File name:

setup.exe

Full analysis: https://app.any.run/tasks/618ca795-e4bc-48ff-ad55-bf8bf0bc288f
Verdict: Malicious activity
Analysis date: May 18, 2024, 04:29:29
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

8F7022BA5FE5324CF7A4F97E59AAD32C

SHA1:

9BA91AF704CCE5550F29B93E959ECACCA1968883

SHA256:

611208D0C86A6B0F98F8E2A56C795C53DEC6AD9695558721063EBFDB64C2F66F

SSDEEP:

98304:eCPiN2aTGiHnkYmLYjdOu/hFv8KJ/ioEZOAXKM/z56Y1D3BV00z3AnbdmPGNneKl:5lb0Hx

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • setup.exe (PID: 3980)
      • setup.exe (PID: 2104)
      • setup.tmp (PID: 2108)
      • unins000.exe (PID: 124)
      • _iu14D2N.tmp (PID: 2116)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • setup.exe (PID: 3980)
      • setup.exe (PID: 2104)
      • setup.tmp (PID: 2108)
      • unins000.exe (PID: 124)
      • _iu14D2N.tmp (PID: 2116)

    • Process drops legitimate windows executable

      • setup.tmp (PID: 2108)
      • _iu14D2N.tmp (PID: 2116)

    • Reads the Windows owner or organization settings

      • setup.tmp (PID: 2108)
      • _iu14D2N.tmp (PID: 2116)

    • Starts itself from another location

      • unins000.exe (PID: 124)

    • Starts application with an unusual extension

      • unins000.exe (PID: 124)

  • INFO

    • Checks supported languages

      • setup.exe (PID: 3980)
      • setup.tmp (PID: 3996)
      • setup.exe (PID: 2104)
      • setup.tmp (PID: 2108)
      • unins000.exe (PID: 124)
      • _iu14D2N.tmp (PID: 2116)

    • Create files in a temporary directory

      • setup.exe (PID: 3980)
      • setup.exe (PID: 2104)
      • setup.tmp (PID: 2108)
      • unins000.exe (PID: 124)
      • _iu14D2N.tmp (PID: 2116)

    • Reads the computer name

      • setup.tmp (PID: 3996)
      • setup.tmp (PID: 2108)

    • Creates a software uninstall entry

      • setup.tmp (PID: 2108)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Delphi generic (57.2)
.exe | Win32 Executable (generic) (18.2)
.exe | Win16/32 Executable Delphi generic (8.3)
.exe | Generic Win/DOS Executable (8)
.exe | DOS Executable Generic (8)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2014:07:09 07:58:13+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 65024
InitializedDataSize: 423424
UninitializedDataSize: -
EntryPoint: 0x113bc
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: Blizzard Entertainment
FileDescription: WarCraft III Complete Edition MULTi6 - ElAmigos Setup
FileVersion:
LegalCopyright:
ProductName: WarCraft III Complete Edition MULTi6 - ElAmigos
ProductVersion: 1.27b
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
6
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start setup.exe setup.tmp no specs setup.exe setup.tmp unins000.exe _iu14d2n.tmp

Process information

PID
CMD
Path
Indicators
Parent process
124"C:\Games\WarCraft III\unins000.exe" /VERYSILENT /NODELSAVEC:\Games\WarCraft III\unins000.exe
setup.tmp
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\games\warcraft iii\unins000.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2104"C:\Users\admin\AppData\Local\Temp\setup.exe" /SPAWNWND=$40130 /NOTIFYWND=$20138 C:\Users\admin\AppData\Local\Temp\setup.exe
setup.tmp
User:
admin
Company:
Blizzard Entertainment
Integrity Level:
HIGH
Description:
WarCraft III Complete Edition MULTi6 - ElAmigos Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\appdata\local\temp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2108"C:\Users\admin\AppData\Local\Temp\is-109KO.tmp\setup.tmp" /SL5="$3013C,1639298,489472,C:\Users\admin\AppData\Local\Temp\setup.exe" /SPAWNWND=$40130 /NOTIFYWND=$20138 C:\Users\admin\AppData\Local\Temp\is-109KO.tmp\setup.tmp
setup.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-109ko.tmp\setup.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2116"C:\Users\admin\AppData\Local\Temp\_iu14D2N.tmp" /SECONDPHASE="C:\Games\WarCraft III\unins000.exe" /FIRSTPHASEWND=$201C0 /VERYSILENT /NODELSAVEC:\Users\admin\AppData\Local\Temp\_iu14D2N.tmp
unins000.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\_iu14d2n.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3980"C:\Users\admin\AppData\Local\Temp\setup.exe" C:\Users\admin\AppData\Local\Temp\setup.exe
explorer.exe
User:
admin
Company:
Blizzard Entertainment
Integrity Level:
MEDIUM
Description:
WarCraft III Complete Edition MULTi6 - ElAmigos Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\appdata\local\temp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3996"C:\Users\admin\AppData\Local\Temp\is-8MQDG.tmp\setup.tmp" /SL5="$20138,1639298,489472,C:\Users\admin\AppData\Local\Temp\setup.exe" C:\Users\admin\AppData\Local\Temp\is-8MQDG.tmp\setup.tmp—setup.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-8mqdg.tmp\setup.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
Total events
3 042
Read events
3 010
Write events
25
Delete events
7

Modification events

(PID) Process:(2108) setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
3C080000B8D840FFDBA8DA01
(PID) Process:(2108) setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
117658EB3959F5739228A77E871B2AC83F163C2C6208544170EF0D47E9E3DDCB
(PID) Process:(2108) setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(2108) setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:RegFiles0000
Value:
C:\Games\WarCraft III\xdelta3.exe
(PID) Process:(2108) setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:RegFilesHash
Value:
3AE90A0CEB68E5032F8403586973C6B2F5607C613F873247D6C03EE7B718E189
(PID) Process:(2108) setup.tmpKey:HKEY_CURRENT_USER\Software\ElAmigos
Operation:writeName:InstallPath
Value:
C:\Games
(PID) Process:(2108) setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E8FA15F8-415B-43E1-A04E-A27D6734E624}_is1
Operation:writeName:Inno Setup: Setup Version
Value:
5.5.5 (u)
(PID) Process:(2108) setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E8FA15F8-415B-43E1-A04E-A27D6734E624}_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Games\WarCraft III
(PID) Process:(2108) setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E8FA15F8-415B-43E1-A04E-A27D6734E624}_is1
Operation:writeName:InstallLocation
Value:
C:\Games\WarCraft III\
(PID) Process:(2108) setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E8FA15F8-415B-43E1-A04E-A27D6734E624}_is1
Operation:writeName:Inno Setup: Icon Group
Value:
WarCraft III
Executable files
20
Suspicious files
1
Text files
7
Unknown types
0

Dropped files

PID
Process
Filename
Type
3980setup.exeC:\Users\admin\AppData\Local\Temp\is-8MQDG.tmp\setup.tmpexecutable
MD5:3DA366D45E3D00A61DDFB94C06D0094A
SHA256:97E988BE40A26BBF681618EDD8409F590CF45CE4A7C56DFDF00FE0A385E73732
2108setup.tmpC:\Users\admin\AppData\Local\Temp\is-HKSCH.tmp\issi_splash.bmpimage
MD5:41E95626CF4D975E8A51DB63C5BF9275
SHA256:C45F2D2E84A95A74C63D33E6BF50050EC8AC179D0ED4704966E8CDCEEF10D9B2
2108setup.tmpC:\Users\admin\AppData\Local\Temp\is-HKSCH.tmp\_isetup\_iscrypt.dllexecutable
MD5:A69559718AB506675E907FE49DEB71E9
SHA256:2F6294F9AA09F59A574B5DCD33BE54E16B39377984F3D5658CDA44950FA0F8FC
2108setup.tmpC:\Users\admin\AppData\Local\Temp\is-HKSCH.tmp\wintb.dllexecutable
MD5:9436DF49E08C83BAD8DDC906478C2041
SHA256:1910537AA95684142250CA0C7426A0B5F082E39F6FBDBDBA649AECB179541435
2108setup.tmpC:\Users\admin\AppData\Local\Temp\is-HKSCH.tmp\ISDone.dllexecutable
MD5:4FEAFA8B5E8CDB349125C8AF0AC43974
SHA256:BB8A0245DCC5C10A1C7181BAD509B65959855009A8105863EF14F2BB5B38AC71
2104setup.exeC:\Users\admin\AppData\Local\Temp\is-109KO.tmp\setup.tmpexecutable
MD5:3DA366D45E3D00A61DDFB94C06D0094A
SHA256:97E988BE40A26BBF681618EDD8409F590CF45CE4A7C56DFDF00FE0A385E73732
2108setup.tmpC:\Games\WarCraft III\unins000.exe —
MD5:—
SHA256:—
2108setup.tmpC:\Users\admin\AppData\Local\Temp\is-HKSCH.tmp\1.icoimage
MD5:BCFD9F1E134DAB07B3D555F4078F1063
SHA256:6FA58A4E79734E87057A92EFF2643BFAC9D4D92D7BC2ECB258BABE62239BA611
2108setup.tmpC:\Users\admin\AppData\Local\Temp\is-HKSCH.tmp\callbackctrl.dllexecutable
MD5:F07E819BA2E46A897CFABF816D7557B2
SHA256:68F42A7823ED7EE88A5C59020AC52D4BBCADF1036611E96E470D986C8FAA172D
2108setup.tmpC:\Users\admin\AppData\Local\Temp\is-HKSCH.tmp\2.icoimage
MD5:0EE990AF02BC758FD194844FFC1B66B1
SHA256:34DD2954E50C46C600CC85C6AA6083813F995C6CAC0485498D3C172C13C51139
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
1088
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
setup.exe