File name:

setup.exe

Full analysis: https://app.any.run/tasks/618ca795-e4bc-48ff-ad55-bf8bf0bc288f
Verdict: Malicious activity
Analysis date: May 18, 2024, 04:29:29
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

8F7022BA5FE5324CF7A4F97E59AAD32C

SHA1:

9BA91AF704CCE5550F29B93E959ECACCA1968883

SHA256:

611208D0C86A6B0F98F8E2A56C795C53DEC6AD9695558721063EBFDB64C2F66F

SSDEEP:

98304:eCPiN2aTGiHnkYmLYjdOu/hFv8KJ/ioEZOAXKM/z56Y1D3BV00z3AnbdmPGNneKl:5lb0Hx

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • setup.exe (PID: 3980)
      • setup.exe (PID: 2104)
      • setup.tmp (PID: 2108)
      • _iu14D2N.tmp (PID: 2116)
      • unins000.exe (PID: 124)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • setup.exe (PID: 3980)
      • setup.exe (PID: 2104)
      • setup.tmp (PID: 2108)
      • unins000.exe (PID: 124)
      • _iu14D2N.tmp (PID: 2116)

    • Process drops legitimate windows executable

      • setup.tmp (PID: 2108)
      • _iu14D2N.tmp (PID: 2116)

    • Reads the Windows owner or organization settings

      • setup.tmp (PID: 2108)
      • _iu14D2N.tmp (PID: 2116)

    • Starts itself from another location

      • unins000.exe (PID: 124)

    • Starts application with an unusual extension

      • unins000.exe (PID: 124)

  • INFO

    • Create files in a temporary directory

      • setup.exe (PID: 3980)
      • setup.exe (PID: 2104)
      • setup.tmp (PID: 2108)
      • unins000.exe (PID: 124)
      • _iu14D2N.tmp (PID: 2116)

    • Checks supported languages

      • setup.exe (PID: 3980)
      • setup.tmp (PID: 3996)
      • setup.exe (PID: 2104)
      • setup.tmp (PID: 2108)
      • unins000.exe (PID: 124)
      • _iu14D2N.tmp (PID: 2116)

    • Reads the computer name

      • setup.tmp (PID: 3996)
      • setup.tmp (PID: 2108)

    • Creates a software uninstall entry

      • setup.tmp (PID: 2108)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Delphi generic (57.2)
.exe | Win32 Executable (generic) (18.2)
.exe | Win16/32 Executable Delphi generic (8.3)
.exe | Generic Win/DOS Executable (8)
.exe | DOS Executable Generic (8)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2014:07:09 07:58:13+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 65024
InitializedDataSize: 423424
UninitializedDataSize: -
EntryPoint: 0x113bc
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: Blizzard Entertainment
FileDescription: WarCraft III Complete Edition MULTi6 - ElAmigos Setup
FileVersion:
LegalCopyright:
ProductName: WarCraft III Complete Edition MULTi6 - ElAmigos
ProductVersion: 1.27b
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
6
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start setup.exe setup.tmp no specs setup.exe setup.tmp unins000.exe _iu14d2n.tmp

Process information

PID
CMD
Path
Indicators
Parent process
124"C:\Games\WarCraft III\unins000.exe" /VERYSILENT /NODELSAVEC:\Games\WarCraft III\unins000.exe
setup.tmp
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\games\warcraft iii\unins000.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2104"C:\Users\admin\AppData\Local\Temp\setup.exe" /SPAWNWND=$40130 /NOTIFYWND=$20138 C:\Users\admin\AppData\Local\Temp\setup.exe
setup.tmp
User:
admin
Company:
Blizzard Entertainment
Integrity Level:
HIGH
Description:
WarCraft III Complete Edition MULTi6 - ElAmigos Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\appdata\local\temp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2108"C:\Users\admin\AppData\Local\Temp\is-109KO.tmp\setup.tmp" /SL5="$3013C,1639298,489472,C:\Users\admin\AppData\Local\Temp\setup.exe" /SPAWNWND=$40130 /NOTIFYWND=$20138 C:\Users\admin\AppData\Local\Temp\is-109KO.tmp\setup.tmp
setup.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-109ko.tmp\setup.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2116"C:\Users\admin\AppData\Local\Temp\_iu14D2N.tmp" /SECONDPHASE="C:\Games\WarCraft III\unins000.exe" /FIRSTPHASEWND=$201C0 /VERYSILENT /NODELSAVEC:\Users\admin\AppData\Local\Temp\_iu14D2N.tmp
unins000.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\_iu14d2n.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3980"C:\Users\admin\AppData\Local\Temp\setup.exe" C:\Users\admin\AppData\Local\Temp\setup.exe
explorer.exe
User:
admin
Company:
Blizzard Entertainment
Integrity Level:
MEDIUM
Description:
WarCraft III Complete Edition MULTi6 - ElAmigos Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\appdata\local\temp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3996"C:\Users\admin\AppData\Local\Temp\is-8MQDG.tmp\setup.tmp" /SL5="$20138,1639298,489472,C:\Users\admin\AppData\Local\Temp\setup.exe" C:\Users\admin\AppData\Local\Temp\is-8MQDG.tmp\setup.tmp—setup.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-8mqdg.tmp\setup.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
Total events
3 042
Read events
3 010
Write events
25
Delete events
7

Modification events

(PID) Process:(2108) setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
3C080000B8D840FFDBA8DA01
(PID) Process:(2108) setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
117658EB3959F5739228A77E871B2AC83F163C2C6208544170EF0D47E9E3DDCB
(PID) Process:(2108) setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(2108) setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:RegFiles0000
Value:
C:\Games\WarCraft III\xdelta3.exe
(PID) Process:(2108) setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:RegFilesHash
Value:
3AE90A0CEB68E5032F8403586973C6B2F5607C613F873247D6C03EE7B718E189
(PID) Process:(2108) setup.tmpKey:HKEY_CURRENT_USER\Software\ElAmigos
Operation:writeName:InstallPath
Value:
C:\Games
(PID) Process:(2108) setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E8FA15F8-415B-43E1-A04E-A27D6734E624}_is1
Operation:writeName:Inno Setup: Setup Version
Value:
5.5.5 (u)
(PID) Process:(2108) setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E8FA15F8-415B-43E1-A04E-A27D6734E624}_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Games\WarCraft III
(PID) Process:(2108) setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E8FA15F8-415B-43E1-A04E-A27D6734E624}_is1
Operation:writeName:InstallLocation
Value:
C:\Games\WarCraft III\
(PID) Process:(2108) setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E8FA15F8-415B-43E1-A04E-A27D6734E624}_is1
Operation:writeName:Inno Setup: Icon Group
Value:
WarCraft III
Executable files
20
Suspicious files
1
Text files
7
Unknown types
0

Dropped files

PID
Process
Filename
Type
2108setup.tmpC:\Users\admin\AppData\Local\Temp\is-HKSCH.tmp\_isetup\_iscrypt.dllexecutable
MD5:A69559718AB506675E907FE49DEB71E9
SHA256:2F6294F9AA09F59A574B5DCD33BE54E16B39377984F3D5658CDA44950FA0F8FC
2108setup.tmpC:\Users\admin\AppData\Local\Temp\is-HKSCH.tmp\_isetup\_shfoldr.dllexecutable
MD5:92DC6EF532FBB4A5C3201469A5B5EB63
SHA256:9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
2108setup.tmpC:\Users\admin\AppData\Local\Temp\is-HKSCH.tmp\callbackctrl.dllexecutable
MD5:F07E819BA2E46A897CFABF816D7557B2
SHA256:68F42A7823ED7EE88A5C59020AC52D4BBCADF1036611E96E470D986C8FAA172D
2108setup.tmpC:\Users\admin\AppData\Local\Temp\is-HKSCH.tmp\CLS-MSC.dllexecutable
MD5:67A3A34ECAFC68AFDF05F71657EE0009
SHA256:6D3D6B0FF25FD2AC2C8D478B068AF55CB053D9B2C08C53964D6559C7C8B8047D
2108setup.tmpC:\Users\admin\AppData\Local\Temp\is-HKSCH.tmp\ISDone.dllexecutable
MD5:4FEAFA8B5E8CDB349125C8AF0AC43974
SHA256:BB8A0245DCC5C10A1C7181BAD509B65959855009A8105863EF14F2BB5B38AC71
2108setup.tmpC:\Users\admin\AppData\Local\Temp\is-HKSCH.tmp\1.icoimage
MD5:BCFD9F1E134DAB07B3D555F4078F1063
SHA256:6FA58A4E79734E87057A92EFF2643BFAC9D4D92D7BC2ECB258BABE62239BA611
2108setup.tmpC:\Games\WarCraft III\unins000.exe —
MD5:—
SHA256:—
2108setup.tmpC:\Users\admin\AppData\Local\Temp\is-HKSCH.tmp\2.icoimage
MD5:0EE990AF02BC758FD194844FFC1B66B1
SHA256:34DD2954E50C46C600CC85C6AA6083813F995C6CAC0485498D3C172C13C51139
2108setup.tmpC:\Users\admin\AppData\Local\Temp\is-HKSCH.tmp\unarc.dllexecutable
MD5:2CED17F02B24372C166FAAF7DA2DFFB3
SHA256:89952411324163A635942DB33DD0087508E20D112E1E75403DC1D5E852927DD7
2108setup.tmpC:\Users\admin\AppData\Local\Temp\is-HKSCH.tmp\3.icoimage
MD5:03623E728A8FF98BA17812B8AD1B00AB
SHA256:14BAE90A5AD2F623BBC0FB26FA31108F5340A120FDCA23A1608EC91C7EC8435D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
1088
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
setup.exe