cannot find the file specified. (0x2)
|
msedge.exe | [1224/185806.604:ERROR:filesystem_win.cc(128)] GetFileAttributes C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\attachments\2f9aba5a-b4bd-4314-8be1-4ea2952c5b74: The system cannot find the file specified. (0x2)
|
msedge.exe | [1224/185806.640:ERROR:filesystem_win.cc(128)] GetFileAttributes C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\attachments\2f9aba5a-b4bd-4314-8be1-4ea2952c5b74: The system cannot find the file specified. (0x2)
|
msedge.exe | [1224/185806.640:ERROR:filesystem_win.cc(128)] GetFileAttributes C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\attachments\2f9aba5a-b4bd-4314-8be1-4ea2952c5b74: The system cannot find the file specified. (0x2)
|