File name:

MoE Chemistry Setup.exe

Full analysis: https://app.any.run/tasks/abbaa868-4d52-4eaf-b946-169b8ef13e97
Verdict: Malicious activity
Analysis date: November 03, 2023, 15:33:39
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

52E63AA5752EFC1CDAB9EB48913A5441

SHA1:

67B54D4ED8066BF352F66317D74E770FAAA03B2F

SHA256:

7CF57766C8E838400B1286D0964B5886368DB9C1E32CDA8FD1224C1A9E185636

SSDEEP:

49152:ewE00hfSYUZVkupeYUg7S5fU3pKh8A/7PvLVGVNGHHMwaRsU9xBcsEGVSXbbApG6:M0aAkAUf5fypKh8ADPvoNGHswa79YKVB

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • MoE Chemistry Setup.exe (PID: 3428)
      • MoE Chemistry Setup.exe (PID: 3576)
      • MoE Chemistry Setup.tmp (PID: 3424)
      • 7za.exe (PID: 3900)

  • SUSPICIOUS

    • Reads the Windows owner or organization settings

      • MoE Chemistry Setup.tmp (PID: 3424)

    • Reads the Internet Settings

      • MoE Chemistry Setup.tmp (PID: 3424)

    • Checks Windows Trust Settings

      • MoE Chemistry Setup.tmp (PID: 3424)

    • Reads security settings of Internet Explorer

      • MoE Chemistry Setup.tmp (PID: 3424)

    • Reads settings of System Certificates

      • MoE Chemistry Setup.tmp (PID: 3424)

    • Drops 7-zip archiver for unpacking

      • MoE Chemistry Setup.tmp (PID: 3424)

    • The process drops C-runtime libraries

      • 7za.exe (PID: 3900)

    • Process drops legitimate windows executable

      • 7za.exe (PID: 3900)

  • INFO

    • Create files in a temporary directory

      • MoE Chemistry Setup.exe (PID: 3428)
      • MoE Chemistry Setup.exe (PID: 3576)
      • MoE Chemistry Setup.tmp (PID: 3424)

    • Checks supported languages

      • MoE Chemistry Setup.exe (PID: 3428)
      • wmpnscfg.exe (PID: 3212)
      • MoE Chemistry Setup.tmp (PID: 3432)
      • MoE Chemistry Setup.exe (PID: 3576)
      • MoE Chemistry Setup.tmp (PID: 3424)
      • wmpnscfg.exe (PID: 3836)
      • 7za.exe (PID: 3900)
      • CrocodileChemistry.exe (PID: 3620)

    • Reads the computer name

      • wmpnscfg.exe (PID: 3212)
      • MoE Chemistry Setup.tmp (PID: 3432)
      • MoE Chemistry Setup.tmp (PID: 3424)
      • wmpnscfg.exe (PID: 3836)
      • 7za.exe (PID: 3900)
      • CrocodileChemistry.exe (PID: 3620)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3212)
      • wmpnscfg.exe (PID: 3836)
      • CrocodileChemistry.exe (PID: 3620)

    • Reads the machine GUID from the registry

      • wmpnscfg.exe (PID: 3212)
      • MoE Chemistry Setup.tmp (PID: 3424)
      • wmpnscfg.exe (PID: 3836)
      • CrocodileChemistry.exe (PID: 3620)

    • Checks proxy server information

      • MoE Chemistry Setup.tmp (PID: 3424)

    • Creates files or folders in the user directory

      • MoE Chemistry Setup.tmp (PID: 3424)

    • Creates files in the program directory

      • 7za.exe (PID: 3900)
      • MoE Chemistry Setup.tmp (PID: 3424)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Delphi generic (45.2)
.dll | Win32 Dynamic Link Library (generic) (20.9)
.exe | Win32 Executable (generic) (14.3)
.exe | Win16/32 Executable Delphi generic (6.6)
.exe | Generic Win/DOS Executable (6.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:06:14 15:27:46+02:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 66560
InitializedDataSize: 54272
UninitializedDataSize: -
EntryPoint: 0x1181c
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: وزارة التعليم - المملكة العربية السعودية
FileDescription: المختبرات الافتراضية مادة الكيمياء Setup
FileVersion: 1.0.0
LegalCopyright: Copyright (c) 2019 وزارة التعليم - المملكة العربية السعودية
ProductName: المختبرات الافتراضية مادة الكيمياء
ProductVersion: 1.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
50
Monitored processes
8
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start moe chemistry setup.exe no specs wmpnscfg.exe no specs moe chemistry setup.tmp no specs moe chemistry setup.exe moe chemistry setup.tmp wmpnscfg.exe no specs 7za.exe no specs crocodilechemistry.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3212"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
3424"C:\Users\admin\AppData\Local\Temp\is-RHDAC.tmp\MoE Chemistry Setup.tmp" /SL5="$90184,652986,121856,C:\Users\admin\AppData\Local\Temp\MoE Chemistry Setup.exe" /SPAWNWND=$501FC /NOTIFYWND=$60134 C:\Users\admin\AppData\Local\Temp\is-RHDAC.tmp\MoE Chemistry Setup.tmp
MoE Chemistry Setup.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-rhdac.tmp\moe chemistry setup.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3428"C:\Users\admin\AppData\Local\Temp\MoE Chemistry Setup.exe" C:\Users\admin\AppData\Local\Temp\MoE Chemistry Setup.exe—explorer.exe
User:
admin
Company:
وزارة التعليم - المملكة العربية السعودية
Integrity Level:
MEDIUM
Description:
المختبرات الافتراضية مادة الكيمياء Setup
Exit code:
0
Version:
1.0.0
Modules
Images
c:\users\admin\appdata\local\temp\moe chemistry setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3432"C:\Users\admin\AppData\Local\Temp\is-G0ET5.tmp\MoE Chemistry Setup.tmp" /SL5="$60134,652986,121856,C:\Users\admin\AppData\Local\Temp\MoE Chemistry Setup.exe" C:\Users\admin\AppData\Local\Temp\is-G0ET5.tmp\MoE Chemistry Setup.tmp—MoE Chemistry Setup.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-g0et5.tmp\moe chemistry setup.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3576"C:\Users\admin\AppData\Local\Temp\MoE Chemistry Setup.exe" /SPAWNWND=$501FC /NOTIFYWND=$60134 C:\Users\admin\AppData\Local\Temp\MoE Chemistry Setup.exe
MoE Chemistry Setup.tmp
User:
admin
Company:
وزارة التعليم - المملكة العربية السعودية
Integrity Level:
HIGH
Description:
المختبرات الافتراضية مادة الكيمياء Setup
Exit code:
0
Version:
1.0.0
Modules
Images
c:\users\admin\appdata\local\temp\moe chemistry setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3620"C:\Program Files\المختبرات الافتراضية مادة الكيمياء\CrocodileChemistry.exe" C:\Program Files\المختبرات الافتراضية مادة الكيمياء\CrocodileChemistry.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\program files\المختبرات الافتراضية مادة الكيمياء\crocodilechemistry.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\المختبرات الافتراضية مادة الكيمياء\qt-mt336.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
3836"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
3900"C:\Users\admin\AppData\Local\Temp\is-VS6FM.tmp\7za.exe" x -y -o"C:\Program Files\المختبرات الافتراضية مادة الكيمياء" -x!unins000.* "C:\Users\admin\AppData\Local\Temp\is-VS6FM.tmp\MoE_Chemistry_Setup.tmp"C:\Users\admin\AppData\Local\Temp\is-VS6FM.tmp\7za.exe—MoE Chemistry Setup.tmp
User:
admin
Company:
Igor Pavlov
Integrity Level:
HIGH
Description:
7-Zip Standalone Console
Exit code:
0
Version:
16.04
Modules
Images
c:\users\admin\appdata\local\temp\is-vs6fm.tmp\7za.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
Total events
5 679
Read events
5 643
Write events
24
Delete events
12

Modification events

(PID) Process:(3212) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{8BA85B40-4BFB-4832-905D-EDEDBE311F21}\{CE7EA37A-9F07-4BA5-B70F-0CF391F5C737}
Operation:delete keyName:(default)
Value:
(PID) Process:(3212) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{8BA85B40-4BFB-4832-905D-EDEDBE311F21}
Operation:delete keyName:(default)
Value:
(PID) Process:(3212) wmpnscfg.exeKey:HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Health\{84898FAF-7BBC-4CA6-9771-9DECC7061280}
Operation:delete keyName:(default)
Value:
(PID) Process:(3424) MoE Chemistry Setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3424) MoE Chemistry Setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000059010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3424) MoE Chemistry Setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3424) MoE Chemistry Setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3424) MoE Chemistry Setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3424) MoE Chemistry Setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3424) MoE Chemistry Setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
Executable files
19
Suspicious files
37
Text files
1 902
Unknown types
0

Dropped files

PID
Process
Filename
Type
3424MoE Chemistry Setup.tmpC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04binary
MD5:2D2A4FCA9FDD239B71CA447AEFE3E9F0
SHA256:DCC8312FE5523DF06D6CE04BE5540056B5763BF5F81E0297A660A0F9FC402FBB
3424MoE Chemistry Setup.tmpC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:1BFE591A4FE3D91B03CDF26EAACD8F89
SHA256:9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
3424MoE Chemistry Setup.tmpC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\CRQQ2MTW.txttext
MD5:8AFE62798AF4FA26D51563789080FBF0
SHA256:8244034130EF9C9A4BFF8C1AD5EE905D9D00FFF2BB586174A94D8B6816975747
3424MoE Chemistry Setup.tmpC:\Users\admin\AppData\Local\Temp\is-VS6FM.tmp\idp.dllexecutable
MD5:55C310C0319260D798757557AB3BF636
SHA256:54E7E0AD32A22B775131A6288F083ED3286A9A436941377FC20F85DD9AD983ED
3428MoE Chemistry Setup.exeC:\Users\admin\AppData\Local\Temp\is-G0ET5.tmp\MoE Chemistry Setup.tmpexecutable
MD5:E8153D0EAB7853B4E45AB0633C75687B
SHA256:0E8F0CF05C4DFC11F932B6F4D6B89210A21D8FD103C7DB82505B00054DEB3ACE
3576MoE Chemistry Setup.exeC:\Users\admin\AppData\Local\Temp\is-RHDAC.tmp\MoE Chemistry Setup.tmpexecutable
MD5:E8153D0EAB7853B4E45AB0633C75687B
SHA256:0E8F0CF05C4DFC11F932B6F4D6B89210A21D8FD103C7DB82505B00054DEB3ACE
3424MoE Chemistry Setup.tmpC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04binary
MD5:6005D7DF8DE9FA76E0E5DE105FFABD3F
SHA256:EC2DE2A07C6A609ABA759C19DF7A978FB88F8938D28C509425E1AA3CB073D567
3424MoE Chemistry Setup.tmpC:\Users\admin\AppData\Local\Temp\is-VS6FM.tmp\CSplash.bmpimage
MD5:3BE94F69D01AD341435FFC8AC18CAC7A
SHA256:209CBDD67353CD417C08DDFC45C046A1B146D8620097815E1BD97F60C387B374
39007za.exeC:\Program Files\المختبرات الافتراضية مادة الكيمياء\cceditor.dllexecutable
MD5:7F0FD8F0C8087ADF6B33990854BB1D4E
SHA256:3CD532B1819EDA05F5B87E0B0BB7C6EBC52C4EDED469E57C2D50E2033DC182E9
39007za.exeC:\Program Files\المختبرات الافتراضية مادة الكيمياء\autorun.infbinary
MD5:42EDF2DBF8F59F4183E7E2F4563060C5
SHA256:A632C37D3E3B7A54F457D8D11AF0AE843A788AF275BC57E6A2E845D9A7D8DFE0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
8
DNS requests
4
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3424
MoE Chemistry Setup.tmp
HEAD
301
67.199.248.11:80
http://bit.ly/2WgxImu
unknown
—
—
unknown
3424
MoE Chemistry Setup.tmp
HEAD
301
67.199.248.11:80
http://bit.ly/2WgxImu
unknown
—
—
unknown
3424
MoE Chemistry Setup.tmp
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAv4pCY7dOqroY%2Fobakg4w8%3D
unknown
binary
471 b
unknown
3424
MoE Chemistry Setup.tmp
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D
unknown
binary
471 b
unknown
3424
MoE Chemistry Setup.tmp
GET
200
178.79.242.0:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?360d3c682df81f63
unknown
compressed
4.66 Kb
unknown
3424
MoE Chemistry Setup.tmp
GET
301
67.199.248.11:80
http://bit.ly/2WgxImu
unknown
html
167 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3424
MoE Chemistry Setup.tmp
67.199.248.11:80
bit.ly
GOOGLE-CLOUD-PLATFORM
US
shared
3424
MoE Chemistry Setup.tmp
162.125.66.15:443
dl.dropboxusercontent.com
DROPBOX
DE
malicious
3424
MoE Chemistry Setup.tmp
178.79.242.0:80
ctldl.windowsupdate.com
LLNW
DE
whitelisted
3424
MoE Chemistry Setup.tmp
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
bit.ly
  • 67.199.248.11
  • 67.199.248.10
shared
dl.dropboxusercontent.com
  • 162.125.66.15
shared
ctldl.windowsupdate.com
  • 178.79.242.0
  • 95.140.236.0
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted

Threats

PID
Process
Class
Message
3424
MoE Chemistry Setup.tmp
Misc activity
ET INFO DropBox User Content Domain (dl .dropboxusercontent .com in TLS SNI)
3424
MoE Chemistry Setup.tmp
Misc activity
ET INFO DropBox User Content Download Access over SSL M2
3 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
MoE Chemistry Setup.exe